Matisse stolen 10 years ago found in US

Portrait of Henri Matisse 1933 May 20 (Photo credit: Wikipedia)

On July 16, a plane from Mexico City landed in Miami Airport. One of the passengers was a woman holding a bright-red tube that contained a rolled canvas of Henri Matisse. She left the airport for what would turn out to be a meeting with the law.

A few days later news emerged that an FBI operation in Florida had successfully retrieved a painting by Henri Matisse that had been stolen from a Venezuelan Art Museum in 2002. The hunt took almost ten years, and only last week two suspects were arrested when trying to sell the “Odalisque In Red Pants”.

Undercover FBI agents arrested Miami resident Pedro Antonio Marcuello Guzman, 46, and Maria Martha Elisa Ornelas Lazo, 50, of Mexico City when they were trying to sell the painting. The dealers did not even conceal the fact that the canvas had been stolen, thus explaining their incredibly low asking price. Despite the fact that Matisse’s painting was estimated at $3 million, they were ready to sell it for only $740,000. Now, the unfortunate black market art dealers are facing long-term prison sentences.

One would think that the crime had been solved, and that the investigators can head home job well done – but things are not that simple. The history of the theft of the painting is, in fact, rather complex. The “Odalisque In Red Pants” painted by Henri Matisse in 1925 was purchased by the Museum of Modern Art in Caracas in 1981 from a New York gallery for half a million dollars.

The picture was long considered one of the gems of the museum’s collection, but in 2003 information appeared that the “Odalisque” was for sale on the black market. After a close examination it turned out that the painting in the museum’s collection was a forgery. Obviously, unidentified criminals had stolen the original painting replacing it with a fake so skillfully made that museum specialists had not been aware of the swap for quite a long time. The investigators failed to establish the exact time of the crime, but it was most likely committed in 2002.

Now a comprehensive examination is needed in order to figure out whether the picture obtained in the FBI operation is the original stolen from Caracas, or if it is yet another high-quality forgery.

The search for stolen art objects often takes many years, and it is not only the robbed owners that become victims in such situations, but also the new owners of the paintings. For example, not so long ago, Niko Pirosmani’s painting the “Black Lion”, stolen back in 1993 from the house of the former rector of the Georgian Academy of Arts Apollon Kutateladze, was discovered in Moscow. A major scandal broke out, but it turned out that the painting was legally purchased at an auction. After the new owner of the paintings became aware of its criminal past, he went to Tbilisi and re-bought the picture, which is considered to be one of the best works by Pirosmani, from the family of the artist Apollon Kutateladze.

Armen Apresyan

March 8, 2012: The Internet Doomsday Effect on India

On March 8, 2012, for millions around the world Internet will be forcibly shut down! This comes as a consequence of a virus that got so big that it infected millions of computers and is still looming large!

 The case goes back to 2007 when six Estonian men got together to create a botnet to spread DNSChanger malware that tapped into fraudulent servers, directing Web users to unintended – and sometimes illegal – sites. As a part of Operation Ghost Click, FBI took control over the botnet’s command and control servers in November, 2011 and replaced the rogue servers with temporary legitimate servers that were allowed to run only for 120 days – a deadline that is fast running out.

The propagation of DNSChanger was no different from that of other malware. The malware authors learned early that by controlling a user’s DNS servers, they could control and interfere with the user’s Internet browsing habits. This was carried out by manipulating online ads through click jacking. The victims were unaware that their PCs had been compromised – or that the malware turned their PCs defenseless to a swarm of other viruses.

To understand how a DNSChanger works it helps to explore what DNS means and who the stakeholders are. Domain Name System (DNS) is an Internet service that converts domain names into the numerical Internet Protocol (IP) addresses that allow computers to communicate with each other. When you enter a domain name for example, http://www.india.gov.in in the address bar of your browser, your computer contacts DNS servers to determine the IP address for the website. This IP address is used to locate and connect to that website. DNS servers are operated by your ISPs (Internet Service Providers) and are included in your PC’s network configuration. 

DNSChanger belongs to a class of malware that works in one of the two ways described below:

1.  Alters the user’s DNS server settings to replace the ISP’s good DNS with rogue DNS servers operated by the criminals.

2.  Internet devices like routers or home gateways are the targets. If you have a factory set password that is usually easy to break, then the chances are high that the malware can infect the system or a network by changing the DNS settings inside the router as well.

Additionally what the malware also does is that it prevents your PC from obtaining operating system and anti-malware updates – both crucial for protecting your PC from cyber threats.  This also widens the possibility of more malware attacks.

When FBI made a crack-down on this botnet, approximately 4 million PCs in more than 100 countries had been compromised. The criminals had managed to mint $14 million in illicit fees! The replacement servers provided by the FBI were not supposed to remove the malware or other nefarious viruses that it may have aided – from infected computers. The sole purpose was to ensure that users do not lose DNS services.

Over half of Fortune 500 companies and 27 out of 55 government entities have at least one PC or router still infected with DNSChanger. Translating to about 500,000 live infections! Our malware team has reported over 70 variants to DNSChanger malware and thousands of positive cases in India alone.

Before the panic attack sets in, it is wise to understand the ways in which you can deal with this issue. First, the DNSChanger malware must be removed from the system/s. One should take a back-up of all important data and then remove the malware using good Antivirus software.

After this has been carried out, the DNS settings on all affected devices must be set to their correct values. You can seek assistance from your ISP for accurate DNS settings to be used.

If a network has been affected then the DNS settings all PCs on that LAN should be rectified. There are no sure fixes to the malware. There are several tools available that will allow you to change the DNS Settings but the rogue entries still remain in the router. To restore settings in the router you would have to either consult your product manuals or contact the manufacturer.

Related articles

• A major Trojan Horse is lurking – coming soon to a computer near you (ravenit.com)
• FBI Shutting Down DNS Servers of the Day (geeks.thedailywh.at)
• FBI Report on DNSChanger Malware (bespacific.com)
• Active and Passive Auditing of DNS Servers in Use – Finding DNSChanger Malware (tenablesecurity.com)