Twitter bans obvious passwords

An applause for Twitter which has recently made it so that when you sign up for an account you can't use one of those very obvious passwords.

Here is a list of the passwords (courtesy of The Wundercounter)

So, if you currently use passwords which resemble any of those listed, I would encourage you to change them as soon as possible.

Researchers Prepare Practical Demonstration Of GSM Encryption Cracking Technology

GSM calls can be intercepted and decoded using low-cost hardware and open-source software, researchers say.

Security researchers Karsten Nohl and Chris Paget presented their findings in a presentation (WMV video) Monday at the 26th Chaos Communication Congress (CCC) in Berlin. A practical demonstration of the vulnerabilities and potential exploits is scheduled to take place at the conference on Wednesday at 12:00 GMT.

The demonstration is a follow-up to a presentation the two researchers made in August at the Hacking At Random conference, during which they outlined serious flaws in the GSM encryption scheme.

GSM is used in approximately 80 percent of the world's mobile communications systems, and in about 3 billion cell phones across the globe, according to industry estimates. In his CCC presentation yesterday, Nohl pointed out that much data has already been published about GSM's vulnerabilities, but the pair's new research takes it one step further -- by showing how GSM calls can be intercepted and decoded using relatively low-cost hardware and open-source software that is readily available on the Web.

Organizations should assume that within six months of the demo GSM phone calls will be at risk, says Stan Schatt, vice president and practice director for healthcare and security at ABI Research.

For full report, read here.

Phishers prefer Paypal, Visa, eBay and Amex

Compared to the first half of 2009, the amount of phishing messages has remained relatively unchanged, although phishers have switched their focus to institutions that could bring them the most profit in the shortest timeframe. This is one of the results of BitDefender's malware and spam survey.

Primary targets are PayPal, Visa and eBay, followed by HSBC, American Express and Abbey Bank. Ally Bank and Bank of America rank last with a little over one percent of the total amount of phishing messages. These messages mostly target English-speaking computer users who are using the services of at least one of the institutions previously mentioned.

BitDefender Labs found that most web 2.0 phishing attempts in the first half of 2009 relied on social engineering schemes and speculated user naivety. The Twitter Porn Name scam is a good example. Users were invited to reveal their first pet name, as well as the first street on which they lived. These names are usually employed as backup/security questions. An e-crook possessing a person’s username along with these “clues” can easily retrieve a password that he or she can later employ to access the account and send spam, access transactions, or use the account in whatever way necessary to make a profit, including demanding a ransom for release of the hijacked account.

“2009 witnessed a wide range of security threats aiming at both end-users and at corporate networks,” Vâlceanu commented. “Extra caution and a highly-rated antimalware solution with antispam, antiphishing and antimalware modules are a must-have for anyone surfing the web in 2010.”

(Not So) Happy Holidays from Koobface

New variants of Koobface are emerging that attempt to trick Facebook users in to downloading fun images or gifts, associated with the holiday season. Please be careful on all social networks as they are very popular and a target for malware writers and criminals to take advantage of folks.

Extract from report:
"Activities associated with Koobface have increased during the month of December. This morning we noticed a trend with some of the domain-based locations making use of the holiday theme. This has included everything from “presents for your pets” to “festive holiday trees” – these are domains that appear legitimate but are not.

When users go to these sites for these happy holiday thoughts – they are instead instantly greeted by having files downloaded to their computers. And voila – a lovely “gift” is attempting to execute upon them. The gift of holiday identity theft!"

Facebook Hit By Clickjacking Attack

Facebook is cleaning up after a clickjacking attack that infiltrated the social networking site this week -- and security experts say this won't be the last such attack.

Clickjacking, in which an attacker slips a malicious link or malware onto a legitimate Web page that appears to contain normal content, is an emerging threat experts have been warning about.

The attack on Facebook was in the form of a comment on a user's account with a photo that lured the victim to click on it.
The embedded link took the victim to a Web page that presented like a CAPTCHA or Turing test, and asked the user to click on a blue "Share" button on the Facebook page. (as shown below)
Once clicked, the victim is redirected to a YouTube video, and then the same post shows up on the victim's account and thus tries to infect his or her friends. Security experts say the attack appeared to be more of a prank or trial balloon, and it affects only Firefox and Chrome browsers, according to security expert Krzysztof Kotowicz, who blogged about the attack this week.

Facebook has now blocked the URL to the malicious site, fb.59.to.

Full reports here and here.

Twitter attacker had proper credentials

If the earlier report about Twitter's DNS being compromised was bad enough, I guess this would emphasize the severity of the threat.

While Twitter has remained largely quiet on the hour-long hijacking of its domain name, additional information suggests that the attacker had compromised at least one user at the social networking company.

On Thursday, an unknown attacker hijacked Twitter's domain name and redirected visitors to an unrelated site hosting a page claiming Twitter had been hacked by the "Iranian Cyber Army." Evidence indicates, however, that the attackers were able to change the domain-name system (DNS) entries at Twitter's provider, Dyn Inc., said Rod Rasmussen, president and CEO of Internet Identity, an infrastructure security firm which monitors DNS changes.

"First of all the name servers themselves didn't change, so someone was updating things at the provider," Rasmussen said. Because other clients were not showing signs of DNS hijacking, it's unlikely that Dyn itself had been breached, Rasmussen said. "We didn't see anything else at Dyn that indicated signs of that the service had been compromised."

On Friday, Dyn confirmed that the attacker had the proper credentials to log into Twitter's account with the company and change the addressed assigned to various hosts in the Twitter.com domain. While some media reports have called the attack a hack or a defacement against the site, neither term applies, said Kyle York, vice president of sales and marketing for the firm.

"From our point of view, no unauthenticated users logged into the system," York said.

Adobe PDF Reader - Zero Day JavaScript attacks circulating in the wild

Please be careful with all PDF files, keep AV protection updated, and look for future Adobe releases which will address this issue. I usually keep JS off unless it's required to fill out a PDF form.

Adobe PDF Reader - Zero Day attack circulating
http://www.adobe.com/support/security/advisories/apsa09-07.html
http://www.avertlabs.com/research/blog/index.php/2009/12/16/another-adobe-reader-zero-day-take-care/

QUOTE: Adobe has confirmed a critical vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions that could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild. Adobe recommends customers follow the mitigation guidance below until a patch is available

HOW TO DISABLE JAVASCRIPT IN ADOBE READER:

Customers can mitigate the issue by disabling JavaScript in Adobe Reader and Acrobat using the instructions below:

1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the 'Enable Acrobat JavaScript' option
5. Click OK

Twitter investigates DNS hijack

Twitter, the popular micro-blogging network, welcomed visitors on Thursday night with a page claiming that the site had been hacked by a defacers with links to Iran.

In reality, the company's domain name had been hijacked by the vandals and visitors redirected to an unrelated site hosting the page. Passive domain-name service (DNS) records showed the DNS poisoning, as Twitter's record pointed first to two domains registered in Moldova and then to a domain registered to an undisclosed person in Pompano Beach, Florida, according to information posted by the SANS Internet Storm Center.

Twitter acknowledged the issue late last night, following earlier media reports.

Defacement was claimed to be done by the "Iranian Cyber Army," but another message -- translated from Farsi by Google's automated translation engine -- reportedly claimed the attack was motivated by the U.S. and Twitter's interference in "my country," suggesting the attacker was an individual.

There's No Such Thing as a Free Movie

Those looking to see the latest 3D blockbuster movie, The Avatar, on the cheap will have to take great care in what they search for. We have become aware of at least one site that has been rigged to redirect users to a page that presents the now-familiar "play video/need codec" screen. In an unusual twist, this time it is offering a new ActiveX update rather than the usual codec or Flash player updates.

Read on to see what new tricks these scammers have up their sleeves.

Koobface Botnet - New Christmas Theme

Facebook and other users of web 2.0 social networks should be careful and avoid unusual messages or spammed comments on their sites, and a new variant of the Koobface worm is circulating with a Christmas based theme.

The Koobface botnet, one of the most efficient social engineering driven botnets, is entering the Xmas season with a newly introduced template spoofing a YouTube video page, in between enticing the visitor into installing a bogus Adobe Flash Player Update (New Koobface campaign spoofs Adobe’s Flash updater), which remains one of the most popular social engineering tactics used by the botnet master

Full report here:
http://blogs.zdnet.com/security/?p=5001

Bit.ly steps up security

Bit.ly, one of the most popular URL shortening services, announced it will be integrating three new security-related services by the end of the year:

1. Websense's ThreatSeeker Cloud security-as-a-service solution - to analyze and categorize the Web sites and content behind millions of shortened bit.ly URLs created daily to protect end users from "spammy URLs, malicious content and phishing sites."

2. VeriSign’s iDefense IP reputation service - to detect malware and "blacklist URLs, domains, and IP addresses which host exploits, malicious code, command and control servers, drop sites and other nefarious activity."

3. Sophos' security service - to identify malware and spam by using behavioral analysis.

Very good news, indeed!

Illegal Games? Pay the Price—Publicly!

Security Response has discovered a threat that is being talked about among some members of certain discussion groups in Japan. The threat, named Infostealer.Kenzero, teaches yet another lesson to those using file-sharing networks not to download illegal games. Infostealer.Kenzero primarily arrives in the guise of setup.exe, which in this case is a fake installation file for Japanese pornographic games that are circulating around the file-sharing network “Share.” Several pornographic games have been reported to include this malicious setup.exe file.

Once the setup.exe file is executed it attempts to download image files (.bmp) from a predetermined website. Using these images, the threat brings up a form that asks the user to enter personal information, including his or her full name, password for the game, email address, postal code, residential address, gender, company name, and telephone number. Users who desperately want to play the games may hurriedly complete the form without realizing that this dangerous online practice will come back and haunt them. They will soon find out that the information they have provided is to be made available on a public website, along with system information and screenshots of their desktop.

We have come across several similar cases before. However, those uploaded desktop pictures and private information do not seem to be punishment enough. As a security company we are always looking out for the users, but if you are navigating a dodgy and deceitful place, you must pay extra attention—just like you would in the real world.

What is the moral of this story? Always use legal and legitimate software.

Source:

http://www.symantec.com/connect/blogs/illegal-games-pay-price-publicly

Microsoft releases password attack data

Microsoft released data collected from an FTP-server honeypot, showing that attempts to guess passwords continue to focus on the low-hanging fruit: passwords with an average length of eight characters, with "password" and "123456" being the most common.

The data is part of a project to monitor attacks that everyday users might encounter on a regular basis. Most of the attacks attempted to log into the administrator account on English and French computers -- "Administrator" and "Administrateur" were, by far, the two most popular usernames -- using a variety of passwords. The attackers were typically compromised computer that were part of a botnet, Microsoft researchers stated on the company's Malware Protection Center blog.

"You should take care of what user name and password you're choosing," the researchers wrote. "If your account has no limit on the number of login attempts, then knowing the user name is like having half the job done."

In one case, an attacker made more than 400,000 attempts to guess a user name password combination.

The most common passwords were password, 123456, #!comment:, changeme and an expletive.

Microsoft recommended that users create passwords consisting of letters, numbers and special characters using a combination of lower and upper case. The average length of the password attacks was eight characters, so users should focus on longer passwords, the researchers stated.

MySpace phishing and malware combo

F-Secure warns about phishing emails that urge users to update their MySpace accounts. If you fall for the trick and follow the link, you are taken to a fake MySpace page, where you are asked to enter your username and password. The login information is then used to hijack your account and use it for spreading malware.

But that is not enough for the bad guys. Upon logging on, you encounter the following request:

The update tool is, of course, malware - a Zeus/Zbot variant.

Phishers Playing Games?

Phishers are constantly targeting newer brands from diverse industries, with the sole motive of fraudulently acquiring a large amount of users’ confidential information for financial gains. Symantec has observed and followed up with some recent trends in phishing attacks targeting some of the popular online gaming websites. Since the beginning of this year there has been a steady rise in phishing attacks on gaming websites.

Using these fake websites, phishers are employing tactics to acquire online gaming registrations and product keys from the intended victims.

Read on to find out the tactics observed.

New iPhone Worm attempts to build botnet

iPhone users beware.

History repeats itself, as safety trade-offs occur when a product's security layers are altered for ease-of-use or greater functionality. There is very limited exposure for this new threat that F-Secure is currently analyzing. It only impacts devices where Apple's original security safeguards for the iPhone are intentionally altered through a process called "Jailbreaking".

Read the analysis here.

QUOTE: "it only affects Jailbroken iPhones which have SSH installed and have not changed the default password. This one connects to a web-based command & control center running in Lithuania. The worm is not widespread, but it is much more serious than the first iPhone worm as it seems to try to steal information from the devices."

Other useful reads:

How it works
http://www.net-security.org/malware_news.php?id=1144

Ikee - First iPhone Worm impacts "Jailbroken iPhones"
http://www.f-secure.com/weblog/archives/00001814.html

What are "Jailbroken iPhones"?
http://en.wikipedia.org/wiki/Jailbreak_%28iPhone_OS%29

How to change root password in "Jailbroken iPhones"
http://www.f-secure.com/weblog/archives/cydia.htm

Major IE8 flaw makes 'safe' sites unsafe

The latest version of Microsoft's Internet Explorer browser contains a bug that can enable serious security attacks against websites that are otherwise safe.

The flaw in IE 8 can be exploited to introduce XSS, or cross-site scripting, errors on webpages that are otherwise safe, according to two Register sources, who discussed the bug on the condition they not be identified. Microsoft was notified of the vulnerability a few months ago, they said.

Ironically, the flaw resides in a protection added by Microsoft developers to IE 8 that's designed to prevent XSS attacks against sites. The feature works by rewriting vulnerable pages using a technique known as output encoding so that harmful characters and values are replaced with safer ones. A Google spokesman confirmed there is a "significant flaw" in the IE 8 feature but declined to provide specifics.

Full report here.

Serious Adobe Flash vulnerability

Foreground Security discovered a critical vulnerability in Adobe Flash.

This vulnerability allows the same-origin policy of Adobe Flash to be exploited to allow nearly any site that allows user generated content to be attacked.

No fix for this vulnerability currently exists.

According to Foreground Security Senior Security Researcher Mike Bailey, who discovered the vulnerability: “Whether you use Flash or not, you may still be vulnerable because this issue affects users directly and not the servers themselves. Websites that are at risk of being vulnerable include social media sites, major career portals, and Fortune 1000 and government agencies websites. Basically, if you have a website, you could be vulnerable.”

Following the discovery, the vulnerability was reported to both Adobe and Google, whose Google Applications, including Gmail, are vulnerable to exploit.

Bailey also noted: “This is insidious because Flash content can be crafted to look like many different file types, such as Microsoft Word or Excel documents, image files or zip files. This variability allows malicious content to appear in many different and normally non-threatening guises. Nobody expects pictures to attack them."

Here's a video demonstration of the (now fixed) Gmail exploit that uses Mike Bailey's Flash exploit as its basis:

Battle of the anti-virus: What is the best software?

AV-Comparatives.org recently released the results of a malware removal tests with which they evaluated 16 anti-virus software solutions:

• Avast Professional Edition 4.8
• AVG Anti-Virus 8.5
• AVIRA AntiVir Premium 9.0
• BitDefender Anti-Virus 2010
• eScan Anti-Virus 10.0
• ESET NOD32 Antivirus 4.0
• F-Secure AntiVirus 2010
• G DATA AntiVirus 2010
• Kaspersky Anti-Virus 2010
• Kingsoft AntiVirus 9
• McAfee VirusScan Plus 2009
• Microsoft Security Essentials 1.0
• Norman Antivirus & Anti-Spyware 7.10
• Sophos Anti-Virus 7.6
• Symantec Norton Anti-Virus 2010
• Trustport Antivirus 2009.

The test focused only on the malware removal/cleaning capabilities, therefore all used samples were samples that the tested antivirus products were able to detect. The main question was if the products are able to successfully remove malware
from an already infected/compromised system. The test report was aimed to typical home users. A further question was if the products are able to remove what they are able to detect.

Based on a scoring system that evaluated malware and leftovers removal capabilities, these were the results:
"None of the products performed “very good” in malware removal or removal of leftovers, based on those 10 samples. eScan, Symantec and Microsoft (MSE) were the only products to be good in removal of malware AND removal of leftovers", says the report. "Some products do not remove all registry entries on purpose (as long as they do not have any visible side effect for the user), e.g. if that helps to prevent reinfection by the same malware. Furthermore, in some cases it is not possible to know if the registry values (or the hosts file) were modified by the malware or by the user itself (or third-party utilities used by the user)."

To see which malware sample were used and why, and how the particular anti-virus solutions behaved, go here.

Facebook groups hacked through design flaw

Mashable reports that anyone can hijack a group on Facebook just by joining the group and registering as an administrator after the real admin has left. The group is then at the mercy of the "illegal" admin, who can change the name, edit the information, the picture, send messages to members - in short, he can abuse the acquired "power" by putting up offensive stuff.

There was a Facebook group by the name Control Your Info, whose members were going around and hijacking groups to try to raise awareness about the flaw, but it has been shut off by Facebook.

Let's hope they are also fixing the flaw.

Koobface worm creates Facebook accounts to spread

Be careful the next person you approve as your friend on Facebook.

According to TrendLabs, there is a new Koobface component that makes Internet Explorer create Facebook accounts. It automates the whole process - the browser registers the account, confirms and activates the registration via Gmail, joins random Facebook groups, adds friends, posts messages to their walls...

It actually does a good job at imitating a person starting its Facebook account - the details it provides are complete, credible and vary from account to account: photo, birth date, favorite movies, religious views, etc. These details are picked up from one of the botnet’s available proxy domain.

Another "smart" Koobface feature is that after it has created the account, it makes sure not to surpass the maximum number of friend requests allowed by Facebook, so it doesn't raise the suspicions of its administrators.

The messages that the account posts on friends' walls usually has a link that, if clicked, takes the unsuspecting user to a site that hosts the Koobface loader.

iPhone worm spreads via default password

In my earlier post about Hacked iPhones held hostage, here's another piece:

An iPhone worm has started jumping between jailbroken devices, taking advantage of users who have replaced the phone's software but failed to create a new root password, security firm F-Secure stated on Monday.

Affected users will find that their iPhone wallpaper has been altered to a picture of Rick Astley (of Rickroll fame) and the message "ikee is never going to give you up".

The worm targets users who have jailbroken their phone but have not changed their default root login password. It will search for vulnerable iPhones by scanning a handful of IP ranges - most of which are in Australia. At the moment, we have no confirmed reports of Ikee outside of Australia.

After Ikee infects a phone, it disables the SSH service, preventing reinfection. To protect your jailbroken iPhone, change your root password. Here's how.

The creator of the worm has released full source code of the four existing variants of this worm. This means that there will quickly be more variants, and they might have nastier payload than just changing your wallpaper or might try password cracking to gain access to devices where the default password has been changed.

Source.

Facebook best practice

I can't stress enough how important it is to take responsibility of what you post up on the Internet, especially on social networking websites. What you reveal about yourself may eventually be used against you - Refer to the earlier post I made about public search engines mining your private Facebook profile details.

I've observed that of late, many of my friends around me are plagued with this Wall posting weird activity. Facebook has provided users with powerful controls to protect themselves online, and it is up to individuals to check and ensure that appropriate settings are in place.

Sophos has published recommendations for how to configure the settings for each of these privacy areas of Facebook.

Take a look here.

Windows 7 vulnerable to most viruses

Windows 7 was touted as a big improvement on Vista, security aspect included.

The Sophos team wanted to test that assertion, so they installed a full release copy of the new OS on a previously cleaned computer, kept the default values for User Account Control (UAC) and didn't install any anti-virus software.

They then proceed to infect the machine with 10 unique samples of malware that SophosLabs received last. The result wasn't good for the users (although it technically is a good result for manufacturers of anti-malware software around the world): only 2 out of 10 failed to operate!

The UAC managed to block by itself only on sample, and that is definitely not good enough.

The conclusion? If you installed Windows 7, don't forget to use anti-virus software.

Hacked iPhones held hostage

Dutch T-mobile customers that use jailbroken iPhones got a nasty surprise yesterday. A "message" popped up on their screen claiming that their iPhone's been hacked and instructs them to visit doiop.com/iHacked and secure their iPhones. To add more incentive, the hacker also wrote: "Right now, I can access all your files."

When the scared users would visit the website, they were asked to send €5 to the hacker's PayPal account so he can send them instructions on how to secure their device.

How did this happen? It seems that the hacker identified the jailbroken iPhones using port scanning, because those particular devices have SSH running. SSH has to be enabled for the user to log in via Terminal and run UNIX commands, and the default root password often gets forgotten and remains unchanged. The hacker used this fact to hack into the phones.

Although it appears that the hacker didn't misuse any of the data he had access to - afterwards he posted the instructions on the website, apologized and returned the money - it doesn't mean that someone else will not, since the technique is pretty simple to execute and requires only a basic knowledge of networking.

To all iPhone users that have jailbroken their device, it is advised to shut down SSH when it's not needed and to change the default root password.

Trojan.Whitewell: What’s your (bot) Facebook Status Today?

I'm very sure by now, most of you Facebookers would have received some weird posts on your Walls from either your friends or your friends would have notified you that you posted something on their wall.

Here are some sample messages:

• Thought you might want to check this out http://_fb-newss.org
• has made $159 today working at home! go to TheBizMeet.com to see how you can start! ktq
• For You http://_newwss2.org
• I found a job you might be interested in news44.org

Here is a breakdown of what's happening.

If you discover that your account has been used to post weird links on your friend's Walls, you should immediately do the following:

• Change the password of your FB account.
• Change the password of the email account linked to your FB.
• Get your antivirus updated with the latest virus definitions with perform a full scan.
• If you do not have antivirus software installed on your computer, pls proceed here to download a free copy.
  

Password Reset Email is New Facebook Virus

Facebookers Alert! There is an email circulating with an attachment stating itself as the new password prompting you to open it, pls ignore the email and delete it.

Security firm MX Lab said in a blog post Tuesday it has detected a new Bredolab variant masking itself as the "Facebook Password Reset Confirmation." According to MX Lab, the From address in the email is shown as "The Facebook Team ", but this address is spoofed.

The attachment has the name Facebook_Password_4cf91.zip and includes the file Facebook_Password_4cf91.exe. The part between _ and .zip at the end is choosen randomly and contains letters and numbers.

The trojan is known as Trojan.Downloader.Bredolab.AZ (BitDefender), Bredolab.gen.a (McAfee) or W32/Obfuscated.D2!genr (Norman) and is only detected by 14 of the 41 AV engines at Virus Total, MX Lab researchers said.

The body of the email is as follows:

Hey [random user name] , Because of the measures taken to provide safety to our clients, your password has been changed.

You can find your new password in attached document.

Thanks,
The Facebook Team

According to MX Labs, Bredolab is a trojan horse that downloads and executes files from the Internet, such as rogue anti-spyware. To bypass firewalls, it injects its own code into legitimate processes svchost.exe and explorer.exe. Bredolab contains anti-sandbox code (the trojan might quit itself when an external program investigates its actions).

This email has also been documented to be a hoax here.

I would recommend that you read about other recent popular Facebook scams as well:

• Five Facebook, Twitter Scams to Avoid
• Five More Facebook, Twitter Scams to Avoid.

Click here to get a more technical rundown of this trojan.

Windows 7 - Improve your experience with these 77 tips

Windows 7 is set to debut on October 22, 2009.

These 77 tips will enhance security, performance, and functionality for this new operating system:

http://technet.microsoft.com/en-us/magazine/2009.10.77windows.aspx

QUOTE: Windows 7 may be Microsoft’s most anticipated product ever. It builds on Windows Vista’s positives, and eliminates many of that OS’s negatives. It adds new functionality, too—all in a package that is less resource-hungry than its predecessor.

At a Glance:
■ Make Windows 7 faster
■ Get more done with Windows 7
■ The best Windows 7 shortcuts
■ Securing Windows 7

The dangers of exposing information on social networking sites

Here's an interesting podcast by Dr. Herbert Thompson, the Chief Security Strategist at People Security, discussing on why we should practice regular identity hygiene checks on social networking channels to prevent leaking sensitive information that can be used in identity theft (e.g email account password reset).

Fake Facebook, Fake Video, Fake CAPTCHA

Watching videos on Facebook is a popular activity, so it's not surprising to find dozens of fake copycat sites being used to infect unsuspecting viewers with malware.

Here's one fake Facebook site with a malicious JavaScript that uses the old "Flash Player upgrade installation" trick — but with a slight twist.

Read on to see how this is accomplished.

Conficker Eye Chart (at a glance)

Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites. Need some refresh your memory? Read these previous posts.

Here is a cool website to test if your computer is infected with this malware.

However if you are using a proxy server, you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.

Researcher: Hackers Hijack Some Facebook Apps

Full time Facebookers take note.

A number of games and other applications built to be used on Facebook.com have been hacked so that users are quietly sent to sites that try to install malicious programs, a security researcher has found.

A number of the applications Thompson named in his research -- including one called Pass-it-On, and another called City Fire Department -- are no longer available on Facebook.com.

Full report here.

Fake Anti-Virus Programs Hijacking Computers

Cyber criminals are becoming more aggressive in attempting to sell fake anti-virus programs known as rogueware. In addition they are now combining rogueware with ransomware, hijacking users' computers and making them useless until victims purchase fake anti-virus programs, according to a new report by PandaLabs.

The fake program that PandaLabs detected, called Total Security 2009, is being offered to victims for about $120. Victims can also buy "premium" tech support services for an additional $29. Users who pay the ransom receive a serial number that releases all files and executables, allowing them to work normally and recover their information.

The fake anti-virus, however remains on their systems. PandaLabs has published a list of serial numbers that victims can use to unlock their computers, along with a video explaining how the scam operates.

Previously, when computers were infected by this type of malware, users would usually see a series of warnings prompting them to buy a paid version of the programs. The new method of selling rogueware blocks users' attempts to run programs or open documents, falsely displaying a message informing them that all files on their computers are infected and the only solution is to buy fake anti-virus.

"Users are often infected unknowingly - in most cases through visiting hacked Web sites. Once a computer is infected, it is extremely difficult to eliminate the threat, even for those with a certain degree of technical knowledge," said Luis Corrons, technical director of PandaLabs.

"Users are also prevented from using any type of detection or disinfection tool, as all programs are blocked. The only application that can be used is the Internet browser, conveniently allowing the victim to pay for the fake anti-virus. For this reason, on the PandaLabs blog, we have published the serial numbers required to unblock the computer if it has been hijacked. Users can then install genuine security software to scan the computer in-depth and eliminate all traces of this fake anti-virus."

Free Security Tool Detects Malicious URLs On Twitter

The popularity of embedding shortened URLs into Twitter, Digg and other social media sites is being threatened by hackers who use the anonymity of these URLs to hide malicious websites.

AVG Technologies has released a free tool called LinkScanner that can detect the presence of malicious web pages. LinkScanner works by testing the destination of each URL in real time and does not use blacklists that quickly become outdated.

"People click with the intention of going to a specific site, but the link can be easily hacked to send people to a site containing Trojans, spyware, rootkits and other malware instead."

AVG says malicious web pages are the latest way that hackers and spammers deposit malware onto computers in order to steal passwords or recruit computers into botnets.

Computer users can become infected by clicking on a link, viewing an image, or sometimes just hovering their mouse over a banner. To avoid detection, hackers typically infect a specific web page for less than 24 hours before moving on.

Adobe to patch exploited Acrobat flaw

Software firm Adobe announced on Thursday that the company plans to plug a critical security hole in its Acrobat and Reader software, a hole which is currently being used to compromised PCs.

Calling the attacks "limited," the company stated in a blog post that the current exploit can be blocked by disabling Javascript or, for Windows Vista users, if data-execution protection (DEP) is turned on. The vulnerability will be fixed as past of Adobe's regularly quarterly update scheduled for Tuesday, October 13, the company said.

"There are reports that this issue is being exploited in the wild in limited targeted attacks," the company said on its Product Security Incident Response Team (PSIRT) blog. "The exploit targets Adobe Reader and Acrobat 9.1.3 on Windows."

In May, Adobe moved to a quarterly patch schedule for its popular Adobe Acrobat and Reader software, citing criticism from security researchers. Yet, despite the fact that attackers are increasingly targeting popular third-party applications, such as Adobe's, companies are less quick to patch issues in the software, compared to fixing flaws in core operating system components, according to a report published last month.

In its latest advisory, Adobe credits Chia-Ching Fang and the Information and Communication Security Technology Center in Taiwan with helping disclose the vulnerability.

Webmail phishing attack only the beginning

In the wake of the news reports this week of the large-scale webmail phishing attacks, much of the coverage has surrounded the compromise of email accounts which, according to the numbers, affected a massive amount of webmail users.

However, what has been glossed over is the potential impact on the other aspects of the victims' online lives. The bad guys likely now have more than just access to users' email accounts, they have access to a host of other online services the victim uses.

"A user's unique email address is often used to authenticate a number of web sites, including social networking sites and Instant Messaging on a public IM network," said Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec. "If your email address has been compromised, not only should you change the password there, you should also change it on any other site that uses that email address as a log in ID."

Once the bad guys have email account information and the will to take over a related social networking accounts, all they need to do is try the password reminder links from the login pages. They can then not only use your email to spam, they can also gain access to other personal information stored online.

Over the last year, MessageLabs Intelligence has tracked a number of phishing attacks using Instant Messaging whereby the bad guys collected real IM user account information and passwords and used them to send commercial messages to everyone on the user's buddy list. An invitation to view a funny video or embarrassing pictures by clicking on a link in an IM was the bait and the landing site would then ask the victim to log in with their IM user name and password. For public IM networks, the user name is often the same as the web-based email account.

Phishing isn't the only way the bad guys can gain access to webmail accounts. MessageLabs Intelligence has been aware of an increase in the number of "brute-force" password breaking attempts, where dictionary attacks are used against online webmail accounts to break in, perhaps using POP3 or webmail to conduct the attacks. Users with simple or weak passwords are the most vulnerable. On the website, an attacker will be asked to solve a CAPTCHA puzzle to prove they are a real person. CAPTCHAs can be easily bypassed using a variety of CAPTCHA-breaking tools.

Statistics of the Hotmail phishing attack

Bogdan Calin from Acunetix examined the passwords published after the Hotmail phishing attack, came to several conclusions and published some basic statistics.

After analysis, we have statistics of the "The top 20 most common passwords" and "Password length distribution" from the list. See here.

Email Password Leak Swells - Includes GMail, AOL and YahooMail

Yesterday, when reports indicated that the passwords to certain Hotmail accounts had been published, we tried to play it safe by suggesting that all Hotmail users change their passwords.

Now, we're just going to recommend that everybody revisit those settings, as it seems that the passwords to Gmail, Yahoo, and AOL accounts have also been leaked.

The list was posted on the same site - pastebin.com - as the Hotmail-related one. (Although we should note that pastebin.com's owner doesn't appear to be in any way responsible for the spread of the info.)

Also, in case you were wondering, "BBC News has confirmed that many - including Gmail and Hotmail addresses - are genuine."

So be a little overcautious and change the passwords (and security questions/answers) to all of your email addresses.

10,000 Hotmail Account Passwords Published Online

People with Hotmail accounts - and particularly people with Hotmail accounts beginning with the letter "a" or "b" - should change their passwords as soon as possible. A list containing about 10,000 account names and passwords has been published online.

Apparently the information was posted on pastebin.com on the first of this month. Tom Warren reports that the original post was deleted at some point, but people still managed to view it and spread the data around. So now an unknown number of hackers, scammers, and other bad guys may have the ability to access certain accounts.

What's more, even though the published list only covered email accounts starting with "a" and "b," the fact that everything was in alphabetical order implies that other lists exist. Or the existence of a complete set seems no less likely than the proven existence an incomplete one, at any rate.

So again, change your password if you use Hotmail and haven't done so already. Pick a different security question (and answer), too, while you're at it, and maybe check your outbox for suspicious messages in case your account's been abused.

Microsoft's promised in a statement that it's investigating the problem, so hopefully the source of the account info leak will be identified and plugged, at least.

Microsoft Releases Free Security Software

Let's face it, we all lurveeeee FREE stuffs. So, good news for you people out there!

Microsoft has released its free security suite for consumers today, dubbed Microsoft Security Essentials.

The anti-malware services helps to protect users against viruses, spyware and other malicious software. It requires no registration, trials or renewals and is available for download directly from Microsoft.

Microsoft Security Essentials is designed to run quietly in the background alerting users only when there is an action for them to take. It limits CPU and memory usage and has less impact on tasks users perform such as opening documents or browser windows or loading search results, even on older less powerful PCs.

Microsoft Security Essentials is available for Windows XP SP2 or SP3, Windows Vista and Windows 7 including Windows XP mode on both x32 and x64 PCs.

Microsoft Security Essentials is available in eight languages and 19 countries including Australia, Austria, Belgium, Brazil, Canada, France, Germany, Ireland, Israel, Italy, Japan, Mexico, the Netherlands, New Zealand, Singapore, Spain, Switzerland, the United Kingdom and the United States.

Source

Twitter warns of direct-messaging worm

Social-networking service Twitter warned users on Wednesday that a link sent by direct message redirects users to a malicious site that attempts to steal their account credentials.

It's unclear how many users of the microblogging service had fallen prey to the phishing scheme, which sends victims to a replica of the Twitter logon page. Accounts compromised by the attack will send out messages, which resembles "rofl this you on here? http:// videos.twitter.*****-logins01.com," to their followers, according to reports.

"A bit o'phishing going on -- if you get a weird direct message, don't click on it and certainly don't give your login creds!" Twitter warned users through its spam channel.

Source

Serious security bug found in Windows Vista

An independent security consultant publicized this week the details to a critical flaw in the server message block version 2 (SMB2) component of Microsoft's Windows Vista, Windows Server 2008, and the release candidate for Windows 7.

The researcher, Laurent Gaffié, claimed in his advisory that the vulnerability causes a Blue Screen of Death, a pernicious crash on Windows system, but other researchers have subsequently concluded that the flaw is actually remotely exploitable, a more serious issue.

Microsoft acknowledged the flaw on Tuesday in an advisory. The flaw does not affect the latest version of Windows 7, Windows Server 2008 R2, nor Windows XP, the company stated. Microsoft took the researcher to task for disclosing the information before it fixed the security issue.

While Microsoft has not released a fix for the issue, the software giant recommended that administrators disable SMB version 2 or block the specific TCP ports (139 and 445) used by the file-sharing feature.

Detailed report here.

Twitter spam protection tips

With the popularity of social networking platforms such as Twitter on the rise, cyber criminals have found an easy target among unsuspecting users.

One of the biggest security problems facing Twitter as it relates to the spread of spam and malware are the many link-shortening services utilized for hyperlink posting. Users are limited to 140 characters per tweet so these URL-shortening services allow tweeters to post a longer link under such tight character limitations. Attackers use link-shortening services to disguise malicious links. Some infections could be easily prevented by allowing users to see the real URL before clicking on it.

Some of the common types of Twitter spam include:

* Tweet spam: Tweet spam comes from someone a user is currently following and everyone following that user will see the tweet

* Direct message: A direct message comes from someone a user is currently following and only the user will see the message

* ReTweet spam: ReTweet spam searches for legitimate tweets and reposts them in the system but with a different, malicious URL

* Trending subjects spam: Trending subjects spam searches for hot topics on twitter (like Michael Jackson's death) and posts similar tweets with different, malicious URLs

* Following spam: Following spam happens when a user's profile receives a lot of followers he/she doesn't know. If the user does not start following them back within a week, they stop following the user. Statistics show that one in two users will follow back. Usually these profiles are bots which are programmed to acquire as many followers as possible before they can start broadcasting spam.

Twitter users can protect themselves from falling into spam traps by following five tips, courtesy of BitDefender:

* Install a comprehensive security solution on your computer - preferably a suite containing antivirus, firewall and a phishing filter

* Follow the spam profile on Twitter: http://twitter.com/spam. Users can find good advice here. For example, a recent post states: "If you gave your login and password info to TwitViewer, we strongly suggest you change your password now. Thanks!"

* Don't click on all the links you receive

* Disable the "auto followback" option. This will allow you to pick and chose who you want to follow

* Make sure you know who you are following.

Researcher Launches Facebook Bug Project For September

First Twitter and now Facebook: A researcher today began a round of daily disclosures of serious vulnerabilities in popular Facebook applications.

The researcher, who goes by "theharmonyguy," plans to disclose multiple cross-site scripting (XSS) flaws he discovered in various third-party Facebook applications this month, though he may not do so every day. He says he found major security holes in several of Facebook's top 10 most popular applications.

Today's bugs include XSSes in FunSpace, which has more than 8 million users; SuperPoke, which has 2 million users; SocialToo, which has nearly 2,000 users; and YellowPages.ca, which has nearly 1,200 users. FunSpace, SuperPoke, and SocialToo have been patched, but YellowPages.ca has not.

The problem, he says, lays in Facebook's API -- problem that has been well-documented by other researchers, as well. The API gives the application developer full access to a Facebook member's profile when a user runs that application.

Full report here.

CNN: The 12 most annoying types of Facebookers

This is my personal favourite article for the moment.

Read on to find out the top 12 most annoying types of Facebookers. :)

Burglars search Twitter, Facebook updates to target homes

You might be getting social with the wrong people. Do you check who is following you on Twitter or do you just love having lots of followers without ever reading a bio? When someone requests to be your 'friend' on Facebook, do you check to see if they are friends with people you know personally or do you just add them to your growing list?

One or more of these 'friends' might be making good use out of your updates on Twitter or Facebook...as a burglar. Every time you post excitedly about that upcoming vacation or how long you'll be gone at the mall, everyone in your network can read about it.

Not only are your updates tempting to a burglar, but your photos are as well! Perhaps you had a party at your home or you just finished your baby's new nursery. You upload the pictures to Facebook or TwitPic and everyone gets to see what's in your house. Including the person who just put you on the list of potential targets when you're on that warm vacation in the tropics next month.

This does not mean you should stop using Facebook and Twitter. Perhaps it is just a wake-up call to be a bit more savvy when it comes to choosing your friends and followers. Going to a site that allows you to get '1500 new followers overnight" is not only a terrible way to find followers, it might land you the one follower who puts your home on his target list.

Be smart when accepting friends on Facebook and followers on Twitter. Taking the time to be choosy about who you communicate with might just help you keep a burglar out of your neighborhood.

Full article here.

Trojan Could Enable Attackers To Eavesdrop On Skype Calls

The next time you open Skype and make calls on it, think twice about it.

Security researchers at Symantec have observed the public availability of source code for a Trojan that targets users of the Skype voice over IP service.

The Trojan has the ability to record audio from the computer -- including any Skype calls in progress -- and store the files locally in an encrypted MP3 file, where they can later be transmitted to the attacker.

Full article here.

Video: Social Zombies presentation from DEFCON

Presented on August 2, 2009 at DEFCON 17 in Las Vegas, Tom Eston and Kevin Johnson explore the various concerns related to malware delivery through social network sites. Ignoring the FUD and confusion being sowed today, this presentation will examine the risks and then present tools that can be used to exploit these issues.

This presentation begins by discussing how social networks work and the various privacy and security concerns that are caused by the trust mass that is social networks. We use this privacy confusion to exploit members and their companies during our penetration tests.

The presentation then discusses typical botnets and bot programs. Both the delivery of this malware through social networks and the use of these social networks as command and control channels will be examined.

Tom and Kevin next explore the use of browser-based bots and their delivery through custom social network applications and content. This research expands upon previous work by researchers such as Wade Alcorn and GNUCitizen and takes it into new C&C directions.

Finally, the information available through the social network APIs is explored using the bot delivery applications. This allows for complete coverage of the targets and their information.

Social Zombies: Your Friends Want To Eat Your Brains from Tom on Vimeo.

Attack Of The Tweets: Major Twitter Flaw Exposed

A newly exposed cross-site scripting (XSS) vulnerability in Twitter lets an attacker wrest control of a victim's account merely by sending him or her a tweet.

The embedded code can perform any tasks the Twitter Website can perform, including redirecting a user to another page, sending tweets, changing account information, or adding or deleting followers, he said.

"Simply by seeing one of these tweets, code can be run inside your browser impersonating you and doing anything that your browser can do. Perhaps it may simply redirect you to a pornographic website? Or maybe delete all of your tweets? Send a message to all of your friends? Maybe it would delete all of your followers, or worse still, just send the details needed to log in to your account off to another website for someone to use at their leisure," Slater said

Detailed article here.

More Employers Blocking Social Networks

Employers are gradually putting more restrictions on what websites their employees can view and are increasingly choosing to block access to popular social networking sites, according to a new report from security firm ScanSafe.

"When Web filtering first became an option for companies we generally saw them block access to typical categories such as pornography, illegal activities and hate and discrimination," said Spencer Parker, director of product management at ScanSafe.

"In recent months, employers are obviously wising up to the dangers and negative impact on productivity linked to certain sites and more and more of our customers have chosen to block social networking, online banking and Webmail."

The report found a 20 percent increase in the number of companies blocking social networking sites in the last six months. Currently, 76 percent of companies are blocking social networks and it is now a more popular category to block than online shopping (52%), weapons (75%), alcohol (64%), sports (51%) and Webmail (58%).

ScanSafe specifically found an increase in the number of customers choosing to block the below categories in the last 6 months.

28% increase in travel
27% increase in restaurants and bars
26% increase in sports
26% increase in online shopping
19% increase in Job Searches
16% increase in Webmail

"Social networking sites can expose businesses to malware and if not used for business purposes can be a drain on productivity and bandwidth," says Parker.

"Given the option, companies are increasingly taking a sterner approach to the sites that their employees are allowed to access. I imagine before long, social networking will be up there with pornography in terms of categories blocked."

Twitter Used As Botnet Command Center

As if being deluged under DDoS attacks isn't bad enough, this week Twitter found itself the target of another sort of threat. The Register recently reported that the wildly popular social networking service is also being used to direct part of a botnet's activities.

According to the report, a security analyst accidentally stumbled across a Twitter account being used by botherders as a cheap and effective way of directing infected computers to websites where they can get further instructions.

This appears to be the first time Twitter has been used as part of a botnet's command and control structure. At time of writing, the malicious account has already been taken offline.

For more details, you can also check the original post from Arbor Sert.

Credits

Nearly 80% Of Users Vulnerable To Adobe Flash Attack

Most users haven't fixed their Acrobat Reader apps two weeks after Adobe issued critical patch, Trusteer says.

Adobe may have sped up its process of releasing security patches to its software, but most users apparently aren't applying them immediately or at all, according to new data released today.

Trusteer found that close to 80 percent of users are running older and vulnerable versions of Flash, and 84 percent, older and vulnerable versions of Acrobat Reader. The data (PDF) was gathered from Trusteer's 2.5 million users of its Rapport browser security service, 98.8 percent of whom have Flash active in their browsers.

More details here.

So please be a good boy/girl and patch up your Adobe products:

WordPress Password Problem Crops Up

People who use version 2.8.3 of the WordPress blogging software may want to download an update posthaste. A vulnerability's been discovered that, while it won't let other folks take over accounts, will allow troublemakers to lock out administrators.

Laurent Gaffié gets credit for uncovering the problem, and according to a warning published on Full Disclosure, this hack isn't the domain of shadowy professionals and government agents. About all that's needed in order to pull it off is a Web browser and one special URL.

Then, it's possible to mess with the WordPress password reset function, resetting passwords without the admin ever getting any notice of the action.

You can imagine how this would prove problematic if an administrator couldn't figure out what was going on. And even if an admin did catch on, a prankster could probably manage to repeat the performance over and over, creating a real headache or even permanent roadblock.

Luckily, version 2.8.4 of WordPress has been made available in response, and it addresses the issue. So get to downloading the update as soon as seems convenient for the sake of not getting locked out of your blog.

52 percent of new viruses only last 24 hours

Every day, PandaLabs receives nearly 37,000 samples of new viruses, worms, Trojans and other types of Internet threats, 52 percent of which (that is 19,240 on average) spread and try to infect users for just 24 hours. After this, they become inactive and harmless as they are replaced by other, new variants that join the list of new specimens in circulation.

The reason for this lies in hackers’ motivation to profit financially from malware. To do this, they try to ensure their creations go unnoticed by users and security solution vendors.

Just 24 hours after they put any strain of malware into circulation, they will modify its code so that it can continue to spread without being detected by security companies.

According to Luis Corrons, Technical Director of PandaLabs, “This is a never-ending race which, unfortunately, the hackers are still winning. We have to wait until we get hold of the malware they have created to be able to analyze, classify and combat it. In this race, vendors that work with traditional, manual analysis techniques are too slow to vaccinate clients, as the distribution and infection span is very short.”

How Do They Know My Email Address?

Have you received email messages in the last several weeks with several random words in the subject line, and a random sentence in the message body? If your answer is yes, then you are one of the victims of the ongoing directory harvesting attack (DHA) by spammers.

The purpose of a DHA is to find valid email addresses on a domain for future spam attacks. During a DHA attack, any addresses for which the recipient’s email server accepts email are considered valid and will be added to the spammer’s address database to include in future spam attacks.

For example:

Sample #1:

From: joannjasmin8xs@xxxxxx.com
Subject: land

Those journalists showed them a photograph.

Sample #2:

From: clariceboldin9cg@xxxxxx.com
Subject: okay then

They told her the shortest way.

DHA is more than just an annoyance for email recipients. Every successful DHA attack equals one or more email address being subjected to future spam/malware attacks. Furthermore, these attacks also generate a large volume of unnecessary workload and consume significant amounts of system resources on the recipient’s email server. Symantec is closely monitoring these attacks and will inform readers of any further developments.

Credits

DDoS Attackers Continue Hitting Twitter, Facebook, Google

While it was reported earlier that Twitter is still struggling to recover form the DDOS attacks, the latest update seems to prove otherwise.

And to add on to the action, Google's Blogger blog publishing services were not spared as well. According to a Google spokeman, a small percentage of Blogger users have experienced error messages as the result of what appears to be an ongoing distributed denial of service attack aimed at multiple services across the web.

It is predicted that this DDOS may persist throughout the weekend.

Twitter & Facebook taken down by denial-of-service attack

Twitter spent the later part of the week fighting off a DOS (denial of service) attack, that also targeted fellow social-media site Facebook.

Social media sites Facebook and Twitter took a beating over the weekend after both were subjected to a DOS attack. Twitter was down for two hours on Thursday and still suffered from the attacks on Friday.

Facebook reported that people had trouble accessing the site on Thursday, but resolved the situation late that morning Pacific Time. A blogger from Georgia claimed that the Russian government sponsored the attacks in an effort to silence him for speaking out against the country's handling of Georgia.

While Twitter was mum on the attacks' motivation, a Facebook spokeswoman said they were directed at an "activist blogger" -- possibly the Georgia advocate -- rather than the sites themselves.

Email Scams Targeting Job Seekers

Email security firm Red Condor has issued a warning to email users about the latest email scams that are targeting people looking for employment.

Among the scams are emails that claim to be offering employment from legitimate companies such as Pepsi and Starbucks or that appear as messages from real job sites like CareerBuilder or Monster.com.

The fake employment offers frequently involve "payment processing" requests which give scammers an excuse to ask for a respondent's bank account information.

In addition to email spam, other scammers are using Craigslist to post fake job ads. When people respond to the ads, they receive an email reply that requires them to go to a "credit check" website to get their credit scores. The credit check link contains the scammer's affiliate, so when the victims pay for the credit check, the scammer gets a commission.

An email response to "Legal Secretary job posting" on craigslist email said, "Do not send me your info or report, I just want to make sure your score is above the 400 mark so check it and give me your exact score when you e-mail me your resume and references."

"Unfortunately, as with all phishing attacks, there is no legitimate employment offer coming, and victims have either given their personal information or money to unknown, deceitful sources," said Dr. Tom Steding, chief executive officer of Red Condor.

"Spammers are once again demonstrating that nothing is off limits as they focus their efforts on the millions of people that are unemployed and looking for work.

Mobile Malware Targeting Smartphones

Nearly one out of every 63 smartphones powered by the Symbian operating system is infected with some form of malware, according to a new study by mobile security firm SMobile Systems.

A comparison of these statistics to the worldwide smartphone population places the number of infected devices globally in the millions. Because the vast majority of these infections are designed to be stealthy and the fact few smartphones have Anti-Malware applications, most infected users are unaware their devices have been compromised.

Throughout 2009 SMobile's Global Threat Center has seen an increase in the capabilities of new malware infecting mobile devices, as well as frequency of attacks. The attacks have taken the form of worms and Trojans that are transmitted via Bluetooth, SMS, MMS, or emails, as well as Spyware that is downloaded from various online application and shareware websites.

Detailed report here.

Famous Security Experts' Sites Hacked

Here's a discouraging piece of news for anyone who's put security professionals Dan Kaminsky and Kevin Mitnick on a pedestal: both men's sites were hacked in apparent coordination with the start of the Black Hat security conference.

The hackers left behind notes indicating that they were trying to humiliate and discredit their targets, accusing them of getting by more on reputation and hype than skill. It's unclear how the hackers carried out their attacks, but they did share some evidence of their success, and Kaminsky seems to have been the hardest hit.

Following the attacks, a file containing all sorts of confidential info was made public, and Dan Goodin reports, "The file posted on security mailing lists claimed to have obtained more than four years' worth of data from Kaminsky, and as proof, it offered a smattering of emails, instant messages, and other communications that laid out sensitive research work and intimate personal conversations."

Also, "multiple passwords Kaminsky used and back-end configurations for Kaminsky's website" were shared, and the site's been offline ever since as a result.

Read more here

Google Safe Browsing Feature Could Compromise Privacy

Researcher RSnake has discovered that Google's anti-malware and anti-phishing features for Chrome and Firefox tracks information about user's browsing habits

Google basically stores a cookie on the user's computer that can be used to track him or her, he says. And the cookie can be used to identify the IP addresses he or she visits, for instance. Hansen says Google logs that data for anti-distributed denial-of-service (DDoS) purposes.

"In Chrome, every five hours it phones home" to check for the current version and"sends a payload including machine ID and user ID," says RSnake.

The only way to protect your privacy from this, he says, is to turn off the anti-phishing and anti-malware options. "The bummer is you're turning off a great service," he says. "It protects you from malware" and other threats, he says.

The good news, he says, is that Google only retains the data for two weeks, and then stores it in aggregate form. "But having this IP address, this cookie, and this timestamp is enough information to decloak someone for a [hacking] incident they did two years ago," he says. "So if you use Firefox or Chrome, you should know the risks" of the Safe Browsing feature, he says.

Read here for detailed article.

Next Gen IT Security 2009 Conference

Event: Next Gen IT Security 2009
Date: 18 August-19 August 2009
Location: Singapore
Organizer: Marcus Evans
Homepage: http://www.marcusevans.com

Marcus Evans’ ‘Next Gen IT Security’ conference will keep IT security professionals to keep up-to-date on their knowledge in the latest threats, new practices and continuous improvement strategies in the industry to maintain a competitive edge in the market.

This conference highlights the participation of representatives from international companies such as OWASP Singapore (Singapore), Royal Bank of Scotland (Singapore), Citco Funds (Singapore), SingHealth (Singapore), Creative Technology (Singapore), Bank of America (Singapore), JPMorgan Chase Bank (Singapore), Nokia Siemens Networks (Singapore), Hong Kong Police Force (Hong Kong), CBH Group, Dell Inc. (Global Business Center), Affin Bank (Malaysia), British Telecommunications, Professional Information Security Association (PISA), Allergan (India), Acmamall.com, Bank Muamalat (Malaysia), Carsem and among others.

For further event details and event brochure, kindly contact Ms. Catherine Foo here.

What is a browser?

If a major piece of your security strategy revolves around employee training, the following video might be a major setback. Many security pros pride themselves on the amount of training they give their employees. But I wonder, is it all for naught?

A Google employee took a camera and microphone onto the streets of New York City to find out if non-techies knew what a browser is and the results were astounding. Less than 8% of those interviewed knew. And these guys don’t reside in an assisted living facility or a 55 and over community. Many of them could have Facebook accounts and even Twitter handles.

After watching the video, I wonder, how would I begin a security training program if many of my employees don’t know what a browser is?

Phishing sounds like a foreign language and malware sounds like a bad word. Maybe the next generation will have a better understanding. But how long can we wait?

Koobface Turns the Other Cheek

Twitter's in the news again.

There has been many reports of yet another variant of Koobface doing the rounds through Twitter. The tweets doing the rounds contain the following messages:

• My home video :)
• Watch my new private video! LOL :)
• michaeljackson' testament on youtube

Looking around for some of the hacked twitter accounts, I found a few unfortunate souls whose accounts have been hijacked to spread this malware.

Here's one example I have found below. Some of the TinyURLs are pointing to the AdultFriendFinder Web site; the one below is not responding but appears to be active.

Other URLs are directing users to a fake video Web site that contains the usual Codec-type social engineering trick to lure users into downloading and running the file.

Symantec detects this as W32.Koobface.C. The threat that it drops is detected as Antivirus2008. Given the redirects chosen by the attacker and also the threat that it drops, clearly the makers of Koobface are in the business of making money.

Twitter has taken action and suspended accounts that have been infected.

To prevent your computer from becoming infected, be wary when clicking any links you receive in a tweet, even from your friends as this worm uses social engineering techniques in an attempt to infect your computer; that is once a user is infected it will send links to their followers and hence the link comes from someone you know.

Make sure that you also regularly update your anti-virus security software to catch the latest threats. Alternatively, you can check back here regularly for new updates. =)

Source