7 Things About Android Lollipop 5.0 You Need To Know

After offering chocolate (Kit-Kat), now Google is ready to serve you Lollipops. Google on Wednesday finally revealed the official name of its next version Android L - Android 5.0 Lollipop.

The newly released Android 5.0 Lollipop ships with the latest Motorola-made Nexus 6 smartphone and Nexus 9 tablet built by HTC, but the company did not make the Lollipop available for download to other users immediately. The older versions of Nexus devices will receive the Lollipop update in the coming weeks.

Lollipop features some significant changes to the Android platform with a sleek new user interface, cross platform support and improved performance via the new ART runtime engine. The operating system also offers better battery life, improved notifications, OpenGL ES 3.1 and 64-bit support, among other features.

Here are some most notable features of Android 5.0 Lollipop, along with some insight as to when you might be able to get your hands on it.

Google describes Lollipop as "the largest Android release yet," with more than 5,000 new APIs. So from the developer’s perspective, there is a lot for developers to explore. Technically, the release brings Android up to API level 21.

1) MATERIAL DESIGN
Lollipop features a redesigned User Interface, which is referred to as Material Design, in which Google made extensive use of animations and layered elements to deliver what it promises.
The material design interface runs on multiple types of devices, including everything from your smartphone and tablet to your laptop and TV. The new interface supports elevation values, real-time shadows and lighting that gives a 3D appearance overall.

2) SECURITY IMPROVEMENTS
With Lollipop, Security gets enhanced as well, since it comes with encryption turned on by default in order to protect users’ data from being accessed on lost or stolen devices.
Most importantly, now you are free to share your devices with any of your friends, as Lollipop offers you guest user mode, where you can create multiple user accounts to enable your friends to log in on your device. Therefore, in both the cases, no one will be able to access your private files.

3) ANDROID SMART LOCK
For an extra layer of security, there is an Android Smart Lock, which makes it easier to unlock your phone without having to constantly enter a pin or trace a pattern. Android smart lock secures your phone or tablet by pairing it with a trusted device like your Android smartwatch, car, or even facial expressions.

For example, your Android Lollipop device will recognize your Smart watch and let you unlock your phone by simply tapping the power button. The company has also enforced the SELinux security module for all apps to give better protection against vulnerabilities and malware.

4) NOTIFICATIONS ENHANCEMENT
Notifications also get enhanced with the new OS, as of now you’ll be able to rank them based on your priorities. You can now view and respond to messages directly from your lock screen, and also could hide notifications for sensitive contents by turning on Priority mode through your device’s volume button.

You can also choose to avoid calls from interrupting the game you are playing or the movie you are watching. You can also see a more complete list of features here; scroll down to the bottom and click the “See All Features” link.

5) KILL-SWITCH IMPROVEMENT
Among lots of other features of Lollipop, Google is supporting a “kill-switch” to make stolen phones unusable through what it is calling “Factory Reset Protection.”
Essentially, it requires a password before a phone can be reset, ideally preventing thieves and intruders from making use of stolen phones.

6) RUNTIME AND PERFORMANCE BOOST
Users will experience a faster, smoother and more powerful computing with Lollipop. ART, an entirely new Android runtime, improves application performance and responsiveness as well. The new Android is ready for the 64-bit era, as it comes fully prepared to support a full 64-bit environment.
Supports 64 bit devices that brings desktop class CPUs to Android
Support for 64-bit SoCs using ARM, x86, and MIPS-based cores
Shipping 64-bit native apps like Chrome, Gmail, Calendar, Google Play Music, and more
Pure Java language apps run as 64-bit apps automatically

7) BATTERY LIFE
Last but not least, Android Lollipop is expected to bring some serious battery improvements to your mobile devices via Google’s Project Volta. The software will benefit you from a Power Saving mode that detects when your handset’s battery life is low, the app can automatically reduce CPU load and display brightness.

According to Google, the feature can get you an additional 90 minutes when you are running low, which is a lot of power when you are running on empty. The feature also displays an estimated time left to fully charge when your device is plugged in as well as time left on your device before you need to charge again.

YouTube Ads Lead To Exploit Kits, Hit US Victims

Malicious ads are a common method of sending users to sites that contain malicious code. Recently, however, these ads have showed up on a new attack platform: YouTube.

Over the past few months, Trend Micro has been monitoring a malicious campaign that used malicious ads to direct users to various malicious sites. Users in the United States have been affected almost exclusively, with more than 113,000 victims in the United States alone over a 30-day period.

Recently, they saw that this campaign was showing up in ads via YouTube as well. This was a worrying development: not only were malicious ads showing up on YouTube, they were on videos with more than 11 million views – in particular, a music video uploaded by a high-profile record label.

The ads observed do not directly lead to malicious sites from YouTube. Instead, the traffic passes through two advertising sites, suggesting that the cybercriminals behind this campaign bought their traffic from legitimate ad providers.

In order to make their activity look legitimate, the attackers used the modified DNS information of a Polish government site. The attackers did not compromise the actual site; instead they were able to change the DNS information by adding subdomains that lead to their own servers. (How they were able to do this is unclear.)

The traffic passes through two redirection servers (located in the Netherlands) before ending up at the malicious server, located in the United States.

The exploit kit used in this attack was the Sweet Orange exploit kit. Sweet Orange is known for using four vulnerabilities, namely:

• CVE-2013-2460 – Java
• CVE-2013-2551 – Internet Explorer
• CVE-2014-0515 - Flash
• CVE-2014-0322 – Internet Explorer

Based on Trend Micro's analyses of the campaign, they were able to identify that this version of Sweet Orange uses vulnerabilities in Internet Explorer. The URL of the actual payload constantly changes, but they all use subdomains on the same Polish site mentioned earlier. However, the behavior of these payloads are identical.

The final payloads of this attack are  variants of the KOVTER malware family, which are detected as TROJ_KOVTER.SM. This particular family is known for its use in various ransomware attacks, although they lack the encryption of more sophisticated attacks like Cryptolocker. The websites that TROJ_KOVTER.SM accesses in order to display the fake warning messages are no longer accessible.

Users who keep their systems up to date will not affected by this attack, as Microsoft released a patch for this particular vulnerability in May 2013. We recommend that read and apply the software security advisories by vendors like Microsoft, Java, and Adobe, as old vulnerabilities are still being exploited by attackers. Applying the necessary patches is essential part of keeping systems secure. Backing up files is also a good security practice to prevent data loss in the event of an attack like this.

In addition to blocking the files and malicious sites involved in this attack, Trend Micro's browser exploit prevention technology prevents attacks that target these vulnerabilities.

With additional insight from Rhena Inocencio (Threat Response Engineer), the following hashes are detected as part of this attack:

09BD2F32048273BD4A5B383824B9C3364B3F2575
0AEAD03C6956C4B0182A9AC079CA263CD851B122
1D35B49D92A6E41703F3A3011CA60BCEFB0F1025
32D104272EE93F55DFFD5A872FFA6099A3FBE4AA
395B603BAD6AFACA226A215F10A446110B4A2A9D
6D49793FE9EED12BD1FAA4CB7CBB81EEDA0F74B6
738C81B1F04C7BC59AD2AE3C9E09E305AE4FEE2D
A1A5F8A789B19BE848B0F2A00AE1D0ECB35DCDB0
A7F3217EC1998393CBCF2ED582503A1CE4777359
C75C0942F7C5620932D1DE66A1CE60B7AB681C7F
E61F76F96A60225BD9AF3AC2E207EA340302B523
FF3C497770EB1ACB6295147358F199927C76AF21

Google has been about this incident.

Nearly 7 Million Dropbox Account Passwords Allegedly Hacked

Internet users have faced a number of major privacy breaches in last two months. Major in the list are The Fappening, The Snappening and now the latest privacy breach in Dropbox security has gained everybody’s attention across the world.

Dropbox, the popular online locker service, appears to have been hacked by an unnamed hacker group. It is still unclear how the account details of so many users were accessed and, indeed, if they are actually legitimate or not. However, the group claims to have accessed details from nearly 7 million individual accounts and are threatening to release users’ photos, videos and other files.

HACKERS CLAIMED TO RELEASE 7 MILLION USERS’ PERSONAL DATA
A thread surfaced on Reddit today that include links to files containing hundreds of usernames and passwords for Dropbox accounts in plain text. Also a series of posts with hundreds of alleged usernames and passwords for Dropbox accounts have been made to Pastebin, an anonymous information-sharing site.

Hackers have already leaked about 400 accounts by posting login credentials, all starting with the letter B, and labelled it as a "first teaser...just to get things going". The perpetrators are also promising to release more more password details if they're paid a Bitcoin ransom.

"More Bitcoin = more accounts published on Pastebin. 

As more BTC is donated, More pastebin pastes will appear."

The security breach in Dropbox would definitely have bothered its millions of users and since passwords are involved in this incident, so it has more frightening consequences on its users. Reddit users have tested some of the leaked username and password combinations and confirmed that at least some of them work.

DROPBOX DENIED THE HACK - THIRD PARTY IS RESPONSIBLE
However, Dropbox has denied it has been hacked, saying the passwords were stolen apparently from third-party services that users allowed to access their accounts. In a statement to The Next Web, Dropbox said:

"Dropbox has not been hacked. These usernames and passwords were unfortunately stolen from other services and used in attempts to log in to Dropbox accounts. 

We'd previously detected these attacks and the vast majority of the passwords posted have been expired for some time now. All other remaining passwords have expired as well."

The incident came just few days after the Snappening incident in which the personal images of as much as 100,000 Snapchat users were leaked online, which was the result of a security breach in the its third-party app.

Snapchat has denied that its service or server was ever compromised, but the servers of a third-party app designed to save Snapchat photos, which became the target for hackers to obtain personal photographs.

DROPBOX - "HOSTILE TO PRIVACY" SAYS SNOWDEN
Dropbox was in the news earlier this week when, in a recent interview with The Guardian, NSA whistleblower Edward Snowden called Dropbox a "targeted, wannabe PRISM partner" that is "very hostile to privacy" — referring to its ability to access your data itself, which is yet another security consideration when it comes to web services.

Snowden suggested web users to stop using Dropbox and warned them that the cloud storage service does not safeguard users’ privacy because it holds encryption keys and can therefore be forced by governments to hand over the personal data they store on its servers. He suggested people to use an alternative cloud storage provider that do not store any encryption keys, so that the users’ data cannot be read by anyone.

USERS ARE ADVISED TO CHANGE PASSWORDS
Until the full scope of the problem is known, it’s probably worthwhile changing your password. But whether the attack is confirmed or not, it’s a good idea to change your password just to be on a safer side — especially for those users who use same password for multiple services.
Users are also recommended to turn on two-factor authentication, which Dropbox now supports and install a time-based, one-time password app on a mobile device.

Update: Dropbox has issued a statement on its blog further clarifying that the Dropbox passwords were stolen from "unrelated services."

"The usernames and passwords...were stolen from unrelated services, not Dropbox," 

the company said in a blog post. "Attackers then used these stolen credentials to try to 

log in to sites across the internet, including Dropbox. We have measures in place 

that detect suspicious login activity and we automatically reset passwords when it happens."

"Attacks like these are one of the reasons why we strongly encourage users 

not to reuse passwords across services. For an added layer of security, 

we always recommend enabling 2 step verification on your account."

Don't always think before you click on celeb news?

Don't always think before you click on celeb news? You could be bringing malware center stage:

Android Worm Masquerades as Google App

A fresh variant of an Android virus that resembles the self-propagating email worms of the early 2000s has been discovered, which pretends to be a Google Plus app.

The original version of the Selfmite bug sent itself as an SMS link to a victim’s top 20 contacts, and then pushed a third-party app for an alternative Android software market onto the mobile phone. Now, the modus operandi and the coding structure are similar to the original, but “it's both pushier and more flexible than before,” according to Sophos Security researcher Paul Ducklin.

“This time, it's using a botnet-style call-home to download data to decide what to do next, rather than having its malicious activities pre-programmed,” said Ducklin, in a blog. “The downloaded control data is fetched via HTTP and includes settings such as how many SMSes to send; what SMS text to use; where to link to; and more.”

Also, it sends itself to only five contacts now, instead of 20 - presumably an anti-detection policy or, as Ducklin said, “cyber-criminal caution” after the Heart App virus’ aggressive use of SMS (it hit the first 99 contacts) raised its profile. Heart App caught the attention of mobile phone operators and law enforcement, resulting in fairly quick blacklisting, as well as an arrest.

As for goals, Selfmite version 2.0 is being used by financially motivated criminals, he noted.

“Unlike the email viruses of the early 2000s, many of which existed to cause havoc merely by spreading (though what havoc that was!), SelfMite-B aims to make money,” Ducklin said.

Amongst the downloaded configuration information is a pair of shortcut icons. “Once downloaded, the two icons are placed in prime position on your home screen, presumably in the hope that you will click them and generate some affiliate revenue for the crooks,” Ducklin said.

In one case during testing, it was a Mobo Market icon, which, when clicked, downloaded an app entitled MoboMarket.apk. “This seems to be signed by Mobo Market, a Chinese company that runs an alternative Android marketplace,” Ducklin said.

The other, a Mobogenie icon, “redirected us to a web page urging us to sign up for a perpetual subscription SMS service (approximate cost $20/month, billed daily) under the guise of free wallpapers.”

The malware also includes code to extract and upload confidential data like the device ID, the phone's IMEI and the victim’s entire contact list.

Moral of the story? “Don't blindly trust SMSes or other messages simply because they come from your friends, unless you are certain that your friends are taking precautions,” Ducklin said.

A fresh variant of an Android virus that resembles the self-propagating email worms of the early 2000s has been discovered, which pretends to be a Google Plus app.

The original version of the Selfmite bug sent itself as an SMS link to a victim’s top 20 contacts, and then pushed a third-party app for an alternative Android software market onto the mobile phone. Now, the while the modus operandi and the coding structure are similar to the original, but “it's both pushier and more flexible than before,” according to Sophos Security researcher Paul Ducklin.

“This time, it's using a botnet-style call-home to download data to decide what to do next, rather than having its malicious activities pre-programmed,” said Ducklin, in a blog. “The downloaded control data is fetched via HTTP and includes settings such as how many SMSes to send; what SMS text to use; where to link to; and more.”

Also, it only sends itself to five contacts now, instead of 20—presumably an anti-detection policy or, as Ducklin said, “cybercriminal caution” after the Heart App virus’ aggressive use of SMS (it hit the first 99 contacts) raised its profile. Heart App caught the attention of mobile phone operators and law enforcement, resulting in fairly quick blacklisting, as well as an arrest.

As for goals, Selfmite version 2.0 is being used by financially motivated criminals, he noted.

“Unlike the email viruses of the early 2000s, many of which existed to cause havoc merely by spreading (though what havoc that was!), SlfMite-B aims to make money,” Ducklin said.

Amongst the downloaded configuration information is a pair of shortcut icons. “Once downloaded, the two icons are placed in prime position on your home screen, presumably in the hope that you will click them and generate some affiliate revenue for the crooks,” Ducklin said.

In one case during testing, it was a Mobo Market icon, which, when clicked, downloaded an app entitled MoboMarket.apk. “This seems to be signed by Mobo Market, a Chinese company that runs an alternative Android marketplace,” Ducklin said.

The other, a Mobogenie icon, “redirected us to a web page urging us to sign up for a perpetual subscription SMS service (approximate cost $20/month, billed daily) under the guise of free wallpapers.”

The malware also includes code to extract and upload confidential data like the device ID, the phone's IMEI and the victim’s entire contact list.

Moral of the story? “Don't blindly trust SMSes or other messages simply because they come from your friends, unless you are certain that your friends are taking precautions,” Ducklin said.

200,000 naked Snapchat images leaked, after third-party hack

Are you, or is a member of your family, in the habit of exchanging intimate private pictures via Snapchat?

If so, I hope you won’t relying on them remaining private.

Because, as has been known for some time, there will always be ways for Snapchat images to be preserved by recipients – even if you were hoping they would expire and delete themselves a few seconds after being viewed.

Now, in an event dubbed “the Snappening”, hackers managed to hack into the servers of a site called SnapSaved.com, one of several third-party services that have historically allowed Snapchat users to secretly save the images they have been sent.

So, if you have ever exposed your private parts to someone on Snapchat – there is a chance that your picture is now in the hands of hackers. Worse still, the images are allegedly linked to specific usernames – meaning that you might have even more embarrassment to look forward to.

And forget red faces, it could be worse than that. Many of the users of Snapchat are likely to be under the age of consent, and if they have taken intimate photographs of themselves it could technically qualify as child pornography – a point addressed in one 4Chan post.

On its Facebook page, SnapSaved.com posted a statement:

"I would like to inform the public that snapsaved.com was hacked, the dictionary index the poster is referring to, was never publicly available. We had a misconfiguration in our Apache server. Snapchat has not been hacked, and these images do not originate from their database.

Snapsaved has always tried to fight child pornography, we have even gone as far, as to reporting some of our users to the Swedish and Norwegian authorities. As soon as we discovered the breach in our systems, we immediately deleted the entire website and the database associated with it. As far as we can tell, the breach has effected 500MB of images, and 0 personal information From the database."

In an official statement given to the press, Snapchat washed its hands of any responsibility:

“We can confirm that Snapchat’s servers were never breached and were not the source of these leaks. Snapchatters were victimized by their use of third-party apps to send and receive Snaps, a practice that we expressly prohibit in our Terms of Use precisely because they compromise our users’ security. We vigilantly monitor the App Store and Google Play for illegal third-party apps and have succeeded in getting many of these removed.”

To an extent you can sympathise with Snapchat’s viewpoint. They weren’t hacked, and they weren’t guilty of sloppy security (on this occasion at least, but don’t forget that Snapchat usernames and phone numbers have been exposed in the past…).

But more clearly needs to be done to remind Snapchat’s millions of users – many of whom are teenagers – of the dangers of sending intimate images that may later leave them humiliated or embarrassed if shared with unauthorised parties.

I suspect that many of Snapchat’s users have been lulled into a false sense of security, imagining that it is safe to share intimate images via the app and believing the marketing propaganda that suggests images will be safely erased forever within ten seconds.

At the time of writing, SnapSaved.com is inaccessible. Personally, I’d be quite happy for it to stay that way – and if Snapchat itself were to suffer a similar demise, I for one wouldn’t shed any tears.

Is iWorm a Wake-Up Call for Mac Security?

With various publications reporting tens of thousands of users affected around the world by iWorm, does your organization have a good Mac security plan? When iWorm has infected a Mac computer, the malware makes a connection with a command and control (C & C) server out on the Internet. This connection with the C & C server can then be used to achieve a large range of tasks, including the theft of personal or corporate data, installing other malicious software applications, making configuration changes and more. iWorm even showed some interesting creativity by using a forum on the popular Reddit web site to communicate with its command and control network.

Maybe your Mac or organization weren’t affected, but it’s a good reminder of the fact that Macs aren’t immune to malware. In fact, over the past couple of years, our researchers have shown that Macs are increasingly seen as viable targets not only for targeted attacks, but even in the recent Shellshock situation. Here are some examples:

• Shellshock: attacks targeting Macs: http://blog.trendmicro.com/trendlabs-security-intelligence/shellshock-vulnerability-downloads-kaiten-source-code/ 
• Targeted attacks also targeting Macs: http://blog.trendmicro.com/trendlabs-security-intelligence/tibetan-themed-campaign-pushes-hybridized-malware/ 
• Flashback Mac malware: http://blog.trendmicro.com/trendlabs-security-intelligence/osx_flashbck-a-backlash-to-apples-popularity/ 
• Mac threats generally: http://blog.trendmicro.com/trendlabs-security-intelligence/category/mac/

Final thoughts on iWorm: anti-malware protection such as Trend Micro’s Security for Mac is important to have installed on all your MacOS systems, not only to block Windows malware from being spread or forwarded to Windows users, but also to block the MacOS malware that comes up from time to time. In fact, Trend Micro Security for Mac is integrated with OfficeScan and is part of the Smart Protection suites, providing the enterprise with an integrated view of malware incidents across Windows, mobile and Mac platforms.

SingTel announce security operation center, managed defence service powered by FireEye

Singapore Telecommunications Limited (SingTel) and FireEye, Inc. have announced a strategic partnership to enhance the cyber security ecosystem in Asia Pacific (APAC).

The partnership will cover significant investments related to new Advanced Security Operation Centres (ASOCs) in Singapore and Australia; and the launch of the first SingTel Managed Defence solution powered by FireEye in APAC.

The companies have also agreed to build up cyber security expertise, including training up to 150 professionals to operate the ASOCs.

SingTel and FireEye will also set up a new data store in the region; and increase awareness and knowledge of next generation cyber threats through the bi-annual APAC-focused threat advisory reports by SingTel and FireEye.

“This is a ground-breaking collaboration to enhance the cyber security ecosystem in the region,” said Bill Chang, SingTel’s CEO Group Enterprise. “This will help enterprises better manage the increasing challenges of a new generation of cyber-attacks. With deep cyber security capabilities, SingTel aims to be the preferred and trusted ICT services partner for enterprises.”

Chang added: "With more mobile devices consuming enterprise data and increasingly exposed to malware attacks, SingTel and FireEye will join forces to provide threat mitigation for mobile devices as well."

Chang further added: “Apart from offering the game-changing SingTel Managed Defence Powered by FireEye solution, which helps enterprises avert a costly and prolonged malware breach, we are strengthening the industry’s awareness and knowledge in dealing with cyber threats with our bi-annual Asia Pacific-focused threat advisory reports.”

“FireEye is very excited about our partnership with SingTel. Our managed defense capabilities deliver a level of protection, containment and remediation of highly targeted and complex attacks unmatched in the industry, and SingTel has the scale and infrastructure to help reach customers across the region,” said David DeWalt, Chairman of the Board and Chief Executive Officer for FireEye.

DeWalt added: “Many organizations realize the nature of attacks has fundamentally changed, but are unsure how to update their security infrastructure to respond to modern threats. FireEye and SingTel bring a unique solution to the market, providing managed services that transform our customers’ security posture and help protect their most valuable assets. With our two leading brands, we are looking to grow the business quickly in the Asia Pacific market.”

SingTel Managed Defence Powered by FireEye
The solution will provide continuous monitoring, detection and the quick containment of malware and other perceived threats to enterprises and government organizations.

Based on investigations in 2013 from FireEye’s Mandiant incident response unit, advanced attackers went undetected for a median of 229 days before being discovered and the vulnerabilities remediated. During this time, organization can be exposed to potential malicious activity for months. The SingTel Managed Defence Powered by FireEye solution focuses on both preventing threats from breaching a network as well as quickly alerting and remediating vulnerabilities to reduce the window of exposure.

This solution is designed to protect organizations by detecting and preventing intrusion attempts against major attack vectors with patented virtual machine-based technology. The solution also monitors an environment 24x7 and analyzing potential cyber threats using techniques based on over 100,000 hours per year of front-line experience.

The Australian centre is expected to open in Sydney in early 2015.

Unfixable USB Hack Threatens Life as We Know It

USB ports are a bit like Cinnabons at airports and bad Wi-Fi at hotels: ubiquitous. Almost every computer and millions of other connected devices have one. And while USB security has long been discussed, an 'unfixable' exploit threatens to up the danger quotient significantly—especially since it’s been made public.

Two security researchers, Adam Caudill and Brandon Wilson, have reverse-engineered a popular USB firmware from Taiwanese firm Phison, which powers hundreds of millions of devices. With the right exploit, USBs can become an injection conduit for malicious code—so, a flash drive could emulate a keyboard and issue commands on behalf of the logged-in user, to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer.

The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.

Or, a modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects the computer’s operating system prior to boot.

The compromised code in question is stored in the USB’s read-write memory, so a user can’t remove it, and no patch will fix it. In order to get rid of the issue, new USBs must be issued with an entirely different security architecture.

The two are replicating research from SR Labs’ Karsten Nohl, who gave a talk at the Black Hat security conference discussing the exploit, which he dubbed BadUSB. However, given the persistent nature of the issue, he decided not to release it.

“No effective defenses from USB attacks are known,” he said in his information page on the issue. “Malware scanners cannot access the firmware running on USB devices. USB firewalls that block certain device classes do not (yet) exist. And behavioral detection is difficult, since a BadUSB device’s behavior when it changes its persona looks as though a user has simply plugged in a new device.”

 To make matters worse, cleanup after an incident is nigh impossible.

“Simply reinstalling the operating system – the standard response to otherwise ineradicable malware – does not address BadUSB infections at their root,” Nohl said. “The USB thumb drive, from which the operating system is reinstalled, may already be infected, as may the hardwired webcam or other USB components inside the computer. A BadUSB device may even have replaced the computer’s BIOS – again by emulating a keyboard and unlocking a hidden file on the USB thumb drive.”

In case we missed the point, he added, “Once infected, computers and their USB peripherals can never be trusted again.”

But the decision not to disclose is one that Caudhill and Wilson feel is a grand mistake. So now, they’ve thrown the exploit code up on Github to bring attention to the issue.

“The belief we have is that all of this should be public. It shouldn’t be held back. So we’re releasing everything we’ve got,” Caudill told the Derbycon audience in Louisville, Ky. Last week. “This was largely inspired by the fact that [SR Labs] didn’t release their material. If you’re going to prove that there’s a flaw, you need to release the material so people can defend against it.”

Government agencies and high-end espionage groups are probably already using it, Caudhill told WIRED.

“If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it,” he said. “You have to prove to the world that it’s practical, that anyone can do it…That puts pressure on the manufacturers to fix the real issue.”

He added, “People look at these things and see them as nothing more than storage devices. They don’t realize there’s a reprogrammable computer in their hands.”

Romanian Hackers Allegedly Used The Shellshock Bug To Hack Yahoo’s Servers

Security researcher Jonathan Hall says he has found evidence that Romanian hackers used the Shellshock bug to gain access to Yahoo servers, according to a post on his website Future South.

The Shellshock bug can be used by hackers to control servers using a vulnerability in Linux and Unix. The problem has existed for over 20 years, but it was only discovered in September. If a hacker gains access to a server using the Shellshock bug, they could see everything that is stored there.

Hall, a technology consultant and Unix expert, outlined in his post the process he used to track down the hacked Yahoo servers. Hall used a Google search to find servers that had been left vulnerable to Shellshock. He discovered that the WinZip.com domain was being used by hackers to track down other servers that could be vulnerable to the bug.

Hall went on to find that Romanian hackers had gained access to Yahoo’s servers, and were gradually exploring the network in search of the popular Yahoo! Games servers. Yahoo’s games are played by millions of people, making them a target for hackers looking to wreak havoc. Through his research, Hall discovered that two of Yahoo’s servers had been breached by hackers, and that more could have already been accessed.

Yahoo’s servers were vulnerable to attack because they were using an old version of server technology Bash. Hall emailed and tweeted Marissa Mayer, as well as a member of Yahoo’s engineering team. Eventually he received a response from Yahoo that confirmed its servers had been breached and that it was working through its incident response process. Hall claims that Yahoo refused to pay him for the discovery because it claims that it is not part of the company’s bug bounty program.

Yahoo has come under fire in the past for its response to security researchers who uncover bugs in its servers. In 2013 the CEO of a security firm was awarded a $25 voucher for Yahoo-branded items after he uncovered three bugs in Yahoo’s online services.

“The new iPhone 6 recharges with two minutes in the microwave”: A new urban myth about Apple

Remember when some Apple users ‘lost’ their phones after believing stories about the iOS7 making the iPhone waterproof?

After the presentation of the latest new features in Apple devices and the new iOS8 operating system, the Internet is full of articles either in praise of or criticizing the company’s latest efforts. Users, eager to find all the latest information and the best tips on how to get the most from the new iPhone 6, scour forums and blogs to stay up-to-speed with everything about these new releases.

That’s why it’s no surprise to find these types of practical jokes doing the rounds on the Web, or to encounter some poor unsuspecting user, who perhaps expecting more than is reasonable from the new device, falls for the trick.

This story took the form of an advert, similar in style to the one launched by Apple on 4chan, announcing the new ‘Wave’ feature of iPhone, which could supposedly recharge the phone in the microwave.

click to enlarge

So do you believe everything you read on the Internet?

Shellshock Attacks Hit Major NAS Kit; IoT Next?

Security experts are warning that businesses running Internet of Things (IoT) devices could be next in the firing line after discovering what they claim to be the first Bash bug attack aimed at Network Attached Storage systems.

FireEye threat researchers James Bennett and J Gomez claimed they spotted attacks attempting to exploit the Bash remote code injection vulnerability against targets in Japan and Korea, and one in the US.

The attacks gave the hackers a root level remote shell, effectively giving them full access to the contents of the NAS, they said in a blog post.

“NAS systems are used by enterprises to store large volumes of files and house databases, as well as by consumers for personal storage,” they added.

“This makes an NAS an attractive target for attackers given the broad types of data they handle. In this case, the attackers can gain full access the NAS contents as well as execute other commands.”

The attacks in question were launched against popular NAS maker QNAP, which makes personal and business network storage and video surveillance systems for a wide variety of industries.

The firm said in an update that it had now released a patch to fix the issue.

However, the attack could mean other embedded Linux OS devices left unpatched are next in line for the Shellshock hackers, FireEye warned.

“Based on the sheer number of devices which run an embedded Linux OS and the time-to-patch window, we feel the potential for widescale compromise of network-connected personal and business data storage systems is very high at this time,” Bennett and Gomez added.

“As many smart- or connected-devices utilize similar set-ups, this represents one of the first in the wild Shellshock attack against IoT-type devices.”

The Bash bug or Shellshock vulnerability rocked the information security world when it went public last week.

Soon after it was disclosed, security vendors began reporting various attacks in the wild exploiting the vulnerability, resulting in DDoS attacks, malware droppers, data exfiltration, backdoors and more.

It had been claimed that Shellshock may not be as serious as Heartbleed in that there may be complex and varied exploitation paths for each application, making it less attractive and more time consuming for hackers to develop specific exploits