Daily new malware count plunges as cybercriminals look to save money

The year 2015 marked the moment when demand for new malicious programmes reached saturation point, as the number of new malware files detected every day by its products fell by 15,000, from 325,000 in 2014 to 310,000, according to Kaspersky Lab.

Kaspersky Lab’s experts believe this is mainly due to the fact that coding new malware is expensive and cybercriminals have realised that they can get equally good results using intrusive advertising programmes or legitimate digital signatures in their attacks. This approach appears to be working, as results show that despite the cost-cutting in malware creation in 2015, the number of users attacked by cybercriminals increased by 5%.

Between 2012 and 2013, there was a rapid increase in the number of new malicious files detected by Kaspersky Lab, from 200,000 new files every day in 2012 to 315,000 in 2013. Thereafter, things started to slow down. In 2014, the total increased by just 10,000 files a day and in 2015 the overall number has declined from 325,000 to 310,000.

Cybercriminals in search of a quick return appear to have decided that complex coding tools such as rootkits, bootkits or replicating viruses may bring results at a cost, reducing their overall margins and revenue. Moreover, these complex malicious programmes, that can cost tens of thousands of dollars to develop, do not protect the malicious programme from increasingly sophisticated antivirus software accustomed to detecting and analysing far more complicated malware.

For this reason, 2015 saw adware, essentially harmless but often intrusive, become more prominent among overall anti-virus detections. This marks an evolution in cybercriminal tactics, with many now acting almost as businesses, engaged in selling quasi-legitimate commercial software, activity and other “essentials.”

Another trend is for cybercriminals and even advanced, state-sponsored threat actors to make greater use of legal certificates for digital products. With the help of bought or stolen certificates, attackers deceive security software, which trusts an officially-signed file more than a regular one. The value of the certificate may be only a few tens of dollars.

"Cybercrime has lost the last touch of romance. Today, malware is created, bought and resold for specific tasks. The commercial malware market has settled and is evolving towards simplification. I think will we no longer see malicious “code for the code”. This trend is also observed among the operators of targeted attacks," says Vyacheslav.

Cyberspy group repurposes 12-year-old Bifrose backdoor

A group of hackers that primarily targets companies from key industries in Asia is using heavily modified versions of a backdoor program called Bifrose that dates back to 2004.

The group, which researchers from antivirus vendor Trend Micro call Shrouded Crossbow, has been targeting privatized government organizations, government contractors and companies from the consumer electronics, computer, healthcare, and financial industries since 2010.

The group's activities are evidence that engaging in cyberespionage doesn't always require huge budgets, stockpiles of zero-day vulnerabilities and never-before-seen malware programs. Old cybercrime tools can be repurposed and improved for efficient attacks.

This toolset used by the group includes backdoors such as Kivar and Xbow, which are based on or inspired by Bifrose and which in the past have been sold on underground markets for about $10,000.

"What we think happened is that the group purchased the source code of BIFROSE, and after improving its functions, the group then designed a new installation flow, developed a new builder to create unique loader-backdoor pairs, and made more simple and concise backdoor capabilities," the Trend Micro researchers said in a blog post.

This allowed them to remain effective in their operations, despite Bifrose being a very well known and understood threat in the antivirus industry as well as one that is easily detectable.

One interesting aspect about the group is that it is organized in at least two, but possibly three or more teams, according to the Trend Micro researchers. One is the development team, which has at least 10 people who develop new builds of the backdoor. The number of people involved was determined from version strings customized with unique developer IDs.

A second team is responsible for target selection, configuring the malware parameters for each intended victim and building the spear-phishing emails that are used as delivery mechanism. The rogue emails have malicious attachments and masquerade as news reports, resumes, government data or meeting requests.

A third team might be in charge of maintaining the group's extensive command-and-control infrastructure, which includes over 100 servers whose IP addresses and domains are updated in an organized fashion. New domains are being registered all the time, the Trend Micro researchers said.

France looking at banning Tor, blocking public Wi-Fi

Leaked docs from Ministry of Interior show worryingly illiberal trend for France.

According to leaked documents France's Ministry of Interior is considering two new proposals: a ban on free and shared Wi-Fi connections during a state of emergency, and measures to block Tor being used inside France.

The documents were seen by the French newspaper Le Monde. According to the paper, new bills could be presented to parliament as soon as January 2016. These proposals are presumably in response to the attacks in Paris last month where 130 people were murdered.

The first proposal, according to Le Monde, would forbid free and shared Wi-Fi during a state of emergency. The new measure is justified by way of a police opinion, saying that it's tough to track people who use public hotspots.

The second proposal is a little more gnarly: the Ministry of Interior is looking at blocking and/or forbidding the use of Tor completely. Blocking people from using Tor within France is technologically quite complex, but the French government could definitely make it difficult for the average user to find and connect to the Tor network. If the French government needs some help in getting their blockade set up, they could always talk to the only other country in the world known to successfully block Tor: China, with its Great Firewall.

Forbidding the use of Tor through legislative means is another option: France could simply make it illegal for people to access Tor. The difficulty there, though, is in the policing of that new law: the country's ISPs would have to snoop on its users to find out who is using Tor, and then report back to the police. In the UK, where the new Snooper's Charter may require ISPs to log the last 12 months of user activity, a lot of resistance is being met.

The main problem with such a ban on Tor is that it wouldn't achieve a whole lot. Would-be terrorists could still access Tor from outside the country, and if they manage to access Tor from within France I doubt they're concerned about being arrested for illegal use of the network. There is evidence to suggest that the recent Paris attacks were planned via unencrypted channels, too: the Bataclan "go" message was sent in the clear via SMS.

On the other hand, criminalising and/or blocking Tor might affect many other legitimate users of the network, such as whistleblowers, journalists, and anyone else who wants to surf the Web privately.

The proposal to block Wi-Fi hotspots during a state of emergency is slightly more feasible, and you can see where the French government is coming from—but again, it would be technologically very difficult to implement, and the collateral damage would be huge. Millions of people would have to go without public Wi-Fi access, potentially for weeks at a time.

On November 20, a week after the attacks in Paris, France introduced new legislation that extended the current state of emergency to three months. At the same time, new laws were also introduced to make it easier for the Minister of the Interior to block any terrorism-related website, and to dramatically increase police powers for searching seized devices. The French prime minister suggested that they may soon make it illegal to merely visit a terrorism-related website, too.

Come January 2016 we'll see if the French government actually goes ahead with these new Tor and Wi-Fi blocking measures. Hopefully cooler heads will prevail: France is one of the most powerful and influential Western democracies, but it's also rapidly becoming one of the most illiberal. If France rolls out its own Great Firewall, it would then be whole lot easier for the UK, Germany, and other neighbouring countries to do the same thing.

Five security must-dos for first time cloud users

What do Apple, Amazon and Microsoft have in common?

The answer: All three technology giants, considered the gold standard among cloud computing providers, have suffered the ignominy of being breached by hackers.

Apple’s “celebgate” incident exposed personal photos of its celebrity iCloud users and made unwelcome news headlines last year. UK technology provider Code Spaces was forced out of business last year after hackers tried to blackmail it and subsequently deleted crucial data from its Amazon Web Services-hosted cloud storage. In 2013, an expired SSL certificate in Microsoft's Azure cloud service gave hackers the chance to bring down the Xbox Live and a raft of other cloud-hosted services.

Cloud security risks are rising, with attacks growing at 45% year-on-year globally, according to cloud security firm Alert Logic. In the next five years, US$2 billion will be spent by enterprises to shore up their cloud defences, according to Forrester Research.

First time cloud users can be most at risk, simply because of unfamiliarity with the new environment and the added burden of having to grapple with a new way of managing users, data and security.

Here are five security must-do’s before taking the plunge.

1. Know the cloudy areas
There are three main segments in any cloud deployment - the cloud vendor, network service provider and enterprise. Given that the cloud should be treated like an extension of the enterprise data centre, the question to ask is therefore: can a common set of security services and policies be applied across the three segments? What are the security gaps?

During vendor selection, ask the cloud vendor what security services it provides and which security vendors it works with. The cloud is a dynamic environment and requires regular updates to the security architecture to stay up with the latest threats. How does the cloud vendor guard against new security exploits and zero-day vulnerabilities?

Also find out where the boundaries are in the shared security models that come with the cloud service. Understand the extent of your cloud provider’s responsibilities - and your own. In some cloud services, such as IaaS, it is the responsibility of the enterprise to secure its applications and data in the cloud. It is therefore important to know what security appliances and vendors the cloud provider offers/allows the enterprise to deploy in the cloud to do just that.

2. New apps, new fortifications
Ready to move an application into the cloud? Before you do, consider adding new fortifications to the existing security measures you have built around your application’s authentication and log-in processes.

To fortify the access to your cloud application, you should have a granular data access scheme. You can do so by tying access privileges to roles, company positions and projects.  This will add an additional layer of protection when attackers steal your staff’s login credentials.

Account hijacking may sound basic but this age old breach has been flagged by Cloud Security Alliance as a continuing top threat for cloud users. To fortify your login process, consider implementing two-factor authentication, posture checking and the use of one-time passwords. A good tip is requiring user IDs to be changed at initial logins.

3. Embrace encryption
Data encryption is one of your biggest security ally in the cloud, and it should be non-negotiable when it comes to file transfers and emails. While it may not prevent hacking attempts or data theft, it can protect your business and save an organization from incurring hefty regulatory fines when the dreaded event happens.

Ask your cloud vendor about their data encryption schemes. Find out how it encrypts data that is at rest, in use, and on the move. To understand what data should be encrypted, it helps to get a handle of where they reside - whether in your cloud vendor’s servers, the servers of third-party companies, employee laptops, office PCs or USB drives.

4. Wrestling with the virtual
Moving into the cloud lets businesses reap the benefits of virtualization, but a virtualized environment can present challenges to data protection. The main issue has to do with managing the security and traffic in the realm of multi-tenancy and virtual machines.

Physical security appliances are typically not designed to handle the data that is in the cloud. This is where virtual security appliances come in - to secure traffic as it flows from virtual machine to virtual machine. Such appliances are built to handle the complexities of running multiple instances of applications, or multi-tenancy.

They therefore let businesses exert fine security control over their data in the cloud. Ask your cloud provider how it safeguards its virtual environment and find out what virtual security appliances it is using. If you are building your own private or hybrid cloud, consider getting virtual security products that focus on granular control.

5. Don’t be in the dark about shadow IT
There is no shortage of anecdotes and reports out there that point to how the unauthorised use of applications and cloud services, or shadow IT, is on the rise among businesses. The uncontrolled nature of this poses a security threat and governance challenge.

Your new cloud application will be at risk because of this. Consider the simple scenario in which your employees use their smartphones to open a file on their device. It is likely that the phone will make a copy of the file, which could then be sent to an unapproved online storage destination when the phone does its routine automatic backup. Your secure corporate data has just been moved to an insecure location.

Preventing access to shadow IT is unlikely to stop its growth in any given organization. It is more effective to educate your users and use technology to manage the issue. Encryption, network monitoring and security management tools can help defend your first cloud app against the risks of the shadow IT.

Symantec doubles APAC presence with new SOC in Singapore

Symantec Corp. has announced plans to beef up its Cyber Security Services business globally with an investment of more than US$50 million. A portion of this investment has been leveraged to build a new dedicated Security Operations Center (SOC) in Singapore, inaugurated yesterday, doubling Symantec’s Cyber Security Service expertise in the Asia-Pacific region.

Now more than ever, organizations require a deeper security understanding and strong proactive security measures to gain the upper hand on adversaries. Symantec’s SOCs analyze 30 billion logs worldwide each day to provide enterprise-wide protection to help organizations strengthen their defenses and respond to new threats as they emerge 24 hours a day, 7 days a week, 365 days a year.

With the launch of the SOC in Singapore, businesses will have access to intelligence, accurate threat detection and proactive notification of emerging threats to ensure their most sensitive data is protected. The new SOC will also enable businesses to shorten the time between detection and response, reduce operational costs and proactively counter emerging threats.

“Today, technology alone may not stop advanced threats. Organizations need security experts on hand to interpret and prioritize the critical events that need action. By investing in people and security IQ in Singapore and the Asia-Pacific, Symantec is expanding its visibility into the region, enabling us to bolster customers’ security operations capabilities, and protect their critical information and assets,” said Samir Kapuria, SVP and general manager of Cyber Security Services at Symantec.

“The Asia-Pacific region is incredibly diverse and multi-cultural. This allows us to attract highly educated multi lingual security professionals who bring expertise and experience from many vertical industries and global security organizations and are well-versed in the security landscape,” added Kapuria.

Last year Symantec’s team of cyber professionals protected organizations from more than half a million web attacks per day, according to the 2015 Internet Security Threat Report.

The investment will enable the company to expand its Chennai, India SOC as well as the Tokyo, Japan SOC. The next phase of the company’s SOC expansion will take place in Europe, with more facilities expected to open within the next 12 months. Once complete, Symantec will have eight SOCs worldwide, extending their current team of 500+ certified cybersecurity professionals to address every stage of the cyber-attack lifecycle.

Symantec has also invested significantly in its cyber services-enabling technology, including big data analytics and distributed computing. With an increasing demand to manage customers’ security environments with Security as a Service, Symantec Cyber Security Services offers a strong portfolio, including Managed Security Services, DeepSight Intelligence, Incident Response and Security Simulation training.

This announcement follows a US$20 million investment in existing SOCs across Australia, India and Japan in the past year.

Dell's Laptops are Infected with 'Superfish-Like' pre-installed Malware

Similar to the Superfish malware that surrounded Lenovo laptops in February, another big computer manufacturer Dell spotted selling PCs and laptops pre-installed with a rogue SSL certificate that could allow attackers:

• To impersonate as any HTTPS-protected website and spy on when banking or shopping online.

The rogue certificate, dubbed eDellRoot, was first discovered over the weekend by a software programmer named Joe Nord. The certificate is so creepy that it automatically re-installs itself even when removed from the Windows operating system.

Superfish 2.0: Unkillable Zombie
The self-signed transport layer security (TLS) credential came pre-installed as a root certificate on Dell PCs and laptops that are signed with the same private cryptographic key, which is stored locally.
That means an attacker with moderate technical skills can extract the key and abuse it to sign forged version of TLS certificates for any HTTPS-protected site on the Internet, exposing users to all manner of SSL attacks.

The certificate key can be used to conduct man-in-the-middle (MITM) attacks on Dell owners, silently stealing user names, passwords, session cookies, and other sensitive information when the affected Dell machines are connected to a malicious Wi-Fi hotspots in cafes, hospitals or airports.

The problem is similar to the scandal that hit Lenovo in February when the PC manufacturer was caught pre-installing an invasive adware program called Superfish with a similar self-signed cert to inject third-party advertisements into websites on browsers.

Although Dell's case is different as there is no indication that the certificate is being used to inject advertisements on the laptops, the resulting security issue is the same.

Affected PCs and Laptops
The self-signed certificate key was discovered to be pre-installed as a root certificate on at least three Dell laptop models:

• Dell Inspiron 5000 series notebook
• Dell XPS 15
• Dell XPS 13

This indicates that the dangerous certificate may be present on a significant number of the Dell desktops and laptops currently on the market, specifically recent Dell Inspiron Desktop, XPS, and Precision M4800 and Latitude models.

To Check if Your Computer is Vulnerable
To discover the dangerous certificate:

• Open up the Start menu
• Select Run
• Type in certmgr.msc – the Windows certificate manager – into the box and Hit Enter
• Open up the Trusted Root Certification Authority folder on the left
• Select Certificates
• Search for eDellRoot

Once found, right-click over eDellRoot and hit "Remove." It appears to be gone, but actually it's not.

Reboot your computer and reopen certmgr.msc and search for the certificate "eDellRoot". Yeah, the removed root CA cert is back.

What Should You do? How to Remove?
It seems that even if the certificate is clearly fraudulent, Google Chrome and Microsoft Edge and Internet Explorer browsers always establish an encrypted Web session with no warnings.

But fortunately, Mozilla's Firefox web browser generates an alert warning that the certificate was not trusted.

So, Dell customers with new XPS, Precision, and Inspiron models are advised to use Firefox to browse the web.

To fix the issue completely, Dell users will need to manually revoke the certificate permissions, which is a complex and technically demanding task.

Moreover, security researcher Darren Kemp from Duo Security says that the problem may be even worse than what Nord suggested.

According to an analysis done by Kempa, a bundled plugin re-installs the root CA file when it is removed. So, to remove the eDellRoot certificate completely, you must:

• First delete Dell.Foundation.Agent.Plugins.eDell.dll from your system
• Then remove the eDellRoot root CA certificate

Dell's Response
In a statement, a Dell spokesperson said the company is investigating the report and looking into the certificate, but emphasized the company’s policy of minimizing pre-loaded software for security reasons.

"Customer security and privacy is a top concern for Dell," the spokesperson said. "We've a team investigating the current [issue] and will update you as soon as we have more information."

Node.js discloses two critical security vulnerabilities

Node.js is facing two security vulnerabilities, including a potentially major denial-of-service issue, with patches for the problems not available for a week. Releases of Node.js ranging from 0.12 to version 5 are vulnerable to one or both issues.

A bulletin issued today by the Node.js Foundation, which has jurisdiction over the popular server-side JavaScript platform, covers "a high-impact denial-of-service vulnerability" and a "low-impact V8 out-of-bounds access vulnerability." V8 is the Google-developed JavaScript engine leveraged by Node.js. Officially, the DoS issue is labeled as CVE (Common Vulnerabilities and Exposures) 2015-8027, while the access problem is identified as CVE-2015-6764.

 "We have two previously undisclosed vulnerabilities. One's not that a big deal [the out-of-bound access issue], one's a slightly bigger deal," said Mikeal Rogers, community manager for the foundation. "Both will be fixed on Wednesday (December 2)" via patches that will be available at Nodejs.org. Rogers said these vulnerabilities had not been exploited.

The bulletin describes the DoS vulnerability as widespread among Node versions. "A bug exists in Node.js, all versions of v0.12.x through to v5.x inclusive, whereby an external attacker can cause a denial of service. The severity of this issue is high, and users of the affected versions should plan to upgrade when a fix is made available."

The out-of-bounds vulnerability description is less dire. "An additional bug exists in Node.js, all versions of v4.x and v5.x, whereby an attacker may be able to trigger an out-of-bounds access and/or denial of service if user-supplied JavaScript can be executed by an application. The severity of this issue is considered medium for Node.js users, but only under circumstances where an attacker may cause user-supplied JavaScript to be executed within a Node.js application. Fixes will be shipped for the v4.x and v5.x release lines along with fixes for CVE-2015-8027." The 0.10x and 0.12x lines are not affected.

Despite the seriousness of the security issues, Node representatives stressed that users shouldn't be worried. The threat to the community is "minimal," Rogers said. "In fact, we already have fixes for both. It is a routine part of our security policy, which we take seriously, to inform our community of vulnerabilities, and then give them time to plan for an upgrade."

Rogers said Node.js security is under more scrutiny since the formation of the foundation, which is affiliated with the Linux Foundation. "We have much more formal and proper security policy now."

Chinese cybercriminal underground thriving more than ever

By the end of 2013, the Chinese cybercrime underground was a very busy economy, with peddled wares that not only targeted PCs, but mobile devices as well—making it its most prolific segment, according to Trend Micro’s report entitled “Prototype Nation: The Chinese Cybercriminal Underground in 2015.”

The report also saw cybercriminals abusing popular Web services such as the instant-messaging app (IM), QQ, to communicate with peers.

Today, the Chinese underground is thriving more than ever. Data (either leaked or stolen) are now being traded along with prototypes and new functional hardware, like point-of-sales (PoS) and automated teller machine (ATM) skimmers.

Tampered PoS devices are sold to resellers who may or may not know that these devices are rigged. Some PoS skimmers come with an SMS-notification feature that allows the cybercriminal to access the stolen data remotely every time the device is used.C

Commonly sold on B2B websites, ATM skimmers are fraud-enabling devices that allow fraudsters to carry out bank fraud and actual theft. The devices have keypad overlays that are used to steal victims’ PINs.

Pocket skimmers are also widely used. These small, unnoticeable magnetic card readers can store track data of up to 2,048 payment cards. They do not need to be physically connected to a computer or a power supply to work. All captured data can be downloaded onto a connected computer.

Singapore's infosec professionals rate cybersecurity readiness a 'C minus'

The world’s information security practitioners have given global cybersecurity readiness a “C” average with an overall score of 76 percent, according to the 2016 Global Cybersecurity Assurance Report Card released by Tenable Network Security, Inc.

Singapore, the only Asian country included in the report which focused on 6 countries, ranked 4th and received a C-.

According to survey data, global cybersecurity earned an overall score of 76 percent—an underwhelming “C” average. Nearly 40 percent of respondents said they feel “about the same” or “more pessimistic” about their organizations’ ability to defend against cyber attacks compared to last year.

When asked about the biggest challenges facing them today, the practitioners cited an overwhelming threat environment as the biggest challenge, while reporting relative confidence in the effectiveness of cybersecurity products.

“What this tells me is that while security innovations solve specific new challenges, practitioners are struggling to effectively deploy an overarching security strategy without gaps between defenses,” said Ron Gula, CEO, Tenable Network Security. “It’s no surprise that many in the profession feel overwhelmed by the increasingly complex threat environment. The recent, unprecedented cyberattacks have disrupted business for leading global companies, infiltrated governments and shaken confidence among security practitioners. With so much at stake, organizations need to know whether their security programs are effective or if they are falling short.”

Cloud days ahead
Respondents consistently cited cloud applications (graded D+) and cloud infrastructure (D-) as two of the three most challenging IT components for assessing cybersecurity risks.

Mobile devices (D) also were reported as particularly challenging when assessing cyber risks. The inability to even detect transient mobile devices in the first place (C) was another big challenge for the world’s security practitioners.

On the upside, respondents largely believe they have the tools in place to measure overall security effectiveness (B-) and to convey security risks to executives and board members. On the downside, respondents question whether their executives and board members fully understand those security risks (C+) and are investing enough to mitigate them (C).

Overall Cybersecurity Assurance Report Cards by Country

•     Australia: D+ (69 percent)
•     Canada: C+ (77 percent)
•     Germany: C- (72 percent)
•     Singapore: C- (72 percent)
•     United Kingdom: C (74 percent)
•     United States: B- (80 percent)

Overall Cybersecurity Assurance Report Cards by Industry

•     Education: D (64 percent)
•     Financial Services: B- (81 percent)
•     Government: D (66 [percent)
•     Health Care: C (73 percent)
•     Manufacturing: C (76 percent)
•     Retail: C+ (77 percent)
•     Telecom & Technology: B- (81 percent)

“These index scores reflect a startling lack of ability to detect and assess cyber risk in both cloud infrastructure and applications as well as mobile devices,” said Gula. “Another concern is the uphill battle security professionals face in mobilizing their organizations’ leadership to prioritize security. There’s a disconnect between the CISO and the boardroom that must be bridged before real progress can be made.”

Many embedded devices ship without adequate security tests

An analysis of hundreds of publicly available firmware images for routers, DSL modems, VoIP phones, IP cameras and other embedded devices uncovered high-risk vulnerabilities in a significant number of them, pointing to poor security testing by manufactuers.

The study was performed by researchers from the Eurecom research center in France and Ruhr-University Bochum in Germany, who built an automated platform capable of unpacking firmware images, running them in an emulated environment and starting the embedded Web servers that host their management interfaces.

The researchers started out with a collection of 1,925 Linux-based firmware images for embedded devices from 54 manufacturers, but they only managed to start the Web server on 246 of them. They believe that with additional work and tweaks to their platform that number could increase.

The goal was to perform dynamic vulnerability analysis on the firmware packages' Web-based management interfaces using open-source penetration testing tools. This resulted in 225 high-impact vulnerabilities being found in 46 of the tested firmware images.

A separate test involved extracting the Web interface code and hosting it on a generic server so it could be tested for flaws without emulating the actual firmware environment. This test had drawbacks, but was successful for 515 firmware packages and resulted in security flaws being found in 307 of them.

The researchers also performed a static analysis with another open-source tool against PHP code extracted from device firmware images, resulting in another 9046 vulnerabilities being found in 145 firmware images.

In total, using both static and dynamic analysis the researchers found important vulnerabilities like command execution, SQL injection and cross-site scripting in the Web-based management interfaces of 185 unique firmware packages, affecting devices from a quarter of the 54 manufacturers.

The researchers focused their efforts on developing a reliable method for automated testing of firmware packages without having access to the corresponding physical devices, rather than on the thoroughness of the vulnerability scanning itself. They didn't perform manual code reviews, use a large variety of scanning tools or test for advanced logic flaws.

This means that the issues they found were really the low hanging fruit -- the flaws that should have been easy to find during any standard security testing. This begs the question: why weren't they discovered and patched by the manufacturers themselves?

It would appear that the affected vendors either didn't subject their code to security testing at all, or if they did, the quality of the testing was very poor, said Andrei Costin, one of the researchers behind the study.

Costin presented the team's findings at the DefCamp security conference in Bucharest on Thursday. It was actually the second test performed on firmware images on a larger scale. Last year, some of the same researchers developed methods to automatically find backdoors and encryption issues in a large number of firmware packages.

Some of the firmware versions in their latest dataset were not the latest ones, so not all of the discovered issues were zero-day vulnerabilities -- flaws that were previously unknown and are unpatched. However, their impact is still potentially large, because most users rarely update the firmware on their embedded devices.

At DefCamp, attendees were also invited to try to hack four Internet-of-Things devices as part of the on-site IoT Village. The contestants found two critical vulnerabilities in a smart video-enabled doorbell that could be exploited to gain full control over the device. The doorbell also had the option to control a smart door lock.

A high-end D-Link router was also compromised through a vulnerability in the firmware version that the manufacturer shipped with the device. The flaw was actually known and has been patched in a newer firmware version, but the router doesn't alert users to update the firmware.

Finally, the participants also found a lower-impact vulnerability in a router from Mikrotik. The only device that survived unscathed was a Nest Cam.

Details about the vulnerabilities have not yet been shared publicly because the IoT Village organizers, from security firm Bitdefender, intend to report them to the affected vendors first so they can be patched.

Most Small UK Businesses Have No Security Oversight

Smaller UK businesses typically don’t assign an employee to be responsible for information security education and implementation—and are becoming fraud victims as a result.

As detailed in its State of the Industry report, appropriately-named information destruction expert Shred-it has found that nearly half (46%) of small business owners have no employee responsible for managing data security issues internally. Even more concerning, more than a quarter (27%) of small businesses do not have information security policies and procedures in place at all.

And, a third of those who do have policies in place admit to never training their employees on their protocols.

If data security is not made a priority, businesses are left exposed to data breaches, fraud, heavy legal fines from the Information Commissioner’s Office (ICO) and other regulatory bodies, and loss of customers and business partners—all of which can cause irreversible damage.

Since April 2010, the ICO has issued over £7 million worth of fines to organizations that have experienced a data breach. Despite such high figures and the irreversible damage to a company’s reputation as a result of a breach, businesses are still not doing enough when it comes to data security, the report concluded.

In addition to appointing a data protection officer, companies can reduce the risk of workplace fraud by implementing a few best practices. For instance, surprise audits: Conduct unscheduled workplace audits to assess how employees process, store and destroy confidential information.

Frequent training on the risks of fraud and how to prevent it is also important, along with education about vulnerable areas in which to avoid leaving confidential information in the office and off-site.

Shred-it is also calling on the UK government to implement legislation to ensure all businesses have a dedicated employee responsible for raising awareness of the importance of data security, understanding changes to legislation and enforcing data security procedures in the workplace.

“There is a strong correlation between data security practices and data breaches. Introducing legislation which mandates an employee specifically responsible for raising awareness of data security in the workplace and implementing a ‘culture of security’, will help protect businesses  against fraud and help them avoid financial or legal penalties,” said Robert Guice, SVP, EMEA, Shred-it.

To ensure all companies in the UK follow similar standards in data protection compliance, Shred-it has also urged the government to introduce legislation which ensures organizations have dedicated employees responsible for managing and monitoring data security issues on a day-to-day basis.

The longest continuous attack recorded by Kaspersky Lab lasted almost two weeks

The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

Backdoor in Baidu Android SDK Puts 100 Million Devices at Risk

The China's Google-like Search Engine Baidu is offering a software development kit (SDK) that contains functionality that can be abused to give backdoor-like access to a user's device, potentially exposing around 100 Million Android users to malicious hackers.

The SDK in question is Moplus, which may not be directly available to the public but has already made its way into more than 14,000 Android apps, of which around 4,000 are actually created by Baidu.

Overall, more than 100 Million Android users, who have downloaded these apps on their smartphones, are in danger.

Security researchers from Trend Micro have discovered a vulnerability in the Moplus SDK, called Wormhole, that allows attackers to launch an unsecured and unauthenticated HTTP server connection on affected devices, which works silently in the background, without the user's knowledge.

This unsecured server does not use authentication and can accept requests from anyone on the Internet. Though the server is controlled by the attacker, who can send requests to a particular port of this hidden HTTP server to execute malicious commands.

Malicious Functionalities of Wormhole
Currently, the researchers have identified that the SDK is using the port 6259 or 40310 to perform malicious activities on affected Android devices, which includes:

•     Send SMS messages
•     Make phone calls
•     Get mobile phone details
•     Add new contacts
•     Get a list of local apps
•     Download files on the device
•     Upload files from the device
•     Silently install other apps (if the phone is rooted)
•     Push Web pages
•     Get phone's geo-location, and many more

Since the SDK automatically installs the Web server when a Moplus SDK app is opened, hackers just need to scan a mobile network for port 6259 or 40310, thereby finding vulnerable devices they can abuse.

Wormhole is More Dangerous than Stagefright 
The vulnerability, according to researchers, is potentially easier to exploit than the Stagefright flaw, as Wormhole doesn't require social engineering to infect an unsuspecting user.

Trend Micro has also found at least one malware strain (detected as ANDROIDOS_WORMHOLE.HRXA) in the wild that takes advantage of Wormhole in Moplus SDK.

Researchers informed both Baidu as well as Google of the vulnerability.

As a result, Baidu has just pushed a partial fix for the problem by releasing a new version of the SDK that removed some of the SDK's functionality, but not all. The HTTP server remains online and active; however, Baidu assured its users that no backdoor exists now.

This isn't the first time a Chinese company has caught distributing malicious SDK. Just a few days ago, the Taomike SDK – one of the biggest mobile ad solutions in China – was caught secretly spying on users' SMS messages and uploading them to a server in China.

The same malicious functionality was also discovered two weeks back in another SDK developed by Youmi; that affected 256 iOS apps, which were caught using private APIs to collect users private data. However, Apple eventually banned those apps from its App Store.

Akamai warns of 3 new reflection DDoS attacks

Akamai Technologies, Inc. says it has observed three new reflection distributed denial of service (DDoS) attacks in recent months. An advisory from Akamai details the DDoS threat posed by NetBIOS name server reflection, RPC portmap reflection, and Sentinel reflection in full, including payload analysis, a Snort rule, and system hardening best practices

What is DDoS reflection?
In a reflection DDoS attack, also called a DrDoS attack, there are three types of participants: the attacker, victim servers that act as unwitting accomplices, and the attacker’s target. The attacker sends a simple query to a service on a victim host. The attacker falsifies (spoofs) the query, so it appears to originate from the target. The victim responds to the spoofed address, sending unwanted network traffic to the attacker’s target. Attackers choose reflection DDoS attacks where the victim’s response is much larger than the attacker’s query, thus amplifying the attacker’s capabilities. The attacker sends hundreds or thousands of queries at high rates to a large list of victims by automated the process with an attack tool, thus causing them to unleash a flood of unwanted traffic and a denial of service outage at the target.

“Although reflection DDoS attacks are common, these three attack vectors abuse different services than we’ve seen before, and as such they demonstrate that attackers are probing the Internet relentlessly to discover new resources to leverage,” said Stuart Scholly, senior vice president and general manager, Security Business Unit, Akamai. “It looks like no UDP service is safe from abuse by DDoS attackers, so server admins need to shut down unnecessary services or protect them from malicious reflection. The sheer volume of UDP services open to the Internet for reflection DDoS attacks is staggering.”

The attack tools for each of the new reflection attacks are related – they are all modifications of the same C code. Each attack vector requires the same basic recipe – a script that sends a spoofed request to a list of victim reflectors. The command-line options are similar.

NetBIOS name server reflection DDoS attack
The NetBIOS reflection DDoS attack – specifically NetBIOS Name Service (NBNS) reflection – was observed by Akamai as occurring sporadically from March to July 2015. The primary purpose of NetBIOS is to allow applications on separate computers to communicate and establish sessions to access shared resources and to find each other over a local area network.

This attack generates 2.56 to 3.85 times more response traffic sent to the target than the initial queries sent by the attacker. Akamai observed four NetBIOS names server reflection attacks, with the largest recorded at 15.7 Gbps. Although legitimate and malicious NetBIOS name server queries are a common occurrence, a response flood was first detected in March 2015 during a DDoS attack mitigated for an Akamai customer.

RPC portmap reflection DDoS attack 
The first RPC portmap reflection DDoS attack observed and mitigated by Akamai occurred in August 2015 in a multi-vector DDoS attack campaign. RPC portmap, also known as port mapper, tells a client how to call a particular version of an Open Network Computing Remote Procedure Call (ONC RPC) service.

The largest responses had an amplification factor of 50.53. A more common amplification factor was 9.65. Of the four RPC reflection attack campaigns mitigated by Akamai, one exceeded 100 Gbps, making it an extremely powerful attack. Active malicious reflection requests were observed by Akamai almost daily against various targets in September 2015.

Asian companies are in biggest danger of cyber attacks

Attackers are advancing zero day exploits into ‘zero-day-plus-one’ attacks at record speed, warns a new report from Nexusguard. Attacks are outpacing even those IT teams working at their most efficient pace, and teams could not possibly be expected to keep up with the rate of attack.

Add to this the falling cost of botnet-for-hire schemes that threaten to attack unsuspecting businesses for as little as twenty-dollars per attack and teams are overwhelmed in their efforts to stay ahead of swiftly evolving threats.

“The Asia Pacific region not only produces the most amount of DDoS scans to the Internet, but is also the biggest target of DDoS attacks than anywhere else in the world,” says Terrence Gareau, Chief Scientist at Nexusguard. “With the highest rate of software piracy globally, it should come as no surprise that the large botnets are able to operate freely in this region simply because there are so many vulnerable systems.”

Industry and analyst research reviewed in the latest Cybersecurity Asia Pacific report sponsored by Nexusguard point further to the serious cybersecurity threat that companies in the region are facing.

The report notes that organizations in the Asia-Pacific region were forecast to spend $230 billion to deal with cybersecurity breaches in 2014 — the highest amount for any region in the world, according to International Data Corporation (IDC) and the National University of Singapore survey, as reported in Marsh’s “Cybercrime in Asia” 2014 report.

The Asia Pacific Cyber Security Market contributes 17.21 percent of the global market and will grow to 21.16 percent by 2019, according to MicroMarketMonitor.

The private sector – highly developed, economically lucrative, and a prime target for the theft of intellectual property, blackmail, phishing, and identity theft – is investing in cybersecurity in nations such as China, Japan, Korea, Australia, New Zealand, Hong Kong, and Singapore”, according to ABI Research.

Research and Markets states that demand for cloud-based security solutions is one  key trend emerging in the cybersecurity market. End-users prefer cloud-based  security solutions because they are cost-effective and can be easily managed. Therefore, both large enterprises and SMEs in the Asia-Pacific region are increasingly adopting cloud-based cyber security solutions.

According to the Asia Cloud Computing Association, China leads Asia-Pacific nations with a total addressable cloud computing market totaling $141.9 billion. Japan is the number two nation in the region at $101.4 billion. Indonesia is number three at $76.8 billion.

More importantly, Gartner predicts that by 2018, more than half of organisations will use security services firms that specialize in data protection, security risk management and security infrastructure management to enhance their security postures. The expected increase in spending to deal with cybersecurity threats and the lack of preparedness of Asian companies thus represents an opportunity for global firms and regional or local service providers to invest in the right partnerships and technologies to beef up their security offerings.

“Cyber threats including DDoS attacks are a serious meance facing CIOs and their teams, and extending across the organization, especially with the growing integration of personal mobile devices into the corporate network, and increasing mobility of the workforce spread across multiple locations, with all of these disparate areas linked through the cloud,” said Jolene Lee, CEO, Nexusguard.

“Combined with the rate and speed of cyber-attacks and the increasing intelligence behind them, companies outsourcing their cybersecurity needs would be well advised to consider not just innovative technology and global reach, but also the depth of experience and expertise in predicting and mitigating threats.”

2015 Most Dangerous Celebrity

Who doesn’t love to search for celebrities online? From red carpet photos, to clips of the latest fashion faux pas, Hollywood gossip on the Web has a lot of us hooked. But sometimes, our interest in the stars can lead us into the digital danger zone.

Intel Security has dubbed electronic dance music DJ Armin van Buuren as the Most Dangerous Cyber Celebrity of 2015.

The company found that when Web users search for his name combined with the terms "free MP4," "HD downloads," or "torrent" they have almost a one in five chance of landing on a malicious site when they click on the search results.

A number of other musicians also generate dangerous search results, according to Intel Security's Most Dangerous Celebrities study.

"With today's busy culture and a desire for real time information, consumers often click on sites that will quickly provide them with news and entertainment, without considering safety and security implications," said Stacey Conner, online safety expert at Intel Security. "Cybercriminals leverage this need for immediacy by encouraging people to visit unsafe sites that can steal private data."

Indeed, it's worth reminding employees to access content directly from official websites of content providers, to only download videos from legitimate sites, and to use caution when searching for "HD downloads," which is by far the highest virus-prone search term

Cybercriminals will continue to innovate, looking for new ways to take advantage of our interest in pop culture to steal personal information.  Luckily, there are a few things you can do to keep yourself safe:

• Only download from verified sites. Don’t download anything from a website you don’t trust. If it looks suspicious, your hunch about its legitimacy is probably right. Access content directly from reputable sources, such as Apple Music and Google Play Music.
• Be strict when sharing your personal information. If you receive a message from an unknown website asking for your log-in, or requesting other personal information, about face. Cybercriminals often pose as legitimate companies to scoop up your sensitive information via email, text, or other methods of communication. Be wary of these phishing tactics to avoid becoming a victim of identity theft.
• Let an online safety advisor be your guide. When it’s hard to tell if a site is legitimate, a web advisor can help. 
• Use comprehensive security. Whether you follow celebrity gossip or not, it’s always a good idea to protect your devices from potential infection.

Cyber Security Agency of Singapore forges partnerships to boost security capabilities

The Cyber Security Agency of Singapore (CSA) has forged new partnerships to boost cyber security capabilities as part of its ongoing efforts to strengthen Singapore’s cyber security posture and stay ahead of a rapidly evolving cyber security landscape.

The CSA signed a Memoranda of Understanding (MOU) with Singtel, Check Point Software Technologies and FireEye to signal the parties’ commitment to work together on key areas of interest.

CSA will be working with Singtel to build up local capabilities and deliver advanced cyber security services. The partnership will also see CSA and Singtel collaborate on developing manpower through training and certification to meet increasing demand and on research and development to develop new cyber security solutions.

Additionally, Singtel has launched an Advanced Security Operations Centre (ASOC) in Singapore through its strategic partnership with FireEye. The ASOC monitors advanced cyber threats globally and helps customers overcome sophisticated malicious software attacks.

“A resilient cyber security ecosystem will help reinforce Singapore’s position as a key business hub for innovation while building the foundation of a safe and smart nation,” said Bill Chang, Chief Executive Officer, Singtel Group Enterprise.

CSA’s collaboration with cyber security vendor, Check Point, taps on Check Point’s expertise in developing industry leading security solutions. Under the MOU, the parties will focus on bringing advanced solutions to Singapore while growing local capabilities to provide these solutions. The parties will also collaborate on workforce development initiatives and in-depth technical training.

CSA will work with cyber security company, FireEye, to strengthen information sharing on cyber trends and cybercrimes, threats and indicators of compromise as well as jointly devise measures to enhance incident response.

CSA also signed a Memorandum of Intent (MOI) with CREST International and the Association of Information Security Professionals (AISP) to introduce CREST certification for penetration testers in Singapore. The certifications will serve as a competency baseline for practicing professionals and service providers. Under this MOI, the partners will join hands to set up a CREST Singapore Chapter next year.

CSA and the Infocomm Development Authority of Singapore (IDA) have established the Cyber Security Associates and Technologists Programme (CSAT) to train and up-skill ICT professionals to acquire practical skills for specialised job roles for Cyber Security Operations.

The programme is aimed at helping fresh and mid-career ICT individuals attain the necessary practical skills to better equip them for cyber security roles and positions. CSA and IDA will collaborate with industry partners for the training and up-skilling of ICT professionals.

“We are excited to be taking these strides forward with our partners to enhance Singapore’s cyber security capabilities as well as raise the quality of the industry and workforce,” said David Koh, Chief Executive, CSA. “These partnerships pave the way for us to work closely together on innovative solutions to strengthen our cyber security core. We look forward to establishing more of such consequential partnerships to achieve the vision of a secure smart nation for Singapore.”

YiSpecter threat shows iOS is now firmly on attackers’ agenda

YiSpecter Trojan abuses Apple’s iOS enterprise provisioning and private APIs to earn ad revenue. Avoid it by not installing apps from untrusted sources.

Until recently, iOS device users have had a relatively quiet ride on their mobile computing journey, particularly compared to their Android-owning counterparts. Apart from the odd threat popping up here and there, there’s not much to speak of in terms of major malware issues for iOS. But this status quo is starting to change.

This year, Symantec has seen an uptick in threats hitting the iOS platform. YiSpecter (IOS.Specter) is the latest piece of malware that continues the trend of increasing attacks against iOS devices. The malware is designed to target Chinese speakers and has affected East Asia, particularly China and Taiwan. We understand that the threat is being distributed through alternative app stores, hijacked internet service provider (ISP) traffic redirecting users to download YiSpecter, forum posts, and social media.

YiSpecter is a Trojan horse for both jailbroken and non-jailbroken iOS devices which is designed to perform a range of functions, but essentially provides the basis for a back door onto the compromised device and installs adware. The Trojan can allow an attacker to perform a range of functions such as uninstalling existing apps, downloading and installing new fraudulent apps, displaying advertising in other apps that are installed on the device, and much more.

Abusing enterprise certificates to target non-jailbroken devices
YiSpecter is an iOS threat that takes advantage of the enterprise app provisioning framework. In legitimate uses of the framework, businesses can avail of enterprise certificates to provide private apps to their own workforce without making them publicly available on the official App Store. Apps built and signed with the certificates do not need to be vetted by Apple before being distributed outside of the App Store. This gives the certificate owner more scope to develop apps with features that would otherwise be rejected by Apple.

The malware creator used iOS enterprise certificates to package and sign their threat. They could have gained access to the certs in a few ways:

• Registering with Apple as an enterprise, paying the necessary fees, and going through the vetting procedure
• Stealing the cert from an existing registered developer
• Partnering with a registered developer

Once YiSpecter’s creators have the enterprise certificate, they are in a position to create and distribute their apps to potentially any iOS device without further oversight from Apple. It should be noted that if Apple learns of the misuse of an enterprise certificate, the company could instantly revoke the cert and render the signed apps useless.

A common feature of enterprise-signed apps is that they can generally only be installed after the user accepts the request to trust the app or developer. From past experience, Symantec knows that asking the user whether they trust an app or developer is rarely an effective security measure but this is still a line of defense that needs to be crossed before the malware can be installed.

Invoking private APIs
YiSpecter can carry out a lot of advanced functionality because it uses Apple’s own private APIs to perform activities that standard iOS apps can’t. These APIs are designed to allow Apple’s apps to carry out a range of system-level actions. iOS developers are not supposed to use these APIs in their apps.

Any third-party apps that use these private APIs are rejected from inclusion on the Apple App Store. YiSpecter ignores the official App Store, instead relying on unofficial distribution channels to spread the malware. As a result, the threat can take advantage of the private APIs for its own purposes.

Potential copycats
The idea of invoking the private APIs in iOS is not a new idea, but it was not something that we had seen before in iOS malware. Similarly, the abuse of enterprise provisioning is a well-known problem dating back a number of years.

What YiSpecter has demonstrated is that when these two techniques are combined, the potential for misuse is high. Now that the combination of these techniques have been proven, we may yet see copycat threats in future.

Mitigation
iOS device owners are advised not to download and install apps from untrusted sources. Instead, they should only download apps from the official App Store or from their company’s own approved app library.

We would also recommend that iOS users should avoid jailbreaking their devices. This practice violates the terms of the iOS license agreement and puts the device at an increased risk of attack.

Users should ensure that the device’s operating system and software are up to date with latest patches.

Symantec has listed top tips on how to better secure your iOS device from attacks.

What you need to know about Stagefright 2.0

Additional issues have been found surrounding audio files and libstagefright, but Google's already
got a fix underway.

The past couple of months have been filled with a lot of uncertainty surrounding a series of issues popularly named Stagefright, a name earned because most of the issues found have to do with libstagefright in Android. The security firm Zimperium has published what they are calling Stagefright 2.0, with two new issues surrounding mp3 and mp4 files that could be manipulated to execute malicious code on your phone.

Here's what we know so far, and how to keep yourself safe.

What is Stagefright 2.0?
According to Zimperium, a pair of recently discovered vulnerabilities make it possible for an attacker to present an Android phone or tablet with a file that looks like an MP3 or MP4, so when the metadata for that file is previewed by the OS that file could execute malicious code. In the event of a Man in the Middle attack or a website built specifically for delivering these malformed files, this code could be executed without the user ever knowing.

Zimperium claims to have confirmed remote execution, and brought this to Google's attention on August 15. In response, Google assigned CVE-2015-3876 and CVE-2015-6602 to the pair of reported issues and started working on a fix.
Is my phone or tablet affected?

In one way or another, yes. CVE-2015-6602 refers to a vulnerability in libutils, and as Zimperium points out in their post announcing the discovery of this vulnerability it impacts every Android phone and tablet going back as far as Android 1.0. CVE-2015-3876 affects every Android 5.0 and higher phone or tablet, and could theoretically be delivered via website or man in the middle attack.

HOWEVER.

There are currently no public examples of this vulnerability ever having been used to exploit anything outside of lab conditions, and Zimperium is not planning to share the proof-of-concept exploit they used to demonstrate this issue to Google. While it's possible someone else could figure this exploit out before Google issues a patch, with the details behind this exploit still being kept private it's unlikely.

What is Google doing about this?
According to a statement from Google, the October Security Update addresses both of these vulnerabilities. These patches will be made in AOSP and will roll out to Nexus users starting October 5th. Eagle eyed readers might have noticed the Nexus 5X and Nexus 6P we looked at recently already had the October 5th update installed, so if you pre-ordered one of those phones your hardware will arrive patched against these vulnerabilities. Additional information on the patch will be in the Android Security Google Group on October 5th.

As for non-Nexus phones, Google provided the October Security Update to partners on September 10th, and has been working with OEMs and carriers to deliver the update as soon as possible. If you take a look at the list of devices patched in the last Stagefright exploit, you've got a reasonable picture of what hardware is being considered a priority in this process.
How do I stay safe until the patch arrives for my phone or tablet?

In the event that someone really is running around with a Stagefright 2.0 exploit and trying to infect Android users, which again is highly unlikely due to the lack of public details, the key to staying safe has everything to do with paying attention to where you're browsing and what you are connected to.

Avoid public networks when you can, rely on two-factor authentication whenever possible, and stay as far away from shady websites as you possibly can. Mostly, common sense web stuff for keeping yourself safe.

Is this the end of the world?
Not even a little bit. While all of the Stagefright vulnerabilities are indeed serious and need to be treated as such, communication between Zimperium and Google to ensure these issues are addressed as quickly as possible has been fantastic. Zimperium has rightly called attention to problems with Android, and Google has stepped in to fix. In a perfect world these vulnerabilities wouldn't exist, but they do and are being addressed quickly. Can't ask for much more than that, given the situation we're in.

Credits: www.androidcentral.com/what-you-need-know-about-stagefright-20

Stagefright 2.0: A billion Android devices could be compromised

Most Android users are, once again, in danger of having their devices compromised by simply previewing specially crafted MP3 or MP4 files.

Zimperium researchers, who were the ones who discovered easily exploitable remote code execution flaws in the Stagefright media library earlier this year, are also behind this latest discovery, which the dubbed Stagefright 2.0.

"The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright)," they explained in a blog post.

"Google assigned CVE-2015-6602 to vulnerability in libutils. We plan to share CVE information for the second vulnerability as soon as it is available."

It is estimated that currently around one billion of Android devices is affected by the flaw in libutils, but the libstagefright bug is present on around 20 percent of them.

The Stagefright media library is used by Android to process a number of popular media formats.

The vulnerabilities can't be triggered via MMS (as before), but can be via browser or a third-party app that uses the vulnerable library.

Google has, naturally, been notified of the problem, and they are already working on a patch. In the meantime, Zimperium researchers won't be releasing PoC code to the public for the foreseeable future, but they will share it with Zimperium Handset Alliance partners.

All this aside, the researchers are sure that this is not the end of vulnerabilities affecting this particular library. "As more and more researchers have explored various vulnerabilities that exist within the Stagefright library and associated libraries, we expect to see more vulnerabilities in the same area," they noted.

Zimperium customers are protected against attacks exploiting these newly revealed flaws, but the company has promised to update their Stagefright Detector app to detect this vulnerability as soon as Google comes up with a patch (it's scheduled for release next week).

Let's hope that some mobile device manufacturers keep their promises when it comes to shipping patches more quickly and on a regular basis

Singapore is top country worldwide for attacks by banking Trojans

Singapore ranks as the top country globally for Kaspersky Lab users being attacked by banking
Trojans in the second quarter of 2015, according to a study done recently by Kaspersky Lab.

496 Kaspersky Lab users in the city-state had sustained such attacks. In the second quarter of 2015, Kaspersky Lab solutions had deflected attempts to launch malware capable of stealing money via online banking on the computers of 755,642 users. This is a decrease in 18.7% compared to 735,428 in the previous quarter.

Switzerland, Brazil and Australia were next in line in the list of top countries respectively. Hong Kong emerged as the fifth country in the list and also as the only other country in the Asia Pacific region. The bottom ten of the list constituted New Zealand, South Africa, Lebanon and the United Arab Emirates respectively.          

“An A.T. Kearney and EFMA global retail banking study concluded that Singapore is the second country worldwide with the highest inclination for digital banking,” says Jimmy Fong, Channel Sales Director, Southeast Asia, Kaspersky Lab.

“The nation was also placed among the top three for banking capabilities, which included innovative technological developments, a robust financial environment and digital infrastructure. Local banks also fare impeccably well in terms of online banking systems, providing cutting edge features to complement ordinary online banking services. This paves the way towards equipping banks in Singapore for the next level of digital banking.”    

With the large number of technologically savvy consumers, high smartphone penetration rates and strong digital service adoption levels, Singapore is one of the Southeast Asian countries with the highest digital banking penetration rate, pegged at 94%.

Online banking in Singapore was also the second most utilised service platform after ATMs, more than conventional branch visits and telephone banking, as a study conducted by Bain & Company found.      

Kaspersky Lab security solutions had registered a total of 5,903,377 notifications of malicious activity by programmes designed to steal money via online access to bank accounts in Q2 2015.

The percentage of Kaspersky Lab product users who encountered this threat during the reporting period in the country were calculated among all product users in the country. This is to evaluate and compare the degree of risk of being infected by banking Trojans which user computers are exposed to worldwide. Only countries with more than 10,000 Kaspersky Lab product users were included in this study.      

“Cybercriminals are always looking for ways to access vital information that can be monetised, especially when it comes to online banking. Securing critical data that can cause financial loss is essential for both individuals and businesses," said Vitaly Kamluk, Principal Security Researcher, Global Research & Analysis Team, Kaspersky Lab. “As the ease of banking becomes more convenient, it is vital that individuals follow best security practices when on the Internet, recognising that they represent a portal or doorway for numerous malicious agents to get into bigger networks and systems, to wreak havoc and cause significant damage for the business they are part of."

Scammers use Google AdWords, fake Windows BSOD to steal money from users

Faced with the infamous Windows Blue Screen of Death (BSOD), many unexperienced computer users' first reaction is panic. If that screen contains a toll free number ostensibly manned by Microsoft technicians who are there to help users overcome this problem, many are probably tempted to pick up the phone.

It is this reaction that cyber crooks are counting on. But how to make this fake screen appear on the user's computer?

According to Malwarebytes' researcher Jerome Segura, the latest scheme of this kind was detected only days ago. The crooks have been using Google's AdWords to make links to malicious pages appear at the top of the Google Search page when user searched for "youtube".

Even though the ads seemed legit at first glance, they would lead users to the fake BSOD screen (click on the screenshot to enlarge it):

Users who fell for the scheme and called the toll-free "helpline" to resolve the issue were, unbeknownst to them, talking to the scammers, who tried to get them to pay between $199 to $599 for "support packages". And, if they were particularly gullible, they were asked to share personal and bank account information.

"The BSOD is a popular theme as of late and an effective way to display bogus but legitimate error codes that would trouble many internet users," says Segura, and points out that "the best defense against tech support scams (in all their forms) is awareness."

Public Wi-Fi: How to optimise the business without compromising security

With free wireless networks readily available in Singapore, it is common to see business professionals working from their work and personal devices in public areas such as cafés.

In fact, those living in this city state will be familiar with the local wireless broadband network, Wireless@SG, available in most public areas island wide. Once registered to this network, users can enjoy seamless wireless broadband service while on the move in such public spaces.

There are plenty of business owners who have made it a point to set up wireless networks in their shops or buildings to enable patrons’ access to free Wi-Fi. But as Sean Duca, Asia Pacific Chief Security Officer for the next-generation security company, Palo Alto Networks points out, while public networks are convenient, it also increases users’ risk of having their laptops and mobile devices hacked or infected with malware.

“Hackers are generally drawn to public networks as they are easy targets; by hacking into the networks, they would easily obtain access to data from hundreds of devices that are connected at any point, says Sean. “Some of this data may be sensitive and contains private company information, and if found in the wrong hands, can result in loss of revenue and business reputation. As such, it is important to ensure that employees who use public Wi-Fi on laptops and mobile devices optimise their security measures for hotspot connectivity to ensure company data is protected at all times”.

According to Sean, there are three ways in which organisations can optimise mobile device security for public Wi-Fi hotspots:

1. Manage the device
Organisations should configure security settings appropriate for public Wi-Fi connectivity on mobile devices. This allows businesses to safely deploy business applications and oversee device usage across the organisation. Enterprise-scale device management capabilities can also be set up in order to simplify the deployment process. This can be done by applying configurations common to all users, such as email account settings.

2. Protect the device
Organisations can use endpoint security, mobile threat prevention technologies and next-generation firewalls to enforce network policies. This prevents mobile devices from being compromised, and attackers from accessing the company’s data.

Businesses should also take note that traditional endpoint security measures may not adequately protect mobile devices against threats. Hackers are constantly using more sophisticated methods which are not easily detectable. Hence, it is crucial that organisations look to investing in the newer next-generation security products.

3. Control the data
Organisations should control data access and movement between applications. This can be achieved by enforcing policies that control network access to applications and data. By isolating and controlling business data and devices, sensitive corporate data can be better protected through blocking unwanted applications and preventing devices connecting to command and control servers.

With the right security products in place, and through proper and precise policy enforcement, organisations can be assured that security isn’t compromised when their employees connect their mobile devices to wireless networks. Employees can also take advantage of free public Wi-Fi without having to worry about sensitive information falling into the wrong hands.

Credits: Sean Duca, Asia Pacific Chief Security Officer at Palo Alto Networks.

Symantec Sacks Staff After Issuing Unauthorized Google Certs

Symantec has been forced to sack several employees after Google spotted that the firm’s CA subsidiary Thawte issued unauthorized certificates last week for several domains. The certificates made it possible to impersonate HTTPS-enabled Google domains.

The Extended Validation (EV) pre-certificate for the domains google.com and www.google.com were issued as part of a Symantec internal testing process, Google claimed in a blog post.

The web giant added:

“This pre-certificate was neither requested nor authorized by Google. We discovered this issuance via Certificate Transparency logs, which Chrome has required for EV certificates starting January 1st of this year. The issuance of this pre-certificate was recorded in both Google-operated and DigiCert-operated logs.”

Symantec revealed in its own blog post on the matter that the “small number” of unauthorized certificates it issued actually linked back to three domains.

It argued that these test certs were “always within our control” and that they were immediately revoked as soon as the issue was discovered.

The security giant added:

“While our processes and approach are based on the industry best practices that we helped create, we have immediately put in place additional processes and technical controls to eliminate the possibility of human error. We will continue to relentlessly evolve these best practices to ensure something like this does not happen again.”

Symantec also revealed that it had “terminated” a few employees after they failed to follow its own internal best practices around issuing certificates.

“Because you rely on us to protect the digital world, we hold ourselves to a ‘no compromise’ bar for such breaches. As a result, it was the only call we could make,” it said.

Google said it has updated Chrome to recognize the “mis-issued” certificate – which was only valid for a day anyway.

In April this year Google took the unprecedented step of ceasing to recognize the CAs of China’s .cn operator, the government-run CNNIC.

It emerged that a CNNIC-approved intermediate certificate authority, Egyptian firm MCS Holdings, had issued unauthorized digital certificates for some Google domains inside its test network.

AT&T says malware secretly unlocked hundreds of thousands of phoneshttp://core0.staticworld.net/images/article/2015/09/20150918-att-logo-100615497-primary.idge.jpg

AT&T said three of its employees secretly installed software on its network so a cellphone unlocking service could surreptitiously funnel hundreds of thousands of requests to its servers to remove software locks on phones.

The locks prevent phones from being used on competing networks and have been an important tool used by cellular carriers to prevent customers from jumping ship. They can be electronically removed, usually after fulfilling a contract obligation, but many websites offer the same service for a small fee with no questions asked.

AT&T's allegations are made in a filing with U.S. District Court for the Western District of Washington in which it accuses two companies, four people and an unknown software developer or developers, of participating in the audacious scheme. AT&T filed its lawsuit on Sept. 11 but it was first reported by Geekwire on Friday.

The carrier first discovered something was amiss in September 2013 when a surge in the number of unlock requests alerted the company to the possible abuse of "Torch," the software used to unlock cellphones, it said in the complaint.

Upon investigation, the company discovered that the logins and passwords of two employees at a center in Washington were responsible for a large number of the requests and those requests happened within milliseconds of each other.

Both employees, Kyra Evans and Marc Sapatin, are named in the lawsuit.

On the computers of Evans and Sapatin, investigators found unauthorized software intended to route unlocking requests from an external source through AT&T's computer system, it said. AT&T says its investigators uncovered numerous iterations of the software, which grew in complexity until it was eventually able to submit the automatic requests.

Investigators later found the software on a computer of a third employee, Nguyen Lam, according to AT&T. All three are no longer working at AT&T.

AT&T says a California-based company called Swift Unlocks and its proprietor, Prashant Vira, were involved in the scheme and paid Evans and Sapatin at least US$20,000 and $10,500 respectively to install the software. But, AT&T concedes that it doesn't know the full extent of Swift Unlocks' involvement.

Swift Unlocks operates a website where people can pay to have the software lock removed from their phones. Charges vary by phone but AT&T users will generally pay $20 or less for the unlocking service.

In all, AT&T says "hundreds of thousands" of phones were unlocked as a result of the scheme. Its charges include computer fraud, breach of loyalty and civil conspiracy and the carrier has asked the court to hear the case in front of a jury.

The defendants could not immediately be reached for comment and are yet to file a reply to the allegations with the court.

Apple’s iOS App Store suffers first major attack

Apple Inc said on Sunday it is cleaning up its iOS App Store to remove malicious iPhone and iPad programs identified in the first large-scale attack on the popular mobile software outlet.

The company disclosed the effort after several cyber security firms reported finding a malicious program dubbed XcodeGhost that was embedded in hundreds of legitimate apps.

It is the first reported case of large numbers of malicious software programs making their way past Apple’s stringent app review process. Prior to this attack, a total of just five malicious apps had ever been found in the App Store, according to cyber security firm Palo Alto Networks Inc.

The hackers embedded the malicious code in these apps by convincing developers of legitimate software to use a tainted, counterfeit version of Apple’s software for creating iOS and Mac apps, which is known as Xcode, Apple said.

“We’ve removed the apps from the App Store that we know have been created with this counterfeit software,” Apple spokeswoman Christine Monaghan said in an email. “We are working with the developers to make sure they’re using the proper version of Xcode to rebuild their apps.”

She did not say what steps iPhone and iPad users could take to determine whether their devices were infected.

Palo Alto Networks Director of Threat Intelligence Ryan Olson said the malware had limited functionality and his firm had uncovered no examples of data theft or other harm as a result of the attack.

Still, he said it was “a pretty big deal” because it showed that the App Store could be compromised if hackers infected machines of software developers writing legitimate apps. Other attackers may copy that approach, which is hard to defend against, he said.

“Developers are now a huge target,” he said.

Researchers said infected apps included Tencent Holdings Ltd’s popular mobile chat app WeChat, car-hailing app Didi Kuaidi and a music app from Internet portal NetEase Inc.

The tainted version of Xcode was downloaded from a server in China that developers may have used because it allowed for faster downloads than using Apple’s U.S. servers, Olson said.

Chinese security firm Qihoo360 Technology Co. said on its blog that it had uncovered 344 apps tainted with XcodeGhost.

Apple declined to say how many apps it had uncovered.