Scammers use Google AdWords, fake Windows BSOD to steal money from users

Faced with the infamous Windows Blue Screen of Death (BSOD), many unexperienced computer users' first reaction is panic. If that screen contains a toll free number ostensibly manned by Microsoft technicians who are there to help users overcome this problem, many are probably tempted to pick up the phone.

It is this reaction that cyber crooks are counting on. But how to make this fake screen appear on the user's computer?

According to Malwarebytes' researcher Jerome Segura, the latest scheme of this kind was detected only days ago. The crooks have been using Google's AdWords to make links to malicious pages appear at the top of the Google Search page when user searched for "youtube".

Even though the ads seemed legit at first glance, they would lead users to the fake BSOD screen (click on the screenshot to enlarge it):

Users who fell for the scheme and called the toll-free "helpline" to resolve the issue were, unbeknownst to them, talking to the scammers, who tried to get them to pay between $199 to $599 for "support packages". And, if they were particularly gullible, they were asked to share personal and bank account information.

"The BSOD is a popular theme as of late and an effective way to display bogus but legitimate error codes that would trouble many internet users," says Segura, and points out that "the best defense against tech support scams (in all their forms) is awareness."

Symantec Sacks Staff After Issuing Unauthorized Google Certs

Symantec has been forced to sack several employees after Google spotted that the firm’s CA subsidiary Thawte issued unauthorized certificates last week for several domains. The certificates made it possible to impersonate HTTPS-enabled Google domains.

The Extended Validation (EV) pre-certificate for the domains google.com and www.google.com were issued as part of a Symantec internal testing process, Google claimed in a blog post.

The web giant added:

“This pre-certificate was neither requested nor authorized by Google. We discovered this issuance via Certificate Transparency logs, which Chrome has required for EV certificates starting January 1st of this year. The issuance of this pre-certificate was recorded in both Google-operated and DigiCert-operated logs.”

Symantec revealed in its own blog post on the matter that the “small number” of unauthorized certificates it issued actually linked back to three domains.

It argued that these test certs were “always within our control” and that they were immediately revoked as soon as the issue was discovered.

The security giant added:

“While our processes and approach are based on the industry best practices that we helped create, we have immediately put in place additional processes and technical controls to eliminate the possibility of human error. We will continue to relentlessly evolve these best practices to ensure something like this does not happen again.”

Symantec also revealed that it had “terminated” a few employees after they failed to follow its own internal best practices around issuing certificates.

“Because you rely on us to protect the digital world, we hold ourselves to a ‘no compromise’ bar for such breaches. As a result, it was the only call we could make,” it said.

Google said it has updated Chrome to recognize the “mis-issued” certificate – which was only valid for a day anyway.

In April this year Google took the unprecedented step of ceasing to recognize the CAs of China’s .cn operator, the government-run CNNIC.

It emerged that a CNNIC-approved intermediate certificate authority, Egyptian firm MCS Holdings, had issued unauthorized digital certificates for some Google domains inside its test network.

A New Company Called Alphabet Now Owns Google

Well, this was a very unexpected move by Google.

Google Co-Founder Larry Page announced a restructuring of the whole company, revealing the creation of the umbrella "Alphabet" corporation.

But, don’t worry… Google isn’t dead! Rather, Google will become part of Alphabet.

Why Google Rebrands As ‘Alphabet’
Over time, Google, the Mountain View company has become a lot more than just a Search Engine.

Google created and acquired a large number of other popular Internet services, including Android, YouTube and Gmail, that makes too much difficult for a single company to manage all of them effectively.

According to Google Founders, it’s time, when different projects require different leaders, different company cultures, and different types of resources.

"Our model is to have a strong CEO, who runs each business, with Sergey and me in service to them as needed," Page wrote.

So the founders decided to create an all new parental brand that will manage both Google as well as its other far-flung projects — called ‘Alphabet’, going to be the biggest tech company most people have never heard of.

As a part of the new structure, Alphabet will manage Google and all of its other products, including:

• Google
• Calico, an anti-aging biotech Research Division
• Nest, Google's Smart-Home project
• Sidewalk, a company, focused on Smart Cities
• Fiber, Company for High-speed Internet services
• Investment arms, such as Google Capital and Google Ventures
• R&D unit, such as Google X, developing Self-driving cars and Drones.
• Alphabet Inc. will replace Google Inc. as the publicly traded company on the Nasdaq Stock Exchange, and shareholders will get one Alphabet share for every Google share they previously owned.

G is for 'Google' and 'Sundar Pichai 'is New CEO
Google’s senior vice president Sundar Pichai (Pichai Sundararajan), currently senior vice president of products, will be the new CEO of the Search Engine.

Google is now a more coherent company than it was previous. Google will now include the company's core businesses, including:

• Search Engine
• Advertising, Adwords, and Adsense
• Google Maps
• YouTube, the Video Service
• Android, Mobile operating system
• Chrome operating system
• related technical infrastructure.

And the current CEO Larry Page will become Alphabet’s CEO. Co-founder Sergey Brin will be its president, and Eric Schmidt will be the executive chairman of Alphabet.

"It is clear to us and our board that it is time for Sundar to be CEO of Google," Larry Page wrote in the open letter announcing the creation of Alphabet.

"Google itself is also making all sorts of new products and I know Sundar will always be focused on innovation—continuing to stretch boundaries. I know he deeply cares that we can continue to make 
big strides on our core mission to organize the world's information."

The 43-year-old Sundar Pichai rose quickly at Google, from working with the Chrome team to lead both the team as well as Android as senior vice president of Products.

The Launch of Alphabet Inc. will not affect you at all, but Good news… the company’s shares jumped 6 percent after hours, adding tens of billions of dollars to its value.

Android flaw puts personal data at risk for millions

Nearly half of Android devices are vulnerable to an attack that could replace a legitimate app with malicious software that can collect sensitive data from a phone.

Google, Samsung and Amazon have released patches for their devices, but 49.5 percent of Android users are still vulnerable, according to Palo Alto Networks, which discovered the problem. Google said it has not detected attempts to exploit the flaw.

A malicious application installed using the vulnerability, called "Android Installer Hijacking," would have full access to a device, including data such as usernames and passwords, wrote Zhi Xu, a senior staff engineer with Palo Alto.

The company wrote two exploits that take advantage of the flaw, which involves how APKs (Android application packages) are installed.

The vulnerability only affects applications that are installed from a third-party app store. Security experts generally recommend using caution when downloading apps from those sources.

Apps downloaded from third parties place their APK installation files in a device's unprotected local storage, such as an SD card, Xu wrote. From there, a system application called PackageInstaller finishes the installation. The flaw allows an APK file to be modified or replaced during installation without anyone knowing.

An attack would work like this: A user downloads what appears to be a legitimate application. The application asks for certain permissions on the device. During that process, Palo Alto found it was possible to swap or modify the APK file in the background because the PackageInstaller fails to verify it, Xu wrote.

After clicking the install button, "the PackageInstaller can actually install a different app with an entirely different set of permissions," he wrote.

Android devices do not need to be rooted for the attack to work, although rooting does make devices more vulnerable.

When the flaw was discovered, in January 2014, close to 90 percent of all Android devices were affected. That has since dropped to 49.5 percent, but many devices have not been patched.

Palo Alto's exploits were successful against Android versions 2.3, 4.0.3 to 4.0.4, 4.1.x, and 4.2.x. The 4.4 version of Android fixes the issue. Some Android 4.3 devices may still be affected, however, since some manufacturers have not patched yet, Xu wrote.

Google has published a patch here, and Amazon recommends downloading the latest version of the Amazon AppStore, which will update its Fire devices, Xu wrote.

Palo Alto has also developed an Android app that will detect if a device is still vulnerable.

Google releases Cloud-based Web App Vulnerability Scanner and Assessment Tool

Google on Thursday unleashed its own free web application vulnerability scanner tool, which the search engine giant calls Google Cloud Security Scanner, that will potentially scan developers' applications for common security vulnerabilities on its cloud platform more effectively.

SCANNER ADDRESSES TWO MAJOR WEB VULNERABILITIES
Google launched the Google Cloud Security Scanner in beta. The New web application vulnerability scanner allows App Engine developers to regularly scan their applications for two common web application vulnerabilities:

• Cross-Site Scripting (XSS)
• Mixed Content Scripts

Despite several free web application vulnerability scanner and vulnerability assessment tools are available in the market, Google says these website vulnerability scanners are typically hard to set up and "built for security professionals," not for web application developers that run the apps on the Google App Engine.

While Google Cloud Security Scanner will be easier for web application developers to use. This web application vulnerability scanner easily scans for Cross-Site Scripting (XSS) and mixed content scripts flaws, which the company argues are the most common security vulnerabilities Google App Engine developers face.

Today, common HTML5 and JavaScript-heavy applications are more challenging to crawl and test, and Google Cloud Security Scanner claims to take a novel approach by parsing the code and then executing a full-page render to find more complex areas of a developer's site.

GO FOR WEB VULNERABILITY SCAN NOW
The developers can access the Cloud Security Scanner under Compute > App Engine > Security in Google's Developers Console. This will run your first scan. It does not work with App Engine Managed VMs, Google Compute Engine, or other resources.

Google notes that there are two typical approaches to such security scans:

• Parse the HTML and emulate a browser – This is fast; however, it comes at the cost of missing site actions that require a full DOM or complex JavaScript operations.
• Use a real browser – This approach avoids the parser coverage gap and most closely simulates the site experience. However, it can be slow due to event firing, dynamic execution, and time needed for the DOM to settle.

Security Engineering head Rob Mann says that their web vulnerability scanner uses Google Compute Engine to dynamically create a botnet of hundreds of virtual Chrome workers that scan at a max rate of 20 requests per second, so that the target sites won’t be overloaded.

"Cloud Security Scanner addresses the weaknesses of [real and emulated browsers] by using a multi-stage pipeline," Mann wrote in a blog post. "As with all dynamic vulnerability scanners, a clean scan does not necessarily mean you're security bug free."

The search engine giant still recommended developers to look into manual security review by a web app security professional, just to be on the safer side. However, the company hopes its vulnerability scanner tool will definitely provide a simple solution to the most common App Engine issues with minimal false positives.

Google Isn’t Fixing Some Old Android Bugs

Google appears to no longer be fixing security flaws in the oldest versions of its smartphone Internet
browser.

The previously undisclosed move could leave some users with older phones exposed to snooping by hackers and spies, security researchers said.

The new policy applies to the default browser in Android version 4.3, released in mid-2013 and known as Jelly Bean, and earlier. That covers roughly two-thirds of the billion-plus Android devices in use, according to Google, but some users may have updated their browsers to newer versions.

The policy does not apply to browsers in Android 4.4, or KitKat, which Google released in October 2013, or Android 5.0, or Lollipop, released in November 2014. Those versions changed how websites are viewed on Android devices.

The security blind spot illustrates the challenges companies face as they try to move customers onto newer products and focus security resources on patching more-current software. Microsoft applied the same reasoning when it stopped supporting Windows XP, first released in 2001, in April.

That makes any new security holes found in the old software dangerous after they become public, since the companies won’t fix them.

The tension is particularly acute at Google, which has spent the past few years championing Internet security. The company has led the way in encrypting email and gives preference in its search rankings to websites that use encryption.

Rafay Baloch, a Pakistani security researcher, discovered Google’s shift a few months ago after he found several bugs in the old Android browser. Researchers like Baloch, sometimes called “white hat hackers,” comb through popular software searching for slipups that could give bad hackers an opening. Tech giants like Google and Facebook FB sometimes pay researchers for their discoveries.

As recently as September, Google had fixed, or patched, one of Baloch’s security flaws in the older browser. But when he submitted another one later in the fall, Google’s security team responded that if the affected Web browser is on Android 4.3 or earlier, “we generally do not develop the patches ourselves but do notify partners of the issue.” Google said it would distribute patches developed by others.

“What Google doesn’t seem to be considering seriously, though, is the cost associated with this move,” Tod Beardsley, a senior engineer at Rapid 7, who has worked with Baloch and Google on the issue. Beardsley reasoned that many consumers buy old phones to save money and not all carriers push through Android updates.

This past fall, Google announced a new project to sell sub-$100 phones in developing markets. Called Android One the push requires phones to ship with Android 4.4 or later and receive automatic updates for up to two years.

_________________________________________

7 Things About Android Lollipop 5.0 You Need To Know

After offering chocolate (Kit-Kat), now Google is ready to serve you Lollipops. Google on Wednesday finally revealed the official name of its next version Android L - Android 5.0 Lollipop.

The newly released Android 5.0 Lollipop ships with the latest Motorola-made Nexus 6 smartphone and Nexus 9 tablet built by HTC, but the company did not make the Lollipop available for download to other users immediately. The older versions of Nexus devices will receive the Lollipop update in the coming weeks.

Lollipop features some significant changes to the Android platform with a sleek new user interface, cross platform support and improved performance via the new ART runtime engine. The operating system also offers better battery life, improved notifications, OpenGL ES 3.1 and 64-bit support, among other features.

Here are some most notable features of Android 5.0 Lollipop, along with some insight as to when you might be able to get your hands on it.

Google describes Lollipop as "the largest Android release yet," with more than 5,000 new APIs. So from the developer’s perspective, there is a lot for developers to explore. Technically, the release brings Android up to API level 21.

1) MATERIAL DESIGN
Lollipop features a redesigned User Interface, which is referred to as Material Design, in which Google made extensive use of animations and layered elements to deliver what it promises.
The material design interface runs on multiple types of devices, including everything from your smartphone and tablet to your laptop and TV. The new interface supports elevation values, real-time shadows and lighting that gives a 3D appearance overall.

2) SECURITY IMPROVEMENTS
With Lollipop, Security gets enhanced as well, since it comes with encryption turned on by default in order to protect users’ data from being accessed on lost or stolen devices.
Most importantly, now you are free to share your devices with any of your friends, as Lollipop offers you guest user mode, where you can create multiple user accounts to enable your friends to log in on your device. Therefore, in both the cases, no one will be able to access your private files.

3) ANDROID SMART LOCK
For an extra layer of security, there is an Android Smart Lock, which makes it easier to unlock your phone without having to constantly enter a pin or trace a pattern. Android smart lock secures your phone or tablet by pairing it with a trusted device like your Android smartwatch, car, or even facial expressions.

For example, your Android Lollipop device will recognize your Smart watch and let you unlock your phone by simply tapping the power button. The company has also enforced the SELinux security module for all apps to give better protection against vulnerabilities and malware.

4) NOTIFICATIONS ENHANCEMENT
Notifications also get enhanced with the new OS, as of now you’ll be able to rank them based on your priorities. You can now view and respond to messages directly from your lock screen, and also could hide notifications for sensitive contents by turning on Priority mode through your device’s volume button.

You can also choose to avoid calls from interrupting the game you are playing or the movie you are watching. You can also see a more complete list of features here; scroll down to the bottom and click the “See All Features” link.

5) KILL-SWITCH IMPROVEMENT
Among lots of other features of Lollipop, Google is supporting a “kill-switch” to make stolen phones unusable through what it is calling “Factory Reset Protection.”
Essentially, it requires a password before a phone can be reset, ideally preventing thieves and intruders from making use of stolen phones.

6) RUNTIME AND PERFORMANCE BOOST
Users will experience a faster, smoother and more powerful computing with Lollipop. ART, an entirely new Android runtime, improves application performance and responsiveness as well. The new Android is ready for the 64-bit era, as it comes fully prepared to support a full 64-bit environment.
Supports 64 bit devices that brings desktop class CPUs to Android
Support for 64-bit SoCs using ARM, x86, and MIPS-based cores
Shipping 64-bit native apps like Chrome, Gmail, Calendar, Google Play Music, and more
Pure Java language apps run as 64-bit apps automatically

7) BATTERY LIFE
Last but not least, Android Lollipop is expected to bring some serious battery improvements to your mobile devices via Google’s Project Volta. The software will benefit you from a Power Saving mode that detects when your handset’s battery life is low, the app can automatically reduce CPU load and display brightness.

According to Google, the feature can get you an additional 90 minutes when you are running low, which is a lot of power when you are running on empty. The feature also displays an estimated time left to fully charge when your device is plugged in as well as time left on your device before you need to charge again.

YouTube Ads Lead To Exploit Kits, Hit US Victims

Malicious ads are a common method of sending users to sites that contain malicious code. Recently, however, these ads have showed up on a new attack platform: YouTube.

Over the past few months, Trend Micro has been monitoring a malicious campaign that used malicious ads to direct users to various malicious sites. Users in the United States have been affected almost exclusively, with more than 113,000 victims in the United States alone over a 30-day period.

Recently, they saw that this campaign was showing up in ads via YouTube as well. This was a worrying development: not only were malicious ads showing up on YouTube, they were on videos with more than 11 million views – in particular, a music video uploaded by a high-profile record label.

The ads observed do not directly lead to malicious sites from YouTube. Instead, the traffic passes through two advertising sites, suggesting that the cybercriminals behind this campaign bought their traffic from legitimate ad providers.

In order to make their activity look legitimate, the attackers used the modified DNS information of a Polish government site. The attackers did not compromise the actual site; instead they were able to change the DNS information by adding subdomains that lead to their own servers. (How they were able to do this is unclear.)

The traffic passes through two redirection servers (located in the Netherlands) before ending up at the malicious server, located in the United States.

The exploit kit used in this attack was the Sweet Orange exploit kit. Sweet Orange is known for using four vulnerabilities, namely:

• CVE-2013-2460 – Java
• CVE-2013-2551 – Internet Explorer
• CVE-2014-0515 - Flash
• CVE-2014-0322 – Internet Explorer

Based on Trend Micro's analyses of the campaign, they were able to identify that this version of Sweet Orange uses vulnerabilities in Internet Explorer. The URL of the actual payload constantly changes, but they all use subdomains on the same Polish site mentioned earlier. However, the behavior of these payloads are identical.

The final payloads of this attack are  variants of the KOVTER malware family, which are detected as TROJ_KOVTER.SM. This particular family is known for its use in various ransomware attacks, although they lack the encryption of more sophisticated attacks like Cryptolocker. The websites that TROJ_KOVTER.SM accesses in order to display the fake warning messages are no longer accessible.

Users who keep their systems up to date will not affected by this attack, as Microsoft released a patch for this particular vulnerability in May 2013. We recommend that read and apply the software security advisories by vendors like Microsoft, Java, and Adobe, as old vulnerabilities are still being exploited by attackers. Applying the necessary patches is essential part of keeping systems secure. Backing up files is also a good security practice to prevent data loss in the event of an attack like this.

In addition to blocking the files and malicious sites involved in this attack, Trend Micro's browser exploit prevention technology prevents attacks that target these vulnerabilities.

With additional insight from Rhena Inocencio (Threat Response Engineer), the following hashes are detected as part of this attack:

09BD2F32048273BD4A5B383824B9C3364B3F2575
0AEAD03C6956C4B0182A9AC079CA263CD851B122
1D35B49D92A6E41703F3A3011CA60BCEFB0F1025
32D104272EE93F55DFFD5A872FFA6099A3FBE4AA
395B603BAD6AFACA226A215F10A446110B4A2A9D
6D49793FE9EED12BD1FAA4CB7CBB81EEDA0F74B6
738C81B1F04C7BC59AD2AE3C9E09E305AE4FEE2D
A1A5F8A789B19BE848B0F2A00AE1D0ECB35DCDB0
A7F3217EC1998393CBCF2ED582503A1CE4777359
C75C0942F7C5620932D1DE66A1CE60B7AB681C7F
E61F76F96A60225BD9AF3AC2E207EA340302B523
FF3C497770EB1ACB6295147358F199927C76AF21

Google has been about this incident.

Android Worm Masquerades as Google App

A fresh variant of an Android virus that resembles the self-propagating email worms of the early 2000s has been discovered, which pretends to be a Google Plus app.

The original version of the Selfmite bug sent itself as an SMS link to a victim’s top 20 contacts, and then pushed a third-party app for an alternative Android software market onto the mobile phone. Now, the modus operandi and the coding structure are similar to the original, but “it's both pushier and more flexible than before,” according to Sophos Security researcher Paul Ducklin.

“This time, it's using a botnet-style call-home to download data to decide what to do next, rather than having its malicious activities pre-programmed,” said Ducklin, in a blog. “The downloaded control data is fetched via HTTP and includes settings such as how many SMSes to send; what SMS text to use; where to link to; and more.”

Also, it sends itself to only five contacts now, instead of 20 - presumably an anti-detection policy or, as Ducklin said, “cyber-criminal caution” after the Heart App virus’ aggressive use of SMS (it hit the first 99 contacts) raised its profile. Heart App caught the attention of mobile phone operators and law enforcement, resulting in fairly quick blacklisting, as well as an arrest.

As for goals, Selfmite version 2.0 is being used by financially motivated criminals, he noted.

“Unlike the email viruses of the early 2000s, many of which existed to cause havoc merely by spreading (though what havoc that was!), SelfMite-B aims to make money,” Ducklin said.

Amongst the downloaded configuration information is a pair of shortcut icons. “Once downloaded, the two icons are placed in prime position on your home screen, presumably in the hope that you will click them and generate some affiliate revenue for the crooks,” Ducklin said.

In one case during testing, it was a Mobo Market icon, which, when clicked, downloaded an app entitled MoboMarket.apk. “This seems to be signed by Mobo Market, a Chinese company that runs an alternative Android marketplace,” Ducklin said.

The other, a Mobogenie icon, “redirected us to a web page urging us to sign up for a perpetual subscription SMS service (approximate cost $20/month, billed daily) under the guise of free wallpapers.”

The malware also includes code to extract and upload confidential data like the device ID, the phone's IMEI and the victim’s entire contact list.

Moral of the story? “Don't blindly trust SMSes or other messages simply because they come from your friends, unless you are certain that your friends are taking precautions,” Ducklin said.

A fresh variant of an Android virus that resembles the self-propagating email worms of the early 2000s has been discovered, which pretends to be a Google Plus app.

The original version of the Selfmite bug sent itself as an SMS link to a victim’s top 20 contacts, and then pushed a third-party app for an alternative Android software market onto the mobile phone. Now, the while the modus operandi and the coding structure are similar to the original, but “it's both pushier and more flexible than before,” according to Sophos Security researcher Paul Ducklin.

“This time, it's using a botnet-style call-home to download data to decide what to do next, rather than having its malicious activities pre-programmed,” said Ducklin, in a blog. “The downloaded control data is fetched via HTTP and includes settings such as how many SMSes to send; what SMS text to use; where to link to; and more.”

Also, it only sends itself to five contacts now, instead of 20—presumably an anti-detection policy or, as Ducklin said, “cybercriminal caution” after the Heart App virus’ aggressive use of SMS (it hit the first 99 contacts) raised its profile. Heart App caught the attention of mobile phone operators and law enforcement, resulting in fairly quick blacklisting, as well as an arrest.

As for goals, Selfmite version 2.0 is being used by financially motivated criminals, he noted.

“Unlike the email viruses of the early 2000s, many of which existed to cause havoc merely by spreading (though what havoc that was!), SlfMite-B aims to make money,” Ducklin said.

Amongst the downloaded configuration information is a pair of shortcut icons. “Once downloaded, the two icons are placed in prime position on your home screen, presumably in the hope that you will click them and generate some affiliate revenue for the crooks,” Ducklin said.

In one case during testing, it was a Mobo Market icon, which, when clicked, downloaded an app entitled MoboMarket.apk. “This seems to be signed by Mobo Market, a Chinese company that runs an alternative Android marketplace,” Ducklin said.

The other, a Mobogenie icon, “redirected us to a web page urging us to sign up for a perpetual subscription SMS service (approximate cost $20/month, billed daily) under the guise of free wallpapers.”

The malware also includes code to extract and upload confidential data like the device ID, the phone's IMEI and the victim’s entire contact list.

Moral of the story? “Don't blindly trust SMSes or other messages simply because they come from your friends, unless you are certain that your friends are taking precautions,” Ducklin said.

Massive “Gmail Credentials” Dump Posted Online

Another day, another large haul of logins posted to the web. 

While the linked article sounds a bit scary with mentions of a “big security breach” for Gmail, that isn’t the case here and there’s no need to run screaming for the hills just yet. 

What actually appears to have happened is that somebody rolled up lots of older data dumps originating from various causes (such as phishing and / or password reuse) and released it all in one go, posting it to a Bitcoin forum. 

As these logins could give scammers access to Gmail should the email and passwords match up, Google took a look at the data and the results are as follows:

• Less than 2% of what is claimed to be close to 5 million account credentials “might” have worked, and their automated detection systems would have “blocked many of those login attempts.”
• Enabling the various security tools on offer from Google will help to bump up the security level on your accounts and services. Passwords, recovery options, 2 step verification – all of these are available to you.
• These leaked accounts were not the result of a breach of Google systems.

The popular Haveibeenpwned site, run by well-known software architect and Microsoft MVP Troy Hunt – which lets visitors check if their username or email address (NOT password) have appeared in any data breaches – has been updated to reflect this latest data dump.

It seems 17% of the accounts were already in there to begin with. If you’re wanting to keep up with the latest stats, figures and “Where has this data been seen before” you should keep an eye on that particular Twitter account as it promises to be a busy few days.

Otherwise, don’t panic and have a look at your security settings sooner rather than later. You’ll likely be glad you did.

“YouTube Account Manager has sent you a Message…”

We’ve seen some complaints of a message sent to YouTube users via the YouTube messaging system, warning of account suspension:

YouTube account manager has sent you a message

We’d like to inform you that due to repeated or severe violations of our community guidelines and your YouTube account will be suspended 3 days from the time of this message. After careful review we determined that activity in your account violated our community guidelines, which prohibit spam, scams or commercially deceptive content. Please be aware that you are prohibited from accessing, possessing or creating any other YouTube accounts.

Please follow the following instructions to recover your account:

1. Please contact your account manager here: [url]

2. You have to complete a quick survey to make sure you are human.

3. Wait for our email explaining the next steps.

* If you decide to ignore this message and not follow the above steps your account will be suspended.

You can see examples of this on posts made by puzzled YouTubers over on Instagram [1], [2], Yahoo [1] and a few more people complaining about it in Google Groups.

This is what you would see after hitting the supplied link in the message:

“Complete a survey to verify your account”

This one is a survey scam, and whoever is sending these messages is looking to make a little cash along with the panic they’re no doubt whipping up in YouTube users right about now.

The links displayed on the left hand side are regional and will take clickers to various offers / surveys / signups and downloads.

If you’re in any doubt as to the status of your YouTube account, you’d be better served contacting them directly than being tricked by these false messages currently in circulation. Scammers will often use similar tactics to send phishing links and malware, so in some ways recipients of this missive are getting the best of a bad deal – it’s “only” surveys and forms to fill in, along with the occasional download.

However, that doesn’t mean we should rush to jump through their survey sign-up hoops either.

Steer clear of this one, and keep on making those videos.

Google Reportedly Prepping 'Child-Safe' Version of Services

Google is reportedly preparing to launch a child-centric version of some of its services — a move that would give kids their own Google accounts for the first time.

Currently, the company's age limit on those who can officially obtain a Google in the U.S. is 13 years old.

According to a report in a report by The Information Monday, the new initiative will allow younger users to obtain their own YouTube accounts on a "child safe" version of the video site.

Google will also start requiring that users disclose their age when signing up for a Google account on Android devices, the report says — and will give parents a dashboard application that will allow them to monitor the activity of their children on Google services.

Many underage children are likely already accessing Google's account-only services through various illicit means. Introducing such a change could dramatically increase Google's user base, particularly among children whose digital activities are more closely monitored by their parents.

"We don't comment on rumor or speculation," a Google spokesperson told Mashable when asked to comment on the report of the new initiative.  

Researchers Show Malware Can Hack Gmail App With 92% Success Rate

Researchers claims a new piece of malware can steal highly sensitive data from smartphone apps on Android, Windows Phone and iOS with up to a 92% success rate.

The researchers have showcased the proof-of-concept malware running on an Android smartphone with the malicious software able to steal information such as login details, credit card numbers and even sensitive pictures taken with the victim's smartphone camera.

The researchers have not shown the attack working on iOS or Windows Phone operating systems, but they believe that the weakness exists in both platforms to carry out similar attacks "because they share a key feature researchers exploited in the Android system."

One of the researchers, Zhiyun Qian, said: "The assumption has always been that these apps can't interfere with each other easily. We show that assumption is not correct and one app can in fact significantly impact another and result in harmful consequences for the user."

Benign
The attack only works if the attackers can get their victims to download what looks like a benign application, which is in fact a piece of malware. While this can be done on Android through third-party app stores, it is not as easy on iOS, while Apple only allows apps to be downloaded from the official App Store.

For the attack to work, say the researchers, it must happen at the exact time the victim is inputting the sensitive information the attackers are after.

In order to achieve this, the researchers have exploited "a newly discovered public side channel" - the shared memory statistics of an app's process, which can be accessed without any privileges.

The malware is constantly monitoring for changes in the shared memory of the target app (which can be anything from a banking app to Gmail or Amazon) and once the malware notices a change to what the researchers have called an "activity transition event" - such as taking a picture or logging into your Gmail account - the malware takes over and begins capturing the data.

92% successful
The researchers have released three videos (which can be seen here) showing the exploit in action, capturing login details, credit card information and pictures.

The researchers tested the malware against seven different apps including Gmail, Amazon, Newegg, Hotels.com and an app from Chase bank.

Of the apps tested Gmail was the most vulnerable with a 92% success rate in capturing sensitive data, while Amazon was the least vulnerable with just a 48% success rate.

The reason for the Amazon app's lower vulnerability according to the researchers was because it allows one activity to transition to numerous other activities, making it more difficult to guess which activity the app was using.

IBTimes UK contacted Google for a comment on the report with a spokesperson saying they are looking into the matter.

The researchers will publish their full report, called Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks on Friday, 22 August at a security conference in San Diego.

The authors of the paper are Zhiyun Qian, of the Computer Science and Engineering Department at University of California; Z. Morley Mao, an associate professor at the University of Michigan; and Qi Alfred Chen, a Ph.D. student working with Mao

Yahoo wants to encrypt all of your email, with Google’s help

Yahoo will offer its users full end-to-end email encryption and compatibility with Google’s own end-to-end email encryption at some point in 2015, CNET reports, as Yahoo chief information security officer Alex Stamos on Thursday confirmed the company’s email encryption plans at the Black Hat conference.

End-to-end email encryption will make it harder for third parties to snoop on user data, and it’s a step forward for Yahoo, which has already encrypted email at the data center level. The company hopes to work with other email providers in the future, in addition to Google.

“What this means is that eventually not only will Yahoo Mail users be able to communicate in an encrypted manner with other Yahoo Mail users, but also with Gmail users and eventually with other email systems that adopt similar methodologies,” Stamos said.

“We don’t have any other providers to talk about yet, but the hope is that this is open and will be adopted by many others in the email ecosystem,” a Yahoo spokeswoman said.

Yahoo will be offering its encryption source code to the community this fall, just like Google, hoping that its security will be further improved with help from Yahoo Mail users.

Combined, Google and Yahoo have almost 700 million email users, with Yahoo’s email usage estimated at over 273 million accounts.

Do We Want Google To Have This Much Power; Child Pornographer Caught By Gmail Scan.

A slightly disturbing piece of news: a child pornographer has been caught as a result of Google scanning his emails for known images of child abuse.

Hundreds of millions of email accounts are now being routinely scanned for illegal images, thanks to sophisticated new Google software

"Technology giant Google has developed state of the art software which proactively scours hundreds of millions of email accounts for images of child abuse.
The breakthrough means paedophiles around the world will no longer be able to store and send vile images via email without the risk of their crimes becoming known to the authorities.

Details of the software emerged after a 41-year-old convicted sex offender was arrested in Texas for possession of child abuse images.

Police in the United States revealed that Google’s sophisticated search system had identified suspect material in an email sent by a man in Houston. 

Child protection experts were automatically tipped off and were then able to alert the police, who swooped after requesting the user’s personal information from Google."

Yes, we know that Google has been scanning our Gmail in order to serve us ads. But this newer link into the criminal justice system is worrying. For of course such a tactic is not going to remain applied to one crime and one crime only. We can easily enough imagine extensions of it to mentions perhaps of drugs, or drug dealing. Or in countries with a rather lower level of protection for civil liberty than our own for certain buzzwords to do with the politics of those countries. And don’t forget that Google is subject to the laws of the countries in which it operates. If, say, China requires that emails that contain “Tiananmen Square” be reported to the Chinese security agencies then Google will have to comply or not do business in that country (and I think Google has declined to do some work inside China on that basis and Yahoo has not so declined).

The point being that having now shown that they can monitor email for the proof of one crime the company will come under ever greater pressure from a number of sources to apply the same monitoring techniques to evidence of other crimes. And there’s plenty of place around the world where it is criminal to do things we regard as being a lot more benign than child pornography. Even, places where it’s illegal to do things that we consider to be basic human rights. It seems to me inevitable that this technique, however just people may think it to be for this one particular crime, is going to expand out to many others.

Of course, one can simply not use Gmail, one can also simply not do anything that might constitute a crime, but it’s still worrying to me that our communications are to be so vetted.

SMS-controlled Android malware records calls

Researchers at NQ Mobile Security have discovered a new piece of Android malware that receives instructions, i.e. is controlled, via SMS.

Dubbed TigerBot, the Trojan hides by not showing any icon on the home screen and takes the names and icons of popular and common Google and Adobe apps like "Flash" or "System" in order to blend in with the legitimate apps installed on the phone.

"In order to receive remote commands, it registers a receiver with a high priority to listen to the intent with action 'android.provider.Telephony.SMS_RECEIVED'," point out the researchers. "As a result, it can receive and intercept incoming SMS messages before others with lower priorities."

The capabilities of the malware include: recording phone calls, changing network settings, uploading the current GPS location, capturing and uploading images, sending text messages to a particular number (but, it seems, not a premium service one), rebooting the phone and killing other running processes. Still, not all the actions are always effective.

So far, the Trojan hasn't been detected being offered on Google Play (the former Google’s Android Market), but only on third-party online marketplaces.

The researchers urge users to always be careful when downloading new apps.

"Only download applications from trusted sources, reputable application stores, and markets, and be sure to check reviews, ratings and developer information before downloading," they say.

Care2.com servers breached

Seems like friends around me are getting targeted for some reason. I received an email from a friend, which obviously looks like a phishing email. Here's the sample (click to enlarge):


If this is making its way around, it's got to be on Google. And so it is.

"Yesterday we discovered that Care2.com servers were attacked, resulting in a security breach. The hackers were able to access login information for a limited number of Care2 member accounts. Our team has worked to secure Care2.com against this type of attack from recurring.

To protect Care2 members we are resetting access to all Care2 accounts. The next time you login to Care2, you will be automatically emailed a new password, which will enable you to access your Care2 account as usual.

To secure your privacy, we highly recommend you immediately change your password for any accounts that share the password you previously used on Care2.

We sincerely apologize for this inconvenience. Given our large membership size, we have become a significant target for spammers and hackers over the past few years, and this was the first hacking attempt that successfully breached our protective walls. We take the security of our members very seriously and are taking this extreme step of changing all passwords to reduce the chances of any possible negative consequences."

More details here.

Google warns users about active malware infection

Google has begun notifying its users that a particular piece of malware is installed on their computers by showing a big yellow notification above their search results (click on the screenshot to enlarge it):



The warning begun popping up yesterday, and does so only for users whose computers have been infected by a particular strain of malware that hijacks search results in order to drive users towards websites that use pay-per-click schemes.

"Some forms of malicious software will alter your computer settings to redirect some or all of your traffic through a proxy controlled by the attacker," Google explains. "When you use Google, the proxy forwards your query to the real Google servers to fetch the search results. If our system detects that a search came through one of these proxies, we display the warning."

For those wondering how they might have gotten infected, the answer is that they have likely been tricked into downloading this software when visiting a site or reading an email.

Or, as Google security engineer Damian Menscher shared with Brian Krebs, the search hijacking malware is part of a fake AV solution users have been tricked into downloading and installing on their computers.

Google is advising users to install or update their antivirus software in order to get rid of the malware, but warn users who don't have an AV solution already installed to be careful when searching for one online - more so since the malware in question is more likely to serve up links to fake AV solutions.

Google+ related scams move to Facebook

Scammers continue to take advantage of the great interest raised by the introduction of Google+ and have begun tricking Facebook users into giving them access to their accounts via a rogue application.

Users are lured in by updates on their news feeds seemingly posted by their friends, which "like" the "Google+ - Get Invite" Facebook page. Clicking on the link gets them to said page, where the rogue app by the name "Google Plus - Direct Access" is linked.

Clicking on the link initiates the request for permissions from the app:


There are people who will become suspicious once they see that the app wants to post things on their Wall, have access to their data at any time and be able to send them emails, but there are obviously still a lot of users who fall for these kind of scams.

Once the permission is given, the victim is urged to "like" the page that propagates the app and is encouraged to send and invite to his friends to visit it - in the hope that they will fall more easily for the scam if a friend of theirs appears to be supporting it.

When all this is done, the user is redirected to the official Google+ homepage. But, if he tries to sign-in, he is faced with the notice that the service has currently exceeded capacity.

Researcher Satnam Narang believes that one of the scammers' goals is to build a list of fresh e-mail accounts that may either be sold or used in future scams, but is also quite likely that once the access to victims' accounts will be misused to spread other scams and/or malicious links.

If you have fallen for this scam, be sure to revoke the permissions you gave the rogue app, delete all mentions of it from your account and warn your friends about it. It is also a very good idea to report the scammy page to Facebook by going to the page and selecting the "report page" link.

Backdoor in the latest version of vsftpd

Chris Evans, author of vsftpd announced that the master site for vsftpd was compromised and that the latest version of vsftpd (vsftpd-2.3.4.tar.gz) was backdoored.

The backdoor payload is interesting. In response to a :) smiley face in the FTP username, a TCP callback shell is attempted. There is no obfuscation. More interestingly, there's no attempt to broadcast any notification of installation of the bad package. So it's unclear how victims would be identified; and also pretty much guaranteed that any major redistributor would notice the badness.

The official download was promptly moved to Google App Engine.