Mobile Malware Targeting Smartphones

Nearly one out of every 63 smartphones powered by the Symbian operating system is infected with some form of malware, according to a new study by mobile security firm SMobile Systems.

A comparison of these statistics to the worldwide smartphone population places the number of infected devices globally in the millions. Because the vast majority of these infections are designed to be stealthy and the fact few smartphones have Anti-Malware applications, most infected users are unaware their devices have been compromised.

Throughout 2009 SMobile's Global Threat Center has seen an increase in the capabilities of new malware infecting mobile devices, as well as frequency of attacks. The attacks have taken the form of worms and Trojans that are transmitted via Bluetooth, SMS, MMS, or emails, as well as Spyware that is downloaded from various online application and shareware websites.

Detailed report here.

Famous Security Experts' Sites Hacked

Here's a discouraging piece of news for anyone who's put security professionals Dan Kaminsky and Kevin Mitnick on a pedestal: both men's sites were hacked in apparent coordination with the start of the Black Hat security conference.

The hackers left behind notes indicating that they were trying to humiliate and discredit their targets, accusing them of getting by more on reputation and hype than skill. It's unclear how the hackers carried out their attacks, but they did share some evidence of their success, and Kaminsky seems to have been the hardest hit.

Following the attacks, a file containing all sorts of confidential info was made public, and Dan Goodin reports, "The file posted on security mailing lists claimed to have obtained more than four years' worth of data from Kaminsky, and as proof, it offered a smattering of emails, instant messages, and other communications that laid out sensitive research work and intimate personal conversations."

Also, "multiple passwords Kaminsky used and back-end configurations for Kaminsky's website" were shared, and the site's been offline ever since as a result.

Read more here

Google Safe Browsing Feature Could Compromise Privacy

Researcher RSnake has discovered that Google's anti-malware and anti-phishing features for Chrome and Firefox tracks information about user's browsing habits

Google basically stores a cookie on the user's computer that can be used to track him or her, he says. And the cookie can be used to identify the IP addresses he or she visits, for instance. Hansen says Google logs that data for anti-distributed denial-of-service (DDoS) purposes.

"In Chrome, every five hours it phones home" to check for the current version and"sends a payload including machine ID and user ID," says RSnake.

The only way to protect your privacy from this, he says, is to turn off the anti-phishing and anti-malware options. "The bummer is you're turning off a great service," he says. "It protects you from malware" and other threats, he says.

The good news, he says, is that Google only retains the data for two weeks, and then stores it in aggregate form. "But having this IP address, this cookie, and this timestamp is enough information to decloak someone for a [hacking] incident they did two years ago," he says. "So if you use Firefox or Chrome, you should know the risks" of the Safe Browsing feature, he says.

Read here for detailed article.

Next Gen IT Security 2009 Conference

Event: Next Gen IT Security 2009
Date: 18 August-19 August 2009
Location: Singapore
Organizer: Marcus Evans
Homepage: http://www.marcusevans.com

Marcus Evans’ ‘Next Gen IT Security’ conference will keep IT security professionals to keep up-to-date on their knowledge in the latest threats, new practices and continuous improvement strategies in the industry to maintain a competitive edge in the market.

This conference highlights the participation of representatives from international companies such as OWASP Singapore (Singapore), Royal Bank of Scotland (Singapore), Citco Funds (Singapore), SingHealth (Singapore), Creative Technology (Singapore), Bank of America (Singapore), JPMorgan Chase Bank (Singapore), Nokia Siemens Networks (Singapore), Hong Kong Police Force (Hong Kong), CBH Group, Dell Inc. (Global Business Center), Affin Bank (Malaysia), British Telecommunications, Professional Information Security Association (PISA), Allergan (India), Acmamall.com, Bank Muamalat (Malaysia), Carsem and among others.

For further event details and event brochure, kindly contact Ms. Catherine Foo here.

What is a browser?

If a major piece of your security strategy revolves around employee training, the following video might be a major setback. Many security pros pride themselves on the amount of training they give their employees. But I wonder, is it all for naught?

A Google employee took a camera and microphone onto the streets of New York City to find out if non-techies knew what a browser is and the results were astounding. Less than 8% of those interviewed knew. And these guys don’t reside in an assisted living facility or a 55 and over community. Many of them could have Facebook accounts and even Twitter handles.

After watching the video, I wonder, how would I begin a security training program if many of my employees don’t know what a browser is?

Phishing sounds like a foreign language and malware sounds like a bad word. Maybe the next generation will have a better understanding. But how long can we wait?

Koobface Turns the Other Cheek

Twitter's in the news again.

There has been many reports of yet another variant of Koobface doing the rounds through Twitter. The tweets doing the rounds contain the following messages:

• My home video :)
• Watch my new private video! LOL :)
• michaeljackson' testament on youtube

Looking around for some of the hacked twitter accounts, I found a few unfortunate souls whose accounts have been hijacked to spread this malware.

Here's one example I have found below. Some of the TinyURLs are pointing to the AdultFriendFinder Web site; the one below is not responding but appears to be active.

Other URLs are directing users to a fake video Web site that contains the usual Codec-type social engineering trick to lure users into downloading and running the file.

Symantec detects this as W32.Koobface.C. The threat that it drops is detected as Antivirus2008. Given the redirects chosen by the attacker and also the threat that it drops, clearly the makers of Koobface are in the business of making money.

Twitter has taken action and suspended accounts that have been infected.

To prevent your computer from becoming infected, be wary when clicking any links you receive in a tweet, even from your friends as this worm uses social engineering techniques in an attempt to infect your computer; that is once a user is infected it will send links to their followers and hence the link comes from someone you know.

Make sure that you also regularly update your anti-virus security software to catch the latest threats. Alternatively, you can check back here regularly for new updates. =)

Source