Facebook "free plane tickets" scams

Don't be tricked by the impossibly good offers that have lately been popping up on Facebook profiles. There are no free ticket giveaways - there's only the possibility of getting your profile abused by the applications that you are required to install in order to receive them.


Supposedly, Delta Air Lines and JetBlue Airways are giving free tickets to Facebook users, but that could not be further from the truth.

Actually, if you click on the offered link you are asked to install a third-party application - "4freedeltatickets" or "JetBlue Family" - that requests you permission to access your basic profile information, send you e-mails, post on your Wall, access your data any time, and manage your events and pages.

According to Graham Cluley, once you've done that you are redirected to a page where the scammers will try to trick you into signing up for a premium rate cell phone service. In the meantime, the application that you have allowed access to your profile has been posting the same message you fell for on your Wall and added you to events:


If you have fallen for the scam, delete the applications in questions (go to Account/Privacy Settings/Applications and Websites), delete every status message and event it has added to your profile, and contact your cell phone provider to notify them of the situation.

Drive-By Downloads: Malware's Most Popular Distribution Method

After years of burying malicious software in email and portable storage media, attackers now favor quick downloads via legitimate websites, researcher say.

WASHINGTON, D.C. -- OWASP AppSec DC 2010 -- Why try to fool users into opening email attachments when you can simply drop a Trojan on them from their favorite websites?

That's the question many malware authors and distributors are asking -- and the obvious answer is spurring most of them to try out the emerging "drive-by download" method, according to a speaker here this week.

"What we're seeing is a fundamental change in the method of malware distribution," said Neil Daswani, CTO of Dasient, which offers a service that detects and eradicates Web-borne malware. "In the old days, we saw executable code in a static file, which was originally delivered via floppy disks and then via email attachments. Now we're seeing active content delivered via drive-by downloads at legitimate sites."

A drive-by download typically begins by injecting a Web page with malicious code, often through JavaScript, Daswani explained. The code generally invokes a client-side vulnerability to deliver shell code, such as the JavaScript-based Heap Spray attack, to take control of the user's machine. From there, the attacker can send a "downloader," which is often custom, zero-day code that isn't recognized by traditional antivirus systems.

Once the downloader is in place, the attacker can deliver his malware of choice, Daswani said. Drive-by downloads are particularly effective for delivering code that can steal end user credentials (such as Zeus), launch a fake antivirus scam (such as Koobface), steal server-side administrative credentials (such as Gumblar), steal corporate secrets (such as Project Aurora), or collect fraudulent click revenue (such as clickbot.A), he noted.

While drive-by downloads are often more effective at infecting end user devices than email attachments, they also give the attacker broader reach, Daswani observed. Drive-by downloads can be used to infect thousands of websites at once, often by hiding in common third-party devices that are distributed to many sites, such as advertisements, widgets, images, or third-party applications.

"A lot of user organizations do a great job of scanning the code they put on their own sites, but they may not scan the code they're posting from third parties," Daswani warned. "The marketing people will add an ad or a widget to a site, and the IT people may not vet it before it's posted."

Many well-known sites are infected by malware, and the most popular sites are generally targeted most frequently, Daswani noted. In the past two years, major government sites, such as the Treasury Department and Environmental Protection Agency, have been infected, causing them to serve up drive-by downloads to their users. The National Institute of Health has been infected five times in the past two years, and the state of Alabama's website has been infected 37 times in that same time period, he reported.

"It's time to recognize that this is the method of choice for many distributors of malware," Daswani said.

ElcomSoft breaks Firefox, Safari, Opera, and Chrome passwords

Another convincing reason why you shouldn't get lazy and let your Internet browser store your passwords.

Elcomsoft Internet Password Breaker now retrieves cached passwords stored in a variety of email clients and Web browsers.

The new update adds Mozilla Firefox, Apple Safari, Google Chrome and Opera Web browsers to the list of supported applications in addition to already supported Microsoft Internet Explorer, Outlook Express, Outlook, Windows Mail, and Windows Live Mail.


In addition, cached logins and passwords, pre-filled forms and AutoComplete information can be extracted from the browser cache or secure storage area.

Elcomsoft Internet Password Breaker makes it easier to migrate between supported Web browsers. The tool reminds users of some of their login and password information that may long be forgotten thanks to the convenience of using the cached forms.

Features:

• Instant password recovery for a variety of applications
• Supports all versions of Microsoft Internet Explorer, including IE7 and IE8
• Supports all versions of Microsoft Outlook and Outlook Express
• Supports Windows Mail and Windows Live Mail passwords
• Instantly recovers passwords cached in Apple Safari, Google Chrome, Mozilla Firefox and Opera Web browsers
• Reveals stored POP3, IMAP, SMTP and NNTP passwords for all supported applications
• Recognizes and works around enhanced security model of Internet Explorer 7 and 8
• Reveals Microsoft Passport information in Windows Live Mail
• Retrieves Microsoft Outlook PST passwords
• Recovers login and password information to a variety of resources.

Android Falls Short In Security Analysis

We've seen enough news about how Apple's iOS is vulnerable to attack. I think it's only fair that we talk about the shortcomings in its biggest competition, Android. According to a report by Coverity, the popular mobile operating system is home to hundreds of bugs in its kernel with a quarter of those bugs listed as 'high risk' that can be used to exploit user privacy.

Coverity Inc. is in the business of scanning software for potential security vulnerabilities. They recently scanned the open-source Android operating system and discovered 359 bugs. 88 of these are listed as high-risk which according to the report, "include four categories that we have found, through experience and consultation with our customers, to be ones that can cause the most damage and are most likely to be fixed first by developers. These include memory corruptions, illegal memory accesses (e.g., reading beyond the bounds of a memory buffer), resource leaks, and uninitialized variables. "

Let's look at how those bugs compare in the open source world. Coverity claims that the industry average 'defect density' is one defect per every 1,000 lines of code. Android has only half that number, which is impressive until you look at the areas those bugs were found. Most of the code in the operating system is a Linux kernel with custom additions added in, and in the Android specific code, the defect density is twice as high.

Fragmentation of accountability is listed as one of the main conclusions of the report. Coverity basically says that, just like the rest of open source software, with so many people contributing so many different elements to the project, it is almost impossible to keep track of who is in charge of fixing what. This is definitely a problem as open source becomes more and more popular.

The Coverity report can be found here.

Free Mac anti-virus for home users

Good news for MAC users out there!

Sophos announced the availability of a free Mac anti-virus product for home users. Based on Sophos's security software, which protects over 100 million business users worldwide, Sophos Anti-Virus Home Edition for Mac is available for consumers to download at no charge.


Sophos Anti-Virus Home Edition for Mac provides automatic detection against existing and new threats for Mac OS X. The free software also incorporates strong disinfection capabilities, capable of removing malware infections that may already be present on the Mac computer.

Sophos Anti-Virus Home Edition for Mac detects both Mac and Windows malware, and is backed by SophosLabs, Sophos's global network of highly skilled researchers and analysts, protecting businesses from known and emerging malware - viruses, Trojans, spyware and rootkits. SophosLabs ensures that Sophos Anti-Virus Home Edition can even proactively stop brand new unseen threats before they can install on your Mac.

Technical requirements:

• Mac with Intel or PowerPC processor
• 256 MB of memory
• 150 MB of available disk space
• Mac with OS X 10.4 (Tiger), 10.5 (Leopard) or 10.6 (Snow Leopard)
• Supports all Apple Mac hardware including iMac, MacBook, MacBook Pro and the new MacBook Air.

Spying app kicked out of Android Market

Secret SMS Replicator, a spying application that forwards contents of a user's text messages to the phone of the person who installed it in the first place, has been booted out of the Android Market.

Once the application in question is installed, there is no visible shortcut or icon to alert the user about the spying that is in progress, so one can see why this would be a problem for Google. According to ReadWriteWeb, the application was banned because it violates the Market's content policy, which says that applications that are guilty of invasion of personal privacy are not allowed to be uploaded.

Zak Tanjeloff, CEO of DLP Mobile (the company that developed the application) said that they developed it for Android because such an app would never be approved by Apple for use on the iPhone and allowed to be sold on its iTunes App Store.

But, as it turns out, the Android Market has similar rules - the only difference is that Apple's approval process will flush such an application out before it is allowed in, and the Android Market allows them in and removes them once they are published. Unfortunately, that gives potentially malicious applications a small window of opportunity to do their bad work.