Malicious Kodak Galleries used for serving Trojan

A variant of a highly specialized Trojan has appeared on fake sites mimicking Kodak Gallery pages, where potential victims are urged to download software that would supposedly allow them to watch the offered slideshow, but actually creates a folder with configuration files and copies a few executables into the System32 folder.


But before doing that, it actually does show the users a slideshow of car pictures, which acts as a smokescreen in order to hide the malicious activity.

Further research by Sunbelt's experts reveals that the fact that the pictures are of a car might not be so random. The Bayrob Trojan - of which this is a variant - has had a history of targeting eBay users, especially those buying motors and cars since that means that bigger amounts of money are involved. The Trojan spoofs various eBay pages and tries to trick the users into parting with their money.

This particular variant has a very low detection rate, so be careful when checking out links that you find on forums or receive in spam e-mails - or even in e-mails and instant messages seemingly coming from a friend.

Behavior of Safari on the iPhone could benefit scammers

A behavior of the Safari browser on the iPhone could be used by phishers and scammers to fool users into believing they have landed on a legitimate site, says Nitesh Dhanjani.

In short, it allows scammers to display a fake URL bar and hide the real one. Users accessing websites from their computers are not in jeopardy, since all popular web browsers do not allow websites to modify in any way the text in the address bar or to hide the address bar itself.


There are two mitigating circumstances that allow alert users to spot the trick:

• While the page loads, the real address bar is visible
• When the page is rendered, the real address bar is visible if the user scrolls up.

Dhanjani set up a proof of concept demo page (http://www.dhanjani.com/ios-safari-ui-spoofing/) where you can surf to with your iPhone to witness that behavior for yourself.

He says that he notified Apple about the issue, but that they could not say when it will be addressed.

Hole in iPhone PayPal app allows account hijacking

PayPal customers that use the payment company's iPhone application to effectuate payments should update it as soon as possible, because a vulnerability that can be exploited to hijack their accounts has been found by a security researcher and confirmed by PayPal.

The flaw doesn't affect the PayPal site or the company's Android application, but the 4+ million people who downloaded the iPhone application so far are in danger of getting their passwords intercepted by a hacker if they connect over unsecured Wi-Fi networks.

Essentially, the flaw makes the application fail to verify the digital certificate of the PayPal.com website and could allow a criminal to "stand" between the user and the site and simply intercept his username and password. Of course, the hacker must be in the same physical location as the user, trick him to connect to a Wi-Fi hotspot that he (the hacker) set up, and wait for him to use the application.

According to The Wall Street Journal, PayPal spokeswoman Amanda Pires said that they haven't yet heard of an instance where this hole was successfully exploited, but also that the company will reimburse every last cent if it happens to anyone.

That is good news, but it's better if you update your PayPal application now and skip any unpleasant surprises, since the patched version has already been made available.

Security - It's not fun sometimes but be thankful it's there

With Thanksgiving long weekend round the corner, here's a post dedicated to IT Security.Security isn't the happiest topic in the tech business. It's not like PCs and phones that get more powerful and cheaper all the time or displays that get bigger and more brilliant. It's mostly a steady stream of bad news or, at best, mitigations of bad situations. But there's still plenty to be thankful for.

It's unfortunate that the basic state of computing is insecure and that you will be attacked if you don't defend yourself. But you can defend yourself and defenses do get better all the time. Combined with some experience and a skeptical attitude, modern software can protect you very effectively.

I'll avoid business products which, I would argue, provide much more defensive power than consumer products. Consumers can still do a good job by following a few basic rules:

• Don't run Windows XP. Run Windows 7 or at least Windows Vista.
• For your everyday tasks, run as a standard, i.e. less-privileged user. If you get a UAC prompt for elevation, pay attention to it.
  • If an application you run doesn't work well in this environment, try to find a replacement. That application is probably badly-designed and you should blame the developers.
• Keep your operating system and applications up to date.
• Run a security suite and keep it up to date.
• Don't install software casually. Look carefully at what you're installing and at what happens in the installation process. Remove software from your system if you're no longer using it.

Can you still get burned if you follow these guidelines? Yes, but it's highly unlikely, certainly far less likely than if you don't take security seriously. The garden-variety attack out there will raise some flag that you can see. Even a high-quality targeted attack like Stuxnet can be stopped by rigorous methods, but such attacks are very rare.

And if you're a Mac user, be thankful for the fact that, by and large, the malware community still doesn't find you to be worth their attention. This situation may be changing slowly, but you're still flying under the radar.

If you put a little money and effort into securing your computers you can do it effectively. So make sure everything's up to date and then be thankful that you'll be able to rely on your systems and then go stuff your face and watch some football.

Warning about "postcard" computer virus

With Thanksgiving and Christmas coming up, friends and colleagues are bound to send out bountiful of online e-greeting cards.

Warnings have been issued this weekend about a highly destructive computer virus which has been released under the guise of a postcard greeting.

It is strongly advised that computer users should not open any message with an attachment entitled “Postcard” or “Postcard from Hallmark”, regardless of who sent it.

The virus opens a postcard image which then 'burns' the whole hard disk C of your computer. Experts say that the virus will be received from someone who has your e-mail address in his/her contact list.

An American computer expert who has a senior position in Microsoft and is related to an Isle of Man resident said, “Even if you receive a mail called “postcard” and it appears to have been sent by a friend, do not open it! Shut down your computer immediately. This is the worst virus announced by CNN.”

The virus has been classified by Microsoft as “the most destructive virus ever”. It was discovered by McAfee on Saturday and so far there is no repair yet for this kind of virus. This virus simply destroys the Zero Sector of the hard disk, where the vital information is kept.

Kids lured to scam site by promises of parental control bypassing

The latest scam to hit Facebook users is one that supposedly offers a completely free proxy service for those who want to bypass parental controls and blocks set up by schools and at workplaces that prevent users from accessing certain sites such as Facebook.

The campaign is specifically targeting kids, luring them into trying out the service located at hxxp://myfatherisonline.com to access Facebook in school.


Of course, when the victims visit the website they can't find the advertised service. Sunbelt researchers have poked around the site and discovered a veritable trove of various scamming attempts.


The victims are faced with an affiliate site containing malware, surveys, quizzes, offers for free iPhones that will try to get them to subscribe to a premium rate service or sign up for spam.

If you have children and they are permitted to have an account on a social networking site, this might be a good idea to chat with them about the various bogus offers that are lurking on those sites.