Hacking, Security & Privacy - Page 52

Kaspersky Labs has announced the discovery of what it is calling the "most sophisticated" Android trojan yet. Kaspersky identifies the trojan as "Backdoor.AndroidOS.Obad.a" and notes that the trojan is capable of many different functions with the added ability to be extremely hard to remove.

Obad.a is capable of sending SMS to premium-rate numbers, downloading other malware, sending malware over Bluetooth, and remote console commands. Obad.a makes use of code obfuscation and several previously undiscovered security holes in Android to make itself hard to remove or analyze.

Once it gains Device Administrator privileges, it's nearly impossible to remove:

If you want to read an 84-page report from the Commission on the Theft of American Intellectual Property, then check it out here. There's something that is quite shocking in this report, which is the proposal to legalize the use of malware for the goal of punishing people believed to be copying illegally.

The 84-page report also proposes that software would be installed into the systems of people that would somehow (feel free to tell us) tell if you were a pirate, and if it found out that you were, lock your system up and take your files hostage until you call the police and confess your crimes. This is actually used right now by shifty people online, when they deploy ransomware. If this even gets considered by Congress, it could be a scary future for the US and the world, if the below quote was to happen:

Tim Clemente, a former FBI counterterrorism agent claims that there is a 'Person of Interest'-type surveillance network used by the US government to monitors their citizens. Clemente talked about this when he appeared on CNN Wednesday night.

The discussion turned to the Boston Marathon attack, and past telephone calls with Katherine Russell and her deceased husband, suspect Tamerlan Tsarnaev. The former FBI agent said those conversations would be available to investigators. Clemente discussed the issue in an exchange, below, with host Erin Burnett:

What is worse, is Clemente added that "all digital communications in the past" are recorded and saved, saying that no digital communication is secure.

Everyone's favorite iOS hacker, Jay Freeman, or saurik, has discovered an exploit for Google Glass. The exploit is rather scary due to just how easy it is to implement. The exploit can be loaded onto Google Glass using any Android device, theoretically allowing people to quickly exploit devices while out and about.

More importantly, the exploit allows the hacker full access to the camera and microphone. All a hacker has to do is load a couple of files, which is simple due to Google Glass not having any sort of security protection. Glass has no pin lock, gesture lock, or other method of keeping it secure when not being worn.

If a hacker has full access to a camera and microphone, the device could easily be used to spy on a user's life, collect bank pins, or conduct industrial espionage. Of course, Google Glass Explorer Edition is a bit removed from what we will see in the final consumer version next year. One thing is clear, Google needs to make sure to add some sort of security to the device.

Cyberthreats are the new way of slowly removing citizens' privacy, and now the Department of Homeland Security (DHS) is preparing to deploy a very powerful new version of their EINSTEIN intrusion-detection system that is built to detect attacks and malware, especially when it comes to e-mail.

But because this new version of EINSTEIN is able to read electronic content, it is raising privacy concerns. DHS has recognized this, and have just issued a "privacy impact assessment" on what they're calling EINSTEIN 3 Accelerated, the intrusion detection and prevention system that is expected to be made available as a managed security service from ISPs to monitor the ".gov" traffic to and from civilian agencies and Executive Branch departments.

The DHS has said that EINSTEIN 3 might be able to collect "personally identifiable information" (PII) in some instances where this network security system will not just monitor but also prevent threats by clocking traffic in order to detect a cyberthreat or potential cyberthreat.

Android looks like its the OS of choice for malware developers, with mobile security vendor NQ finding that Android devices infected with malware grew exponentially last year alone.

NQ found that Android devices with malware infections grew from 10.8 million in 2011 to 32.8 million, meaning a triple of infections year-over-year. They also found that nearly 95% of malware detected in 2012 was designed specifically for Google's mobile OS, which means that Android is the main target for cybercriminals.

Most Android malware infections happen in China, India and Russia - so while this might seem like some frightening numbers at first, InfoWorld's Brian Katz does make us feel all a little better. Katz also writes that most mobile malware can be avoided if Android users "download apps only from known sources", such as the Google Play Store. My advice? Don't click ads, don't open suspicious links, don't join random or weird Facebook groups that want all of your info.

A new malware has been discovered by Kaspersky labs. The new malware spreads through Skype and turns the victim's computer into a Bitcoin miner. The victim's machine is then fully loaded to mine Bitcoins which is how the malware author makes money from the software.

The malware currently has a low detection rate. Kaspersky now identifies the malware as Trojan.Win32.Jorik.IRCbot.xkt. The malware is downloaded from a server in India. Once on the victim's machine, it pulls down more files from Hotfile, one of which is a Bitcoin mining application.

Bitcoin mining, explained more in-depth by Bitcoin, is a processor intensive task. The victim's CPU will be fully loaded mining Bitcoins, which are then given to the author of the malware. These Bitcoins are then used to turn a profit.

Crowd funding website Indiegogo was hit by a DDOS attack by an unknown source after YourAnonNews posted up a fundraising campaign. YourAnonNews (YAN) is attempting to raise funds to develop and host a new website that is similar to a newswire for Anonymous news. Apparently someone didn't like the idea.

It's not clear where the DDOS attack originated from and Indiegogo hasn't been exactly forthcoming about the attack. Slava Rubin, founder of Indiegogo, apologized for the outage and offered an extension to any campaigns ending this week: "Any campaigns scheduled to conclude this week will have the option of extending until Sunday by contacting our 24-7 Customer Happiness team."

You can check out the YAN Indiegogo campaign on the Indiegogo site.

Activist in Tibet might want to reconsider spreading the word about their next rally through their Android based smartphones. Researchers at Kaspersky Labs have just discovered a new Trojan virus that is designed to target Tibetan and Uyghur Activist.

The malware is specifically designed for Android Phones and is injected into the device when the unsuspecting user opens an email that references the recent World Uyghur Conference. Kaspersky says that this is the first documented attack that targets Android smartphones but it will most certainly not be the last.

In an interview with Mashable, Kurt Baumgartner, a senior security researcher at Kaspersky, said:

A new virus specific to Mac has been discovered by Russian security firm Doctor Web. Named Trojan.Yontoo.1, the virus injects ads into webpages on the infected machine.

The malware works by installing an adware plugin into any of the popular browsers then overlays an advertisement in key locations on webpages. Doctor Web says that this trojan is just another piece of a large adware puzzle that has been infecting OS X for some time now.

The virus can be caught in several different ways, with the most popular method being the use of movie trailer pages in which users must install a plugin to view the content. Other methods of injection have been media player enhancement programs and download accelerators. One indication of infection is that when launched, Trojan.Yontoo.1 will prompt users to install a program called "Free Twit Tube" or something similar.

Samsung has confirmed that they are working on a fix for a flaw that allows bypassing of the lock screen. The bug was posted to the internet today and shows a method for bypassing the lock screen, permanently, if you have enough time to download an app from the Play Store.

The steps to reproduce the bug are below:

The bug is only present on Samsung's implementation of Android. It doesn't seem to affect the stock build. In a statement, Samsung said, "We are aware of this issue and will release a fix at the earliest possibility. Samsung considers user privacy and the security of user data its top priority."

China has said that it is willing to cooperate with the US in an effort to curb future cyber-attacks allegedly coming from within its borders. The country said it is ready to open a "constructive dialogue" to help put a stop to internet related attacks.

In a report released by the Associated Press, a spokesperson for China's foreign ministry said that he condemned the recent attacks. "Cyberspace needs rules and cooperation, not wars. China is willing to have constructive dialogue and cooperation with the global community, including the United States."

The response from China comes after White House national security adviser Tom Donilon released a statement saying "China should take serious steps to investigate and put a stop to these activities," and asked the country to "engage with us in a constructive direct dialogue to establish acceptable norms of behavior in cyberspace."

At the Pwn2Own hacking competition currently running in Vancouver, Canada, two security researchers from MWR Labs have managed to exploit Google Chrome. As a result of this impressive feat, they have been awarded a $100,000 prize. The exploit relied on a bug in Chrome as well as a bug in the kernel of Windows 7.

By visiting a malicious webpage, users could be susceptible to the exploit, even if they are running fully patched software. The exploit allowed the researchers to run code in the sandboxed renderer process. They then utilized a kernel exploit in Windows 7, which granted them elevated privileges.

MWR Labs will not release details on the exploit until the vendors have a chance to patch the vulnerabilities. Chrome is generally seen as the most secure and was picked because of its wide use and perceived security.

Reports surfaced today stating that a small number of Apple's systems were hacked through the same zero-day Java exploit that Facebook's systems fell victim to in January. The source of the exploit is said to be the same as the one that managed to infect some of Facebook's systems. In the case of Apple, there is no evidence that any data was transmitted from Apple's systems.

"Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers," the company said in a statement. "The malware was employed in an attack against Apple and other companies, and was spread through a website for software developers. We identified a small number of systems within Apple that were infected and isolated them from our network."

Apple has released an update to Mac OS X that will help protect customers from the malware. The update can be installed from the Software Update panel in the Mac App Store or downloaded directly from Apple's website.

Security firm Mandiant has come out with quite the startling report titled "APT1: Exposing One of China's Cyber Espionage Units", which has tracked the alleged military-backed Chinese hacking group dubbed as Advanced Persistent Threat 1 all the way back to 2006.

Mandiant have written "Our analysis has led us to conclude that APT1 is likely government-sponsored and one of the most persistent of China's cyber threat actors." The group is also believed to be the 2nd Bureau of the People's Liberation Army (PLA) General Staff Department's (GSD) 3rd Department, otherwise known as Unit 61398.

The New York Times have written about it, where they worked off an advance copy of the report, which led them to buildings in Shanghai which they believe is where the unit is based. The Times then encountered persistent attacks from Chinese hackers last year, where they worked with Mandiant to monitor and block the intrusions into their network.

Aaron Swartz took his life a couple of weeks ago and we have now seen hacktivist collective Anonymous making a strategic move by hacking a US government website related to the justice system.

They posted on the site informing everyone they would begin leaking a cache of government documents if the justice system is not reformed. Anonymous hacked the website for the United States Sentencing Commission late Friday, where they posted a message about what they're calling "Operation Last Resort", which included a bunch of downloadable, but encrypted files that they say contain sensitive information.

Anonymous' statement reads:

Java seems to be one of the most exploited pieces of software running on a computer. Unfortunately, most computers are running Java for websites and other interactive features online. Just earlier this week, Oracle had to rush out a patch for Java that secured up a critical bug that allowed hackers to run code on a victim's machine.

An administrator for an exclusive cybercrime forum posted up Monday an offering for a new zero-day exploit that has yet to be patched by Oracle. It also has yet to be rolled into one of the exploit kits, some of which rent for upwards of $10,000 a month. The starting price for the exploit? $5,000.

The exploit hasn't been verified to exist, though it's doubted that an admin of a site would try to scam users out of $5,000. If you don't want to or can't risk getting compromised, you should disable Java.

Kaspersky of all companies have found something utterly shocking, an advanced cyber espionage network that makes last year's infamous Flame malware look like a joke. Dubbed Operation Red October, each attack is handcrafted for its victim in order to make sure it 100% works.

Red October has been hitting systems across the world since at least May 2007 and carefully chooses its victims spanning over two dozen countries who hold positions in government, military, aerospace, research, trade and commerce, nuclear, oil and other important, vital industries. Investigators aren't sure who is behind the attacks, but it is being reported that Chinese hackers may have created the exploit, while the various malware modules deployed seem to have been created by those who speak Russian.

Kaspersky can't put their finger on the source, as it is currently being run through at least two layers of proxy servers across Russia, Germany and Austria. Whoever is involved has some skill, as they've been silently sitting, unknown to the user, in major government and industry computers.

The tragic supposed suicide of digital activist, and co-founder of Reddit, Aaron Swartz happened just days ago and now Anonymous have stepped into the ring to play [hacking] ball. They leave a tribute message to Swartz, which says:

The link to see it is here, and at the time of writing wasn't loading. I'm sure MIT will have the site updated shortly.

Mobile security firm Lookout has found a botnet as of December 3, which it is calling SpamSoldier. The threat was detected with the help of one of Lookout's carrier partners, though which has not been said. The botnet spreads through text messages and has not been detected on any major app store.

Two, of many, spam campaigns are shown below:

The link downloads an app which installs SpamSoldier and removes the icon from the launcher so you won't see it. Often it installs the free version of the game so that you won't notice that it has been installed. SpamSoldier, meanwhile, is sending out spam in the background through your SMS functions.