Spyware, viruses, & security forum: NEWS - March 08, 2012

Alongside the launch of the "new iPad", Apple released iOS 5.1 for the iPhone 3GS, 4 and 4S, the 3rd generation iPod touch, and iPad and iPad 2. The update includes fixes for 91 issues with CVE identifiers. The majority, 66 of the issues, are described as "unexpected application termination or arbitrary code execution" in WebKit due to memory corruption. These flaws were mostly found by Apple or members of the Google Chrome Security Team, while a number were found by Chrome special reward winner miaubiz.

Two screen lock bypass issues are fixed, including one, a race condition with slide to dial gestures that could bypass the passcode lock, discovered by Roland Kohler of the German Federal Ministry of Economics and Technology, and an uncredited discovery that Siri's lock screen could be used to forward messages to an arbitrary user.

Continued : http://www.h-online.com/security/news/item/Apple-closes-security-holes-with-iOS-5-1-and-iTunes-update-1466786.html

Also:
iOS 5.1 Released, Containing Dozens of Security Fixes
Apple iOS 5.1 released, updates security

From Graham Cluley @ Sophos: Updated: Serious security hole in iOS 5.1? Perhaps not..

Anonymous is claiming to have brought down several Vatican websites, which were offline for most of Wednesday.

But while the main Anonymous Twitter account claims the attack was carried out 'for the pure, simple lulz', the Italian branch says in a statement on its website that it has a host of good reasons, from book-burning to dodgy financial practices.

"In more recent times, you have played a significant role in helping Nazi war criminals find refuge in foreign countries and evade international justice," it says.

"Every day, you have given permission to many members of the clergy responsible for molesting children, covering things up when the facts become public domain."

The group stresses that it has nothing against Christianity, but is protesting against the Catholic Church's 'absurd and anachronistic' practices - including opposition to contraception and interference with Italian political affairs.

Continued : http://www.tgdaily.com/security-features/61942-anonymous-brings-down-vatican-website

Also:
Vatican website hacked for church's 'crimes'
Vatican Site Hit by Hackers Claiming to be Anonymous

Underground Web sites can be a useful barometer for the daily volume of criminal trade in goods like stolen credit card numbers and hijacked PayPal or eBay accounts. And if the current low prices at one of Underweb's newer and more brazen card shops are indicative of a trend, the market for these commodities has never been more cutthroat.

Badb.su is distinguishable from dozens of underground carding shops chiefly by its slick interface and tiny domain name, which borrows on the pseudonym and notoriety of the Underweb's most recognizable carder. It's difficult to say whether "Badb" himself would have endorsed the use of his brand for this particular venture, but it seems unlikely: The man alleged by U.S. authorities to be Badb - 29-year-old Vladislav Anatolievich Horohorin — has been in a French prison since his arrest there in 2010. Authorities believe Horohorin is one of the founding members of CarderPlanet, a site that helped move millions of stolen accounts. He remains jailed in France, fighting extradition to the United States (more about his case in an upcoming story). [Screenshot]

Badb.su's price list shows that purloined American Express and Discover accounts issued to Americans cost between $2.50 and $3 apiece, with MasterCard and Visa accounts commanding slightly lower prices ($2-$3). Cards of any type issued by banks in the United Kingdom or European Union fetch between $4-$7 each, while accounts from Canadian financial institutions cost between $3 to $5 a pop.

Continued : http://krebsonsecurity.com/2012/03/banking-on-badb-in-the-underweb/

DuQu, the malicious code that followed in the wake of the infamous Stuxnet code, has been analyzed nearly as much as its predecessor. But one part of the code remains a mystery, and researchers are asking programmers for help in solving it.

The mystery concerns an essential component of the malware that communicates with command-and-control servers and has the ability to download additional payload modules and execute them on infected machines.

Researchers at Russia-based antivirus firm Kaspersky Lab have been unable to determine the language in which the communication module is written and plan to discuss the mystery code Wednesday at the CanSecWest security conference in Vancouver in the hope of finding someone who can identify it.

They've also published a blog post providing more information about the language.

While other parts of DuQu are written in the C++ programming language and are compiled with Microsoft's Visual C++ 2008, this part is not, according to Alexander Gostev, chief security expert at Kaspersky Lab. Gostev and his team have also determined that it's not Objective C, Java, Python, Ada, Lua or many other languages they know.

Continued : http://www.wired.com/threatlevel/2012/03/duqu-mystery-language/

@ Kasperskys' Securelist Blog: The Mystery of the Duqu Framework

Related:
Duqu Trojan written in mystery programming language, analysis finds
Researchers find MYSTERY programming language in Duqu Trojan
Researchers Can't Identify Programming Language Used in Duqu, Ask for Help

Authentication is one of the thornier problems in security and it's one that's never been solved to any real degree, despite decades of research, technological advances and trial and error. For companies such as Facebook that have to deal with authentication on a massive scale, the problem is even more difficult. Facebook is trying a number of different "social" authentication methods right now, and while some are innovative, they all come with serious drawbacks and weaknesses.

The company at the center of the social media boom--and not a few privacy and security tussles--has more users than many small countries have citizens and one of the issues that presents is a tremendous number of login attempts each day. Facebook sees approximately 1.1 billion login attempts on a daily basis, and some percentage of those obviously are attacks or phishing attempts. What the company has done to try and defeat the large-scale phishing campaigns that have plagued it for years now is to begin using a variety of secondary challenge systems to determine whether a user who has failed the first authentication attempt is the actual user.

"We need to put friction in front of the users, but it can have a detrimental effect. The notion of suspicious logins isn't set in stone. It changes," Alex Rice, who leads the product security and privacy team at Facebook, said in a talk at the CanSecWest conference here Wednesday. "False positives in this type of classification aren't only expected, they're very, very common."

Continued : http://threatpost.com/en_us/blogs/inside-facebooks-social-authentication-system-030812

Also: Facebook cut down large-scale phishing with social authentication