Spyware, viruses, & security forum: NEWS - March 14, 2012

.. vulnerabilities

In the latest round of updates of its suite of internet applications, Mozilla has detailed the security fixes in the Firefox 11 browser, Thunderbird 11 email and news client and SeaMonkey 2.8 "all-in-one internet application suite". There are also fixes for the "enterprise" and legacy versions of Firefox and Thunderbird.

According to the Security Advisories for Firefox page, the Firefox 11.0 update addresses a total of eight vulnerabilities in the browser, five of which are rated as "Critical". The same vulnerabilities have also been fixed in Thunderbird 11 (release notes) and SeaMonkey 2.8 (release notes), as they are based on the same Gecko platform as Firefox 11.

Continued : http://www.h-online.com/security/news/item/Firefox-Thunderbird-and-SeaMonkey-updates-fix-critical-vulnerabilities-1471708.html

See Vulnerabilities / Fixes: Mozilla Firefox / Thunderbird / SeaMonkey Multiple Vulnerabilities

"The BBC has suffered a sophisticated cyber-attack following a campaign by Iranian authorities against its Persian service, director-general Mark Thompson said on Wednesday."

Thompson also reported attempts to jam satellite feeds of the British Broadcasting Corporation services into Iran and to swamp its London phone lines with automated calls.

In extracts from a speech he will make later on Wednesday, Thompson stopped short of explicitly accusing Tehran of being behind the cyber-attack, but he described the coincidence of the attacks as "self-evidently suspicious".

Last month, Thompson accused Iranian authorities of arresting and threatening the families of BBC journalists to force them to quit the Persian news service.

"It now looks as if those who seek to disrupt or block BBC Persian may be widening their tactics," he said in the extracts of his speech, which the BBC released in advance.

"There was a day recently when there was a simultaneous attempt to jam two different satellite feeds of BBC Persian into Iran, to disrupt the Service's London phone-lines by the use of multiple automatic calls, and a sophisticated cyber-attack on the BBC," he said.

Continued : http://www.reuters.com/article/2012/03/14/iran-bbc-idINDEE82D00220120314

From the BBC: Cyber-attack on BBC leads to suspicion of Iran's involvement

A new iPhone app launched today will add a serious - but hopefully infrequent - note to the notifications that set your handset buzzing. AllClear ID will let you know when the FBI or other investigators have found your data in the hands of cyber criminals.

Stories like the spectacular data breach that befell Sony last year mean that most of us now understand that cyber criminals actively access and trade our personal data. A less well-known consequence is that increasing volumes of it - credit card details, social security numbers and online accounts - are also passing through the hands of investigators from organizations like the FBI.

They've traditionally used it only as evidence to help catch crooks. AllClear ID has now set up an agreement that allow the FBI and other organizations affiliated with the National Cyber-Forensics and Training Alliance (NCFTA) to inform people when their data is found in the wrong hands. The NCFTA is a group through which law enforcement, academic and private security experts work together to share information about cyber threats. You must be signed up to AllClear ID's free service, available online as well as through the company's new app, to benefit from that new agreement.

"Being able to notify people their data has been found is the piece that's been missing," AllClear ID's founder Bo Holland told me yesterday. "Let's say a researcher working for PayPal to combat a botnet," he said, "when he finds your credit card information you'll know about it."

Continued : http://www.technologyreview.com/blog/editors/27644/

The makers of Avast antivirus software are warning users about a new scam involving phone calls from people posing as customer service reps for the company and requesting remote access to user systems. Avast is still investigating the incidents, but a number of users are reporting that the incidents followed experiences with iYogi, the company in India that is handling Avast's customer support.

A follow-up investigation by KrebsOnSecurity indicates that Avast (among other security companies) is outsourcing its customer support to a third-party firm that appears engineered to do little else but sell expensive and unnecessary support contracts.

Adam Riley, Avast's third party support manager, wrote in a post on the company's blog that "during the past week or so, we have received some complaints and it appears that some of our customers are being targeted by a new scam. Luckily only a handful of customers have contacted us regarding this so far, but they report receiving phone calls from 'Avast customer service' reps who need to take control of their computer to resolve some issue and who, for a fee, wish to charge them for this privilege." [Screenshot]

I'd first heard about the issue when a reader wrote in to say he'd received complaints from his clients about calls from someone claiming to represent Microsoft and requesting remote access to user computers to help troubleshoot computer problems.

I decided to investigate iYogi myself, and created a fresh installation of Windows XP on my Mac, using the free virtual machine from Virtualbox. I wanted to see whether I, too, would receive follow-up sales pitches. I also wanted to see for myself if there was anything to the claims on Avast's user forum that iYogi was using support requests to push expensive "maintenance and support" packages.

Continued : http://krebsonsecurity.com/2012/03/aghast-at-avasts-iyogi-support/

Those multi-gesture passcode locks on Android phones that give users (and their spouses) fits apparently present quite a challenge for the FBI as well. Frustrated by a swipe passcode on the seized phone of an alleged gang leader, FBI officials have requested a search warrant that would force Google to "provide law enforcement with any and all means of gaining access, including login and password information, password reset, and/or manufacturer default code ("PUK"), in order to obtain the complete contents of the memory of cellular telephone".

The request is part of a case involving an alleged gang leader and human trafficker named Dante Dears in California. Dears served several years in prison for his role in founding a gang in California called PhD, and upon his release he went back to his activities with the gang, according to the FBI's affidavit (pdf). Agents conducted surveillance on Dears and found that he was using a mobile phone to allegedly communicate with prostitutes and other associates.

Dears had denied to his parole officer that he owned a mobile phone, and in January the parole officer went to Dears's apartment and seized the phone. The FBI subsequently served a search warrant on the parole officer and took the phone, but the bureau's forensics investigators couldn't get past the swipe lock on the Android handset. Once they failed enough times, the phone locked and now requires the user's Google username and password for access. As a result, the FBI is asking that Google be forced to hand over the information to get them into the phone.

Continued : http://threatpost.com/en_us/blogs/can-google-be-forced-fbi-unlock-users-phones-031412