Spyware, viruses, & security forum: NEWS - April 27, 2012

From SANS ISC Diary:

Oracles April "Critical Patch Update" listed a vulnerability in the TNS Listener services as one of the patched vulnerabilities. Sadly, it turns out that current versions of Oracle are not patched. Instead, the vulnerability will apparently only be fixed in future versions of the Oracle database. According to a statement from Oracle quoted by the discoverer of the vulnerability, the fix would have possible had stability issues for current versions of Oracle. [1]

The vulnerability was responsibly reported to Oracle back in 2008. Upon release of the April CPU, Joxean Koret, who originally found the vulnerability, came forward with additional details including a proof of concept exploit, fully expecting that a patch is now available.

So in short: We got an unpatched remote code execution vulnerability in all current versions of Oracle with proof of concept exploit code.

Joxean's details published after the CPU release also include some useful workarounds [2]. Please refer to the post for details.

[1] http://seclists.org/fulldisclosure/2012/Apr/343
[2] http://seclists.org/fulldisclosure/2012/Apr/204

http://isc.sans.edu/diary.html?storyid=13069

Also:
Critical Bug Reported in Oracle Servers
Vulnerability in Oracle Servers Fixed Only in "Future Versions"

.. Sites

Vulnerabilities such as the one that affected the Windows Remote Desktop Protocol have made many users better understand the need for security updates. Cybercriminals have taken advantage of this and started sending their own "security update" notifications.

Hoax Slayer reports that an email with the subject "Security update KB971033 has been released" is currently making the rounds, landing in the inboxes of unsuspecting internauts.

After giving some decent advice on how to defend yourself against financial crimeware and identity theft, the fraudsters highlight the importance of security update products.

"We detected that you don't have installed Anti-spoofing update KB971033 from Microsoft, this update will protect you from accessing fake pages like phishing site by checking any accessed link without any delay in browsers and also will fix CVE-2012-3651 (Adobe auto-downloader) exploit, you can install it with just one click here [LINK]," reads part of the email.

Continued : http://news.softpedia.com/news/Fake-Security-Update-KB971033-Emails-Point-to-Malicious-Sites-266765.shtml
To make everything even more legitimate-looking, the notification informs recipients that sometimes, if the customer isn't careful during the automated installation process, some important updates may be skipped, thus exposing the computer to cyber threats.

The growing use of mobile devices to connect with social networks is fast becoming a preferred method for cyber criminals to spread malware, particularly on those devices running Android, say the results of AVG's Q1 2012 Community Powered Threat Report. [Screenshot]

Social networks have become a key source of information and communication. Twitter now has more than 140 million active users; and Facebook has over 845 million users, with some analysts expecting that figure to reach 1 billion this year. The result: targeting those who use Facebook is like targeting around 14 per cent of world's population or approximately 43 per cent of global internet users.

Consider also that there are over 300 million Android phones already activated, with over 850,000 Android phones and tablets added to that number each day, and it is clear these two trends combined result in a new threat: infecting Android devices using social networks.

Most mobile devices are tied into operator billing systems making monetization of malware a lot more effective than on traditional computer systems. All the attackers need to do is trick users to install a malicious app on their device through which they can then gather cash using the phone companies' billing systems by utilizing premium SMS services.

Continued http://www.net-security.org/malware_news.php?id=2085

AVG's Report: Q1 2012 Community Powered Threat Report (pdf)

From the GFI Labs Blog:

Given the long history of advance-fee fraud, it is safe to assume that we're more or less aware (if not familiar) with what 419 scams are. For those who are not, 419 scams typically come to users in the form of an email, asking for either cash or personal information. They are otherwise known as Nigerian scams.

GFI Software Threat Researcher Robert Stetson spotted a 419 scam mail which has been around since 2007, is clearly back in business and whose website even managed to tangle itself up in confusion related to third-party advertising. [Screenshot]

' From: ASIA PACIFIC INT'L LOTTERY
Subject: Congratulations!!! You Won
Message body:
Congratulations!!! Dear Lucky Winner,

ASIA PACIFIC LOTTERY 2012 WINNING NOTIFICATION

We are Pleased to inform you that your Email Address was selected among the winners of Asia Pacific International Lottery Promotion year 2012.

You have therefore been approved for a lump sum pay of US$ 1,000,000.00 (ONE MILLION UNITED STATES DOLLARS ONLY)

For more details visit our website below:
asianpacificonlineweb(dot)hpage(dot)com

Kindly click on the weblink for full information and direction on how to redeem your cash prize.

Congratulations Once again !!!

Announcer !!!
Dr. Thanaporn Deng
President, Asia Pacific Lottery Organization.'

Clicking the link on the email body directs users to this fake lottery and scam website:

Continued : http://www.gfi.com/blog/a-419-scam-and-an-unintended-surprise/

"Nearly half of all malicious programs attempt to communicate out to the Internet in the first minute. Companies need to listen more closely to their networks"

There are telltale signs of malware communications, and organizations that monitor traffic on their networks can pinpoint nearly half of all infected computers within a minute of the system's compromise, researchers say.

Websense researchers Stephan Chenette and Armin Buescher took a random sampling of nearly 200,000 malicious programs and categorized them by behavior, including how the malware communicated over the network. Malware typically reaches out over the network to request commands from a command-and-control (C&C) server or to exfiltrate intellectual property or other sensitive corporate information, they said during a presentation at last week's SOURCE Boston security conference.

"If the point isn't the complete destruction of data, what's going to happen is that the attackers are going to install malware in the network and the malware will eventually communicate out," Chenette said.

Continued : http://www.darkreading.com/security-monitoring/167901086/security/security-management/232901106/busted-in-60-seconds-malware-reveals-itself-in-first-minute.html

[Screenshot]

Google always seems to sneak in some cool Easter Eggs in their web site for people to discover. This week, yet another one of these hidden gems was found and it's an apparent tip of the hat to Blizzard's Starcraft game series.

All one has to do is type in "zerg rush" in Google's search box and the show starts. A bunch of yellow and red zeros with the Google logo font design start spreading themselves on the search results page and destroy those same results. You can click on the circles with your mouse cursor to destroy those circles yourself.

The Zerg are one of the alien races in the Starcraft series and the term "zerg rush" is one that is known in real time strategy game circles. It's used to describe a situation when any player tries to overwhelm his opponent with a mass of units during a multiplayer match.

Google stores your score for each "round" of play along with your "APM" (actions per minute) number, which is the number of times you click on the mouse to defeat those red and yellow foes. In the end, the circles then form two big "G" letters on the screen. You can also send your score to be displayed on your Google+ account.

http://www.neowin.net/news/new-google-easter-egg-destroys-search-results