Spyware, viruses, & security forum: NEWS - May 14, 2012

Following Adobe's recent release of Creative Suite 6 and its statement that it will not be patching critical security vulnerabilities in previous versions of the popular software the suite includes, security experts and users have voiced their indignation.

According to Adobe, the users had either the option to upgrade to CS6 - and pay $375 for the upgrade - or to keep using CS5 and CS5.5 and "follow security best practices and exercise caution when opening files from unknown or untrusted sources."

"No dot release was scheduled or released for Adobe Photoshop CS5," a company spokeswoman explained the reason behind their decision. "In looking at all aspects, including the vulnerabilities themselves and the threat landscape, the team did not believe the real-world risk to customers warranted an out-of-band release for the CS5 version to resolve these issues."

But a day later, they changed their tune. Faced with a backlash from angry customers, Adobe bowed to the pressure and backpedalled on its original decision, deciding to patch the eight vulnerabilities in question free of charge.

Continued: http://www.net-security.org/secworld.php?id=12920

Also:
Adobe backs down, will secure last generation of apps
Adobe u-turn promises free security patches for Creative Suite

Debit card accounts stolen in a recent hacker break-in at card processor Global Payments have been showing up in fraud incidents at retailers in Las Vegas and elsewhere, according to officials from one bank impacted by the fraud.

At the beginning of March 2012, Danbury, Conn. based Union Savings Bank began seeing an unusual pattern of fraud on a dozen or so debit cards it had issued, noting that most of the cards had recently been used in the same cafe at a nearby private school. When the bank determined that the school was a customer of Global Payments, it contacted Visa to alert the card association of a possible breach at the Atlanta-based processor, according to Doug Fuller, Union Savings Bank's chief risk officer.

That's when USB heard from Tony Higgins, then a fraud investigator at Vons, a grocery chain in Southern California and Nevada owned by Safeway Inc.

According to Fuller, Higgins said the fraudsters were coming to the stores to buy low-denomination Safeway branded prepaid cards, and then encoding debit card accounts issued by USB onto the magnetic stripe on the backs of the prepaid cards. The thieves then used those cards to purchase additional prepaid cards with much higher values, which were then used to buy electronics and other high-priced goods from other retailers.

Continued : http://krebsonsecurity.com/2012/05/global-payments-breach-fueled-prepaid-card-fraud/#more-14957

From the GFI Labs Blog:

For some time, we've seen site URLs with the dot TK (.tk) extension being spammed by bogus accounts on Twitter to random users. One of our threat researchers in the AV Labs found these particular Tweets quite noteworthy:

[Screensht: Computer View] - [Screenshot: Smartphone View]

Such Tweets are equally accessible to computer (desktop, laptop, and tablet) and smartphone users. There is no doubt, however, that smartphone users on Android are particularly targeted by these spam. Let me elaborate.

Once users click either good(dash)graft(dot)tk/swig.ph or POSY(dash)****(dot)TK, they are then directed to the Russian Web page, googleapi17(dot)ru/l(dot)php?l=os&r=5519&a=29#.

Users who accessed and used this purported scanner are then given the option to download and install a file, which vary depending on whether the target is a PC or a phone. Computer users will be able to download VirusScanner.jar, smartphone users will be able to download VirusScanner.apk. Outcomes are different, too.

Continued : http://www.gfi.com/blog/new-twitter-spam-run-leads-to-android-rogue-av/

Hotmail users are once again targeted by phishers. With "E-mail account alert!" in the Subject line, the fake email ostensibly comes from Microsoft.

"This e-mail has been sent to you by Hotmail to inform you that your account has been blocked," says the message. "Why are you seeing this? Someone may have used your account to send out a lot of junk messages (or something else that violates the Windows Live Terms of Service). We're here to help you get your account back. What do you need to do? We'll ask you to login to our secured activation page by following the link below and re-activate your account."

As you may guess, the link takes the victims to a spoofed Windows Live Hotmail sign-in page.

"If victims go ahead and enter their Windows Live ID and password, they will immediately be redirected to the genuine Windows Live sign-in page. Thus, users may mistakenly believe that the first sign-in failed for some reason and try again, this time on the genuine site," Hoax-Slayer points out.

Continued : http://www.net-security.org/secworld.php?id=12924

Is there anybody who regularly reads Naked Security who isn't familiar with malware attacks posing as email notifications regarding failed parcel deliveries?

Once again, we are seeing a widespread malware campaign spammed out - this time pretending to be regarding an aborted attempt to send a parcel via DHL to the recipient's address.

But on other occasions we've seen very similar threats pretending to be from UPS or Fedex and others.

Here's what a typical email in today's attack looks like, complete with a DHL corporate logo in the header and the subject line "DHL Package delivery status": [...]

Dear [name derived from email address], with this message we notify you that delivery at your destination, tracking ID #[number], has FAILED due to an address discrepancy. To obtain your delivery please print out the attached document and contact DHL US support

Feel free to contact us with further questions.

Attached to the email is a file, DHL report.zip, which contains malware designed to infect Windows computers.

Continued : http://nakedsecurity.sophos.com/2012/05/14/dhl-malware-campaign/