Spyware, viruses, & security forum: NEWS - May 17, 2012

RealNetworks is warning users about multiple security vulnerabilities in its RealPlayer media player application for Windows; the company says that none of the, now fixed, holes are known to have been used to compromise systems.

The released update, Version 15.0.4.53 of RealPlayer, closes three security holes. One hole is related to ASM RuleBook parsing that could be exploited by an attacker to remotely execute arbitrary code, another is a memory corruption problem related to MP4 file handling in the QuickTime plugin used by RealPlayer, and the third is a buffer overrun in the Media parser.

RealPlayer Versions 11.0 to 11.1 and 14.0.0 to 15.0.3.37, as well as RealPlayer SP 1.0 to 1.1.5 are affected; RealPlayer for Mac is not vulnerable. RealPlayer 15.0.4.53 - available for Windows 7, Vista SP1 and XP SP3 - corrects these problems. All users are advised to upgrade to the latest version. An alternative option is to simply uninstall RealPlayer as very few sites use it exclusively.

http://www.h-online.com/security/news/item/RealPlayer-update-fixes-security-vulnerabilities-1578444.html

See Vulnerabilities & Fixes: RealPlayer Multiple Vulnerabilities

Worm Spreads via Facebook Private Messages, Instant Messengers

From TrendLabs Malware Blog:

We recently received reports about private messages found on Facebook and distributing a link, which is a shortened URL pointing to an archive file "May09-Picture18.JPG_www.facebook.com.zip". This archive contains a malicious file named "May09-Picture18.JPG_www.facebook.com" and uses the extension ".COM". [Screenshot]

Once executed, this malware (detected as WORM_STECKCT.EVL) terminates services and processes related to antivirus (AV) software, effectively disabling AV software from detection or removal of the worm. WORM_STECKCT.EVL also connects to specific websites to send and receive information.

Another noteworthy routine is that this worm downloads and executes another worm, one detected as WORM_EBOOM.AC. Based on our analysis, WORM_EBOOM.AC is capable of monitoring an affected user's browsing activity such as message posting, deleted posted messages and private messages sent on the following websites such as Facebook, Myspace, Twitter, WordPress, and Meebo. It is also capable of spreading through the mentioned sites by posting messages containing a link to a copy of itself.

Continued : http://blog.trendmicro.com/worm-spreads-via-facebook-private-messages-instant-messengers

From the Symantec Security Response Blog:

Further analysis of the OSX.Flashback botnet has shed more light on how profitable such a botnet can be. Previously, we wrote that OSX.Flashback was generating money for its authors by displaying advertisements on compromised computers. We now have a much clearer idea of how many ads the attackers were displaying and how much those ads earned for the attackers.

From our analysis we have seen that, for a three-week period starting in April, the botnet displayed over 10 million ads on compromised computers but only a small percentage of users who were shown ads actually clicked them, with close to 400,000 ads being clicked. These numbers earned the attackers $14,000 in these three weeks, although it is worth mentioning that earning the money is only one part of the puzzle—actually collecting that money is another, often more difficult, job. Many PPC providers employ anti-fraud measures and affiliate-verification processes before paying. Fortunately, the attackers in this instance appear to have been unable to complete the necessary steps to be paid.

Continued: http://www.symantec.com/connect/blogs/osxflashback-how-turn-your-botnet

Twitter has implemented the Do Not Track header on its site, giving users the option of telling the site that they do not want to be tracked across other sites on the Web. The implementation is being done through the DNT technology in the Firefox browser.

Firefox, like other major browsers, allows users to enable the DNT option, which uses an HTTP header to inform sites that they don't want sites to set cookies that enable persistent tracking across the Web. Sites need to choose to respect that particular header in order to make Do Not Track work on their pages, and that's the change that Twitter has made.

Twitter officials said on Thursday that they had implemented Do Not Track.

"The Federal Trade Commission's CTO, Ed Felten, just mentioned Twitter now supports Do Not Track. We applaud the FTC's leadership on DNT," Twitter said in a statement.

Tracking of users through the use of special cookies has been a highly controversial practice, and advertisers have clashed with both privacy advocates and government regulators on the use of tracking cookies. The Federal Trade Commission and other organizations have supported the use of Do Not Track as a way to give consumers the ability to opt out of such tracking. Mozilla and Google have implemented it and Microsoft has implemented a similar system in Internet Explorer.

Continued : http://threatpost.com/en_us/blogs/twitter-implements-do-not-track-051712

A 20-year-old British man will spend the next 18 months behind bars for stealing "Call of Duty" gamers' credit card numbers and other confidential data and selling it to other cybercriminals.

Lewys Martin created a Trojan to remotely monitor gamers' keystrokes, giving him access to their bank and credit card numbers, passwords and PayPal accounts, Kent Online reported. Martin, from the seaside resort town of Deal in Kent, southeastern England, disguised the Trojan as a software patch for the popular computer game, and when people downloaded what they thought was a fix, Martin was able to harvest their sensitive financial details. He sold the data for between $1 and $5 each and kept the illicit profits, believed to be thousands of pounds, in an account in Costa Rica.

Martin might have gotten away with his elaborate Call of Duty con had he stuck to online crimes and not tried his hand at real world theft.

Martin's rap sheet dates back to last May, when he was caught breaking into South Kent College in Dover and attempting to steal computer equipment. He was thwarted before he could get his hands on anything, and at a court appearance in November his sentence was deferred to allow him to attend an IT computer course at a university in Canterbury.

Continued : http://www.msnbc.msn.com/id/47464480

Also:
Hacker Lewys Martin uses Call of Duty virus to sell players' card details
Call of Duty Trojan horse creator ends up in jail, after drunken college raid