Spyware, viruses, & security forum: NEWS - June 07, 2012

Users of dating website eHarmony told their passwords have been stolen

Online dating website eHarmony has confirmed that passwords for some of its users have been exposed in a security breach that echoes the high profile incident involving LinkedIn yesterday. [...]

In a blog post, eHarmony's corporate communications chief Becky Teraoka said that the firm was resetting the passwords of affected users.

Unfortunately, eHarmony doesn't offer much detail of the security incident - only saying that "a small fraction" of its userbase was impacted, and there is no information shared of how the data breach might have happened.

As with the LinkedIn breach, eHarmony users' passwords were exposed in the form of hashes. In this case, the hashes of 1.5 million eHarmony passwords were uploaded to websites, where hackers were encouraged to join forces to crack them.

What really disappoints me is that eHarmony misses an opportunity to tell its users explicitly that if they use the same password on other websites they must change their passwords there also.

Continued : http://nakedsecurity.sophos.com/2012/06/07/eharmony-passwords-stolen/

Also:
eHarmony confirms its members' passwords were posted online, too
eHarmony dating site joins LinkedIn in confirming password breach

A new piece of Android malware that has recently been unearthed by NQ Mobile researchers is capable of logging text messages and phone calls, as well as record them, and send them to a remote server controlled by attackers.

Dubbed DDSpy, the malware hides in the app list and waits for instructions that can be delivered via SMS from a remote server.

"When DDSpy receives a command, it will configure the uploading email address and determine what content to steal. Our research shows that it's capable of uploading the user's SMS, call log, and vocal records," the researchers pointed out.

"In addition, it reserves a GPS-uploading interface for future development. Because of this strange activity, we are concerned that it will evolve into more malicious spyware."

The malware initiates the recording of phone calls either when it receives the command to do it or when it detects outbound calls, and stores the recordings on the phone's SD card. Once a day, all the recorded information is sent to the remote server.

Continued : http://www.net-security.org/malware_news.php?id=2140

Social music site Last.fm announced an investigation into a user password leak this morning. In light of a recent leak involving large sites such as LinkedIn (where 8 million passwords could have been compromised) and eHarmony, Last.fm is asking users to change their passwords immediately.

Last.fm users can switch their passwords by logging in and accessing the "Settings" page, or by reporting their password as lost. In the site's announcement, Last.fm re-emphasized these are the only means for password changes: "We will never e-mail you a direct link to update your settings or ask for your password."

Last.fm will update the status of the leak in the site's user forums or through Twitter when more information is available. Until then, the site offered the warning above and advice on choosing a secure password through Google. The amount of passwords potentially leaked has not been announced at this time.

http://arstechnica.com/security/2012/06/another-hack-last-fm-warns-users-to-change-their-passwords/

Also:
Change your Last.fm password NOW
Last.fm confirms password leak

A new survey conducted by a credit card comparison Web site indicates consumers continue to be lax when it comes to guarding against identity theft.

Users may not be able to prevent leaks such as today's disclosure of 6.5 million stolen LinkedIn passwords, but they are still engaging in their own risky behavior online, according to results from 510 consumers who responded to a 13-question CreditDonkey.com online survey conducted May 21 through 24.

A third admitted to sharing their password with a friend and to using the same password for multiple sites. Nearly 25 percent also said they add Facebook "friends" they don't know.

Thirteen percent said they've been the victim of ID theft.

"Given how promiscuous people are about their passwords online, I'm surprised the number of victims isn't higher," Charles Tran, founder of CreditDonkey.com, said in an e-mail. "Of course, with all the Web sites that now ask for user registration, it's hard to blame somebody for wanting to use the same password for multiple Web sites."

Because the Pasadena-based site helps people manage credit, many of the survey questions focused on how well consumers understood the impact identity theft can have on future borrowing capabilities.

Among the encouraging results:

Continued : http://threatpost.com/en_us/blogs/survey-shows-consumers-still-openly-risking-id-theft-060612