Spyware, viruses, & security forum: NEWS - June 22, 2012

Cisco warned customers Wednesday of several vulnerabilities in its AnyConnect Secure Mobility virtual private network (VPN) client, claiming that if not patched, the VPN software could be exploited by a remote attacker.

The holes are present in versions of Cisco's VPN client for Microsoft's Windows as well as the Linux and Apple OS X systems. Apple's iOS, Google's Android and Cisco's Cius platforms are not affected, according to the alert yesterday.

The VPN software can be deployed through the web or as desktop software by end-users. In a malicious attack against the web-based version, the AnyConnect client could be tricked into thinking certain sites are trustworthy and potentially get an unsuspecting user to download a malicious component, according to the advisory.

Since they are all exploited by the software's update mechanism, all versions of the client are vulnerable, including those deployed on the Web. The arbitrary code execution vulnerability could allow an attacker to remotely execute code on systems via ActiveX or Java, both of which help run the web-version of Cisco's VPN client.

Continued : http://threatpost.com/en_us/blogs/cisco-patches-vulnerabilities-vpn-client-ace-product-062212

Also:
Cisco Patches Vulnerabilities in VPN Client, Security Appliances
Cisco closes holes in its VPN client and security appliances

Twitter did not have a good day yesterday. The service had several random outages throughout the day, and there seemed to be no real explanation provided until everything had been returned to normal. Twitter gave its own explanation for the issue but it would seem that it may have been spurred on by something else. Twitter called the problem a 'cascaded bug', though a hacker collective known as UGNazi would seem to disagree. They claim to have been part of a group which took Twitter down for 40 minutes worldwide. How did they distribute this information, though? Via Twitter, unsurprisingly.

The group UGNazi seems to be relatively new, for they have no real coverage applied to their name until now. At the moment there are five known members, all made clear by their website. As expected they go by pseudonyms: JoshTheGod, Cosmo, IonCuber, GrimTheGod, and MrOsama. Their name focuses on Nazism and the Third Reich, as does their Twitter profile picture (a cartoon image of Adolf Hitler). Interestingly their webpage is headed with the words "Welcome Nazis", though it does not necessarily indicate that they are Neo-Nazi or right wing. It is possible they chose their name and identification to be as offensive or tasteless as possible to further their own agenda.

Continued : http://www.neowin.net/news/hacking-group-ugnazi-takes-credit-for-twitter-outages

Elsewhere: Twitter Blames Outage on 'Cascading Bug'

Related to : Tweetless in Seattle, also New York, San Francisco, etc, etc.

Encoding malicious PDFs as XDP files to bypass anti-virus? No need to panic

GovCertUK, the UK Government's Computer Emergency Response Team, issued an alert yesterday about how attackers could bypass gateway anti-virus software to infect organisations, by encoding malicious PDF files into the XDP format. [Screenshot]

XDP is an XML-based file format which includes the PDF as a Base64-encoded data stream. If you open an XDP file with Adobe Reader, it will be opened just like an ordinary PDF file, and potentially infect your computer with malware.

The truth is, however, that there is little to fear if your computers are protected by up-to-date anti-virus software.

XDP fileWhen you open an XDP file on your computer, the embedded PDF file is written to your hard drive before it is rendered.

At the point that the PDF is accessed for rendering, your on-access scanner should scan the PDF as normal, successfully detecting it if it's a piece of malware that the anti-virus knows about.

In short, good anti-virus software like Sophos does prevent XDPs containing embedded PDF malware from being actively infectious on your PC - we detect and correctly prevent access.

Continued : http://nakedsecurity.sophos.com/2012/06/22/encoding-malicious-pdfs-as-xdp-files-to-bypass-anti-virus-no-need-to-panic/

.. promised

Privacy-conscious users have sounded the alarm after it emerged the "New Tab" thumbnail feature in Firefox 13 is "taking snapshots of the user's HTTPS session content".

Reg reader Chris discovered the feature after opening a new tab only to be "greeted by my earlier online banking and webmail sessions complete with account numbers, balances, subject lines etc.

"This content is behind a secure login for a reason," Chris added.

In response to queries on the matter prompted by Chris's experience, Mozilla acknowledged that the behaviour was undesirable and promised a patch. In the meantime, the browser and email client firm points privacy-conscious users towards various workarounds, as a statement (below) explains.

We are aware of the concern and have a fix that will be released in a future version of Firefox. Mozilla remains resolute in its commitment to privacy and user control. The new tab thumbnail feature within Firefox does not transmit nor store personal information outside the user's direct control. ..........

Continued : http://www.theregister.co.uk/2012/06/22/firefox_new_tab_security_concerns/

Consumer demand for cheap prescription drugs sold through spam-advertised Web sites shows no sign of abating, according to a new analysis of bookkeeping records maintained by three of the world's largest rogue pharmacy operations.

Researchers at the University of California, San Diego, the International Computer Science Institute and George Mason University examined caches of data tracking the day-to-day finances of GlavMed, SpamIt, and Rx-Promotion, shadowy affiliate programs that over a four-year period processed more than $170 million worth of orders from customers seeking cheaper, more accessible and more discretely available drugs. The result is perhaps the most detailed analysis yet of the business case for the malicious software and spam epidemics that persist to this day. [Screenshot]

Their conclusion? Spam — and all of its attendant ills — will remain a prevalent and pestilent problem because consumer demand for the products most frequently advertised through junk email remains constant.

"The market for spam-advertised drugs is not even close to being saturated," said Stefan Savage, a lead researcher in the study, due to be presented early next month at the 21st USENIX security conference in Bellevue, Wash. "The number of new customers these programs got each day explains why people spam: Because sending spam to everyone on the planet gets you new customers on an ongoing basis, so it's not going away."

Continued : http://krebsonsecurity.com/2012/06/pharmaleaks-rogue-pharmacy-economics-101/