Spyware, viruses, & security forum: NEWS - June 29, 2012

In about two weeks, hundreds of thousands of computer users are going to learn the hard way that failing to keep a clean machine comes with consequences. On July 9, 2012, any systems still infected with the DNSChanger Trojan will be summarily disconnected from the rest of the Internet, and the latest reports indicate this malware is still resident on systems at 12 percent of Fortune 500 companies, and roughly four percent of U.S. federal agencies.

In a bid to help users clean up infections, security experts won court approval last year to seize control of the infrastructure that powered the search-hijacking Trojan. But a court-imposed deadline to power down that infrastructure will sever Internet access for PCs that are not rid of the malware before July 9, 2012.

According to Internet Identity, 12 percent of all Fortune 500 companies and four percent of "major" U.S. federal agencies are still infected. The latest stats from the DNSChanger Working Group, an industry consortium working to eradicate the malware, more than 300,000 systems are still infected. [Screenshot: DNSChanger Chronology]

That number is likely conservative: The DCWG measures infections by Internet protocol (IP) addresses, not unique systems. Because many systems that are on the same local network often share the same IP address, the actual number of DNSChanger-infected machines is probably quite a bit higher than 300,000.

Continued : http://krebsonsecurity.com/2012/06/dnschanger-trojan-still-in-12-of-fortune-500/#more-15678

Also:
12% of Fortune 500 infected with DNSChanger malware
Fortune 500 and US Government Agencies Still Infected with DNSChanger

Version 2.3 of the free ClamXav virus scanner for Mac OS X is now available to download. The update is based on the current 0.97.5 release of the GPLv2-licensed ClamAV anti-virus engine and adds support for system-wide preferences for all users.

In preparation for the upcoming Mac OS X 10.8 Mountain Lion release, the project's lead developer, Mark Allan, has signed the application with an Apple-issued Developer ID so that it will work with the new Gatekeeper security feature in 10.8. This means that under Mountain Lion, users who download and install applications that have been signed will no longer receive an alert that it comes from an unknown source and could be malicious.

The developer notes that major update also implements "big changes under the hood" in order to support sandboxing ; however, the feature is not yet enabled by default. Users can copy details from the Infected List using keyboard shortcuts, and RAM usage has been reduced. Some bugs that caused the application to crash have also been fixed.

Continued : http://www.h-online.com/security/news/item/ClamXav-ready-for-Mac-Gatekeeper-and-sandboxing-1628855.html

Using a data set consisting of 120,000 data points, researchers from OPSWAT estimate that Avast is the market share leader in the antivirus software market. [Screenshot]

In an over-crowded antivirus software market, end and corporate users are often finding it difficult to differentiate between a value-added market proposition, next to the "me too" vendors of solutions. As in every other market segment, any scientific insight into the market share of various vendors offers an invaluable perspective into the market dynamics, what are customers purchasing, and most importantly, are they living in a world of 'false feeling of security'.

Using a data set consisting of 120,000 data points, researchers from OPSWAT recently released an informative overview of the antivirus market, answering an important question - which is the most popular antivirus vendor?

According to their findings, that's avast! Free Antivirus, followed by Microsoft Security Essentials and ESET NOD32 Antivirus.

Detailed market share statistics:

Continued : http://www.zdnet.com/blog/security/which-is-the-most-popular-antivirus-software/12608

Google confirms Chrome bug is causing crashes on latest MacBook Air

"A minor update disables GPU acceleration while Google and Apple find a fix."

If you have the latest MacBook Air and run Chrome as your primary browser, you may have been the victim of numerous kernel panics that require a reboot. Google has now confirmed that a resource leak related to GPU acceleration is triggering the kernel panics, and an update released Thursday afternoon temporarily disables some acceleration features until a full fix is ready.

The problem seems to have first been discovered early last week, according to reports in Apple's support discussion forums. The common thread among users experiencing crashes was the use of Chrome, which seemed to cause a kernel panic related to the drivers for Intel's HD4000 integrated graphics.

It turns out that Chrome's use of GPU acceleration for plug-ins—in particular, Flash—leaked resources. A side effect of that leak, however, is that the drivers for the HD4000 cause a kernel panic, requiring a hard restart to recover.

Continued : http://arstechnica.com/apple/2012/06/google-confirms-chrome-bug-is-causing-crashes-on-latest-macbook-air/

From the Kaspersky Antivirus Research Weblog:

Two days ago we intercepted a new APT campaign using a new MacOS X backdoor variant targeted at Uyghur activists.

But before we go into details, let's start with a quiz:

- The Dalai Lama walks into an Apple Store. Why?

A possible answer is, "to buy one of the new MacBook Pro's with the Retina display!" (speaking of which, I would very much like to buy one of those as well, but it's kind of difficult to justify the hit to the family budget)

Joke aside, actually Dalai Lama is a well known Mac user. Here's a photo of him using a Mac during a conf call: [Photo]

And a better one of him using a 17" MacBook Pro: [Photo]

Perhaps it is no surprise that we are seeing an increase in the number of APT attacks against such high profile users using Mac's.

On June 27th, we've intercepted a new wave of APT attacks targeting certain Uyghur Mac users. [Screenshot]

The e-mails have a ZIP file attached. Inside the ZIP file, there's a JPG photo and a MacOS X app:

Continued : https://www.securelist.com/en/blog/blog?weblogid=208193616