Spyware, viruses, & security forum: NEWS - July 05, 2012

This coming Monday, 9 July, the FBI will be turning off the DNS server which currently intercepts queries from DNSChanger victims. This will mean that users who are infected with the malware will be almost completely unable to access the internet normally. Users are therefore advised to check whether their computers or routers use one of the FBI-listed IP addresses for DNS queries, well before the server shutdown, by visiting dnschanger.eu or dns-ok.us.

Users who want to check their configuration manually need to look out for the following IP address ranges:

• 85.255.112.0 to 85.255.127.255
• 67.210.0.0 to 67.210.15.255
• 93.188.160.0 to 93.188.167.255
• 77.67.83.0 to 77.67.83.255
• 213.109.64.0 to 213.109.79.255
• 64.28.176.0 to 64.28.191.255

If an address from one of the above ranges is already set as the DNS server on the computer or router, it is infected with DNSChanger. Users can find out where to locate this DNS server information for their particular case using a wizard set up by the eco association. Future DNS queries can be made using servers such as Google's at 8.8.8.8.

Continued : http://www.h-online.com/security/news/item/DNSChanger-victims-to-lose-internet-on-Monday-1632475.html

Also:
Thousands of DNSChanger malware victims could be knocked offline next week
'Internet doomsday' due on Monday, claims FBI

Apple's App Store is apparently damaging the contents of applications as they're downloading, leaving developers flooded with complaints about errors they can't fix.

The file corruption problem seems to have started yesterday. Instapaper's Marco Arment was one of the first devs hit: he uploaded a new version of Instapaper to the iTunes shop for users to fetch and install, and almost instantly received complaints that his program was crashing on launch despite being perfect when released.

Since then he has compiled a list of more than 20 affected apps. Apple remains typically taciturn.

Not that Cupertino hasn't been busy - some of the listed applications, including Instapaper, are apparently now working properly - but despite the fix there's been no word to developers or response from the Apple team about what's going on or how to fix it.

Continued : http://www.theregister.co.uk/2012/07/05/apple_curruption/

Also: iOS and Mac apps reportedly crashing due to corrupt App Store updates

The secret-spilling group WikiLeaks said Thursday it was in the process of publishing material from 2.4 million Syrian emails—many of which it said came from official government accounts.

WikiLeaks's Sarah Harrison told journalists at London's Frontline Club that the emails reveal interactions between the Syrian government and Western companies, although she declined to go into much further detail.

Ms. Harrison quoted WikiLeaks founder Julian Assange as saying that "the material is embarrassing to Syria, but it is also embarrassing to Syria's external opponents."

It is unclear what exactly is in the documents. WikiLeaks only posted a handful of them to its website Thursday, but the disclosure—whose source WikiLeaks hasn't made clear—wouldn't be the first major leak of Syrian emails.

In February, the Israeli newspaper Haaretz published excerpts of what it said were emails hacked from Syrian servers by Anonymous, the shadowy Internet activist group. In March, Britain's Guardian newspaper published emails it sourced to Syrian opposition activists.

The messages appeared to catch the glamorous wife of Syrian President Bashar al-Assad shopping for pricey shoes while her country slipped toward civil war.

Continued : http://online.wsj.com/article/SB10001424052702304141204577508371280908972.html

Also: Wikileaks Releases Syria Files, 2.4 Million Government Related Emails

The President of the United States is not going to pay your utility bill.

Atmos Energy is warning customers about the latest version of a scam that promises federal stimulus money for utility bills in exchange for a customer's personal information. The scam artist provides a bank routing number that supposedly has an account with funds to pay past due bills.

However, there is no such program and customers should never give personal information to anyone who is not an authorized agent of any utility company.

Atmos Energy previously warned customers about the scam in May but has been receiving calls this week from customers who received the bank routing number. The North Carolina Attorney General issued a warning about this scam June 28 and utilities in Florida have also reported a similar effort.

According to Better Business Bureau reports, scammers have visited customers in person, posted fliers and used social media and texting to send messages claiming that President Obama will provide a credit or directly pay utility bills.

Continued : http://www.net-security.org/secworld.php?id=13200

From the Kaspersky Antivirus Research Weblog:

Yesterday we were contacted by our partner MegaFon, one of the major mobile carriers in Russia. They notified us about a suspicious application, which was found in both the Apple App Store and Google Play. At first glance, this seemed to be an SMS worm spread via sending short messages to all contacts stored in the phone book with the URL to itself.

However, our analysis of the iOS and Android versions of the same application showed that it's not an SMS worm but a Trojan that uploads a user's phonebook to remote server. The 'replication' part is done by the server - SMS spam messages with the URL to the application are being sent from the remote server to all the contacts in the user's address book.

The application is called 'Find and Call' and can be found in both the iOS Apple App Store and Android's Google Play. We've already informed both Apple and Google but we haven't received an answer yet.

[Screenshot: Find and Call in the Apple Store] - [Screenshot: Find and Call in the Google Play]

All user comments (both in Apple Store and Google Play) are pretty angry and contain the same complaint that the app sends SMS spam:

Continued : http://www.securelist.com/en/blog/208193641/Find_and_Call_Leak_and_Spam

From the Symantec Security Response Blog:

If you were to compare the percentage of Mac users with the percentage of Windows users, the Windows user base still eclipses the Mac user base by a large margin. At the time of this blog post, one usage statistics aggregator reports on its website that the Windows market share is a commanding 84.13 percent of the population compared to Macintosh at 14.80 percent. However, statistics vary by research firm and this particular data was collected within the United States only.

So, what does all this have to do with malware you ask? In essence, the theory that operating systems other than Windows are safe from being compromised by malware has already been proven incorrect. From a malware author's perspective, being able to exploit a large user base will provide a greater install base for various reasons. The increased popularity of the Mac platform and the potentially less mature state of Apple security practices have made it a viable target. This has led to more attacks on the Mac platform than ever before.

Let's think about the statistic of 14.80 percent for a second. The estimated population of the United States is currently around 309 million. Assuming everyone in the U.S. owns a computer, it is around 43 million users who are potential victims.

Continued : http://www.symantec.com/connect/blogs/osxmacontrol-back-it-again

Also: New OS X trojan backdoor MaControl variant reported

Related: New MacOS X backdoor variant used in APT attacks