Spyware, viruses, & security forum: NEWS - August 08, 2012

Do not envy the life of a Web app. It's a brutal, public existence filled with attacks from all sides. In fact, a new report by Imperva sheds some light on this sad life, showing that a typical Web app is attacked once every three days and some are targeted as many as 2,700 times in a given year.

Web apps are lots of fun for attackers because they're publicly accessible and take all kinds of interesting inputs. Attackers can take their time, throwing whatever data they choose at a given app and then see what happens to break. To determine what this attack landscape looks like, Imperva monitored 50 Web applications for six months, looking at the kinds of attacks each one endured and pulling out trends.

One of the more interesting findings was that the typical Web app can expect to be attacked every third day and that some of the applications are under attack as often as 292 days per year. There are likely to be multiple attack incidents on any given day, as well. The average attack that Imperva observed lasted a little less than eight minutes and the longest went on for about 80 minutes.

"However, regardless of attack frequency periods, compared to the peaceful periods, the success of the whole mission depends on the defense performance when under attack. Therefore, the defense solutions and procedures should be designed to accommodate attack bursts," the Imperva report (pdf) says.

Continued : https://threatpost.com/en_us/blogs/average-web-app-attacked-every-three-days-080812

Also:
Web apps attacked once every three days, report says
Web apps experience 2,700+ attacks per year

If you're an Android user, you probably couldn't help but notice the hundreds of articles about the proliferation of malware created specifically for that platform. Maybe you have already considered downloading an antivirus solution for your device.

If you did, and decided in favor of it, please download it from Google Play or other legitimate online app markets, as the probability that it will be a malicious app posing as a legitimate AV one is way less than if you go and search for one on the open Internet.

This advise goes doubly for Chinese and Russian users, since there are many third party app stores teeming with malware.

Take this recently discovered one by GFI's researchers for example: [Screenshot]

It ostensibly offers two dozens or so legitimate AV apps from a variety of well-established security companies, but unfortunately all the files are of the same size (186.4kb) and the same nature: they belong to the Boxer family of premium rate SMS senders.

http://www.net-security.org/malware_news.php?id=2210

Given the all-around popularity of various Apple devices, it's no wonder scammers often "offer" them as prizes in bogus contests and lotteries.

The latest of these is a scam that targets mobile phone users: [Screenshot]

In order to claim the "Free Apple Product", the user is urged to follow the link and enter a code in order to get the prize.

The website on which the user lands seems to imply that the prize is an iPad, and helpfully warns that only 15 of a 1000 are left.

But in order to get it, the user is then first asked to complete a brief survey, then enter his mobile phone number for a chance to win the "New iPad 2012."

"Fine print on the page informs users that by entering their phone number they are actually subscribing to an ongoing SMS subscription service that will be billed at $6 per text," Hoax-Slayer warns. "Those who enter their number and continue, will be taken to various other survey pages and asked to supply even more contact information, ostensibly to go in the running for further prizes."

Continued : http://www.net-security.org/secworld.php?id=13391

... into Online Banking Websites

From the Symantec Security Response Blog:

A strain of financial banking Trojans which runs browser-based man-in-the-middle (MITM) attacks has reared its ugly head once again. Trojan.Shylock is sophisticated malware which utilizes fake digital certificates and intercepts network traffic to inject code into banking websites. It tricks users into providing login and account details to cybercriminals. Recently, it has developed new tricks to steal user information.

Back in February, Trusteer published a blog stating that Trojan.Shylock had been observed injecting JavaScript which displayed a web-based chat screen to unsuspecting victims. The hackers controlled the chat screen and proceeded to query the victim for login credentials or other information required to gain access to their financial accounts.

Symantec has now observed another strain of Trojan.Shylock which includes updated configuration information. This configuration file is used to inject JavaScript containing the attacker's telephone details into the contact pages of online banking websites. If users are met with any error or get suspicious, the hope is that they will attempt to contact the bank using the fake contact numbers instead of the real ones.

Continued : http://www.symantec.com/connect/blogs/merchant-malice-trojanshylock-injects-phone-numbers-online-banking-websites

Android malware continues to grow at a startling pace, as Finnish security firm F-Secure found 5033 malicious Android application package files in the second quarter of 2012, representing a 64 percent increase.

It also found 19 new families and 21 fresh variants of existing Android malware families.

"Android malware is on the rise because simply because there are more opportunities out there to exploit. As the Android OS market share continues to surpass Apple's, the criminals have more devices to target and a higher chance of success," said Sean Sullivan security advisor at F-Secure.

Android weakness

"Android's weakness isn't in the technology but the user experience. The main way that Android malware infects phones is through users installing dubious apps. So, it is clearly a social engineering problem rather than a flaw in the operating system itself.

"People can't be expected to read every permission, every time so there should be a way of them being clearer or colour coded, for example if they ask for money."

Just yesterday, Kaspersky Lab found fresh mobile versions of the Zeus malware targeting Android systems. In July, over 100,000 downloaded malicious apps on the official Google Play store. In that case they were disguising themselves as Mario and Grand Theft Auto games titles.

Continued : http://www.techweekeurope.co.uk/news/android-malware-61-percent-88794