Spyware, viruses, & security forum: NEWS - August 10, 2012

Blizzard Compromise - what they missed in their user communication

From SANS ISC:

Published: 2012-08-10,
Last Updated: 2012-08-10 01:51:02 UTC
by Kevin Liston (Version: 2)

James brought this to my attention shortly after I checked in for my shift: http://us.blizzard.com/en-us/securityupdate.html

There are a few more details here: http://us.battle.net/support/en/article/important-security-update-faq

I'm going to repeat a little of what they said about what was accessed:

'Here's a summary of the data that we know was illegally accessed:

North American-based accounts, including players from Latin America, Australia, New Zealand, and Southeast Asia

• Email addresses
• Answers to secret security questions
• Cryptographically scrambled versions of passwords (not actual passwords)
• Information associated with the Mobile Authenticator
• Information associated with the Dial-in Authenticator
• Information associated with Phone Lock, a security system associated with Taiwan accounts only

Accounts from all global regions outside of China (including Europe and Russia)

• Email addresses

China-based accounts

• Unaffected

At this time, there's no evidence that financial information of any kind has been accessed.
This includes credit cards, billing addresses, names, or other payment information. '

Note the bit in bold: "Answers to secret security questions." As we saw with Mat Honan's ordeal earlier this week (http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard) the secret question isn't much of a barrier in an attack, and when they have the actual answer, password resets aren't much of a challenge.

So, Blizzard's recommendation to "change your password" is largely ineffective for North American customers. If you're concerned about your account, change your security questions, and go with their two-factor solution too.

UPDATE: After spending 15 minutes on the battlenet website I couldn't find an easy way to change/update the security question. The best I could do was add SMS alerts to authorize any password resets.

https://isc.sans.edu/diary.html?storyid=13870

The FBI warned computer users on Thursday to ignore a fake message, purportedly from its officers, that freezes people's screens and demands that they pay a fine for visiting inappropriate websites.

"We're getting inundated with complaints," said Donna Gregory from the US Internet Crime Complaint Center, referring to the virus known as Reveton ransomware, which has hit users in the United States and globally.

"Some people have actually paid the so-called fine," she said, describing the virus as "drive-by malware" that installs itself when a user clicks on a compromised website and issues a message saying a federal law has been broken.

"The bogus message goes on to say that the user's Internet address was identified by the FBI or the Department of Justice's Computer Crime and Intellectual Property Section as having been associated with child pornography sites or other illegal online activity," the FBI said in a statement.

"To unlock their machines, users are required to pay a fine using a prepaid money card service," it said, accompanied by reports from victims who had paid fines of $200.

Continued : http://www.securityweek.com/online-scammers-using-fbi-message-demand-money

Also: Reveton Ransomware uses Fake FBI Message to Extort Money

From the Trusteer Blog:

Trusteer discovers a new financial malware targeting banks with a full bag of tricks for avoiding AV detection.

Back in 2009, Trusteer discovered Silon (http://www.trusteer.com/news/press-release/trusteer-warns-of-new-two-headed-trojan-attack-against-online-banks), a financial malware that was defrauding online banking customers protected by two factor authentication systems left and right. In 2010-211 Silon underwent two major updates and continued to "do well". Lately its numbers have been in decline, causing us to wonder whether Silon's perpetrators were taking a long vacation in prison.

Alas - not so. Last month (July 2012), we discovered a new financial malware, which upon close investigation, contained some behaviors identical to those exhibited by Silon. After some internal debate, we decided to name it "Tilon" (originally we had in mind "Silon++", but then we decided to increment the first letter, turning Silon to Tilon).

So-what does it do? Tilon is a financial malware that employs the "Man in the Browser" (MitB) approach. It injects itself into the browser (it has an impressive list of supported browsers - Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, and probably others) and then fully controls the traffic from the browser to the web server, and vice versa.

Continued : http://www.trusteer.com/blog/tilon-son-of-silon

SophosLabs has intercepted a major malware campaign, spread via spam email and compromised self-hosted WordPress blogs, which attempts to infect computers using the notorious Blackhole exploit kit.

Be on your guard if you have received an email entitled "Verify your order", as links contained within the email could take you to a poisoned webpage, designed to install malware onto your PC.

Here's what a typical email looks like: [Screenshot: Malicious email]

Subject: Verify your order

Message body:
Dear [name],

please verify your order #[random number] at [LINK]

We hope to see you again soon!

WordPressThe websites that are being linked to aren't ones that have been created by the malicious hackers.

They are legitimate websites that are running a self-hosted installation of the popular WordPress blogging platform. (Note, this does not include the many millions of bloggers who use the WordPress.com service - the vulnerable sites are those where people have installed their own WordPress software).

Continued : http://nakedsecurity.sophos.com/2012/08/10/blackhole-malware-attack/

Researchers Release Detection Tool For Gauss Malware's Palida Narrow Font

One of the many mysteries around the discovery of the Gauss malware is why the tool installs a new font called Palida Narrow on infected machines. Researchers have been unable to figure out yet what the purpose of the font is, but as its presence on a PC is a good indicator of a Gauss infection, CrySyS Lab and Kaspersky Lab today released a tool to detect it.

The detection tool can be found on the Securelist site and also on the CrySyS Lab site. The two main questions surrounding Gauss are why Palida Narrow is installed and what's inside the encrypted payload that Gauss installs on infected machines. While it may be some time before the contents of the payload are known, researchers have a number of theories about why the font is installed on newly infected machines.

Perhaps the most intriguing of these theories is that Palida Narrow is being used as a kind of brand to mark infected PCs for the command-and-control servers.

Continued : https://threatpost.com/en_us/blogs/researchers-release-detection-tool-gauss-malwares-palida-narrow-font-081012

Related : New Gauss Malware, Descended From Flame and Stuxnet, Found On Thousands of PCs in Middle East

Google's latest version of the Chrome web browser offers an even more secure, tightly sandboxed version of the browser's Flash Player plugin.

If you haven't already updated you can download Chrome 21 from Google. Existing users may need to restart their browser for any updates to apply.

At the moment the Flash Player improvements are only available to Windows users, but the change does apply to the entire Windows spectrum, covering everything from Windows XP (where Chrome is the only option if you want to keep Flash sandboxed) to the coming Windows 8.

As Chrome Software Engineer Justin Schuh writes on the Chromium blog, "Windows Flash is now inside a sandbox that's as strong as Chrome's native sandbox, and dramatically more robust than anything else available."

The Flash update sees Chrome dropping the older Netscape Plugin API — which browsers have long relied on for plugin security — in favor of Google's own Pepper Plugin API (PPAPI). Since PPAPI has a tighter sandbox it makes it harder to exploit Flash, but Schuh says the new architecture will make Flash more stable as well. "By eliminating the complexity and legacy code associated with NPAPI, we've reduced Flash crashes by about 20%."

Continued : http://www.webmonkey.com/2012/08/chrome-tightens-the-leash-on-adobes-flash-player/

A Goldman Sachs programmer cleared six months ago of stealing the source code to the bank's high-frequency trading system has been re-arrested and charged.

The Manhattan district attorney has now accused Sergey Aleynikov, 42, of unlawfully using secret scientific material and unlawfully duplicating computer-related material.

In February Aleynikov overturned a conviction on federal charges that claimed he stole trade secrets from his employer, mega-bank Goldman Sachs. During the appeal hearing, his lawyer Kevin Marino argued Aleynikov had been incorrectly charged under the Economic Espionage Act (EEA).

The appeals court ruled in Aleynikov's favour, finding that taking source code is not a crime under federal law, which instead makes it illegal to steal trade secrets, and that the code didn't qualify as stolen goods under another federal law.

Aleynikov, a naturalized US citizen from Russia, worked for Goldman Sachs between 2007 and 2009, and built software that takes advantage of small arbitrage opportunities in stock prices by placing millions of trades in a matter of seconds.

Continued : http://www.theregister.co.uk/2012/08/10/goldman_sachs_programmer_re_arrested/

Also: Former Goldman Sachs programmer faces new charges of stealing code