Spyware, viruses, & security forum: NEWS - September 05, 2012

.. Bitlfoor

The future of the up-and-coming Bitcoin exchange Bitfloor was thrown into question Tuesday when the company's founder reported that someone had compromised his servers and made off with about 24,000 Bitcoins, worth almost a quarter-million dollars. The exchange no longer has enough cash to cover all of its deposits, and it has suspended its operations while it considers its options.

Bitfloor is not the first Bitcoin service brought low by hackers. Last year, the most popular Bitcoin exchange, Mt.Gox, suspended operations for a week after an attacker compromised a user account and sold all of his Bitcoins in a firesale that temporarily pushed the price down to zero. The site survived the attack and remains the leading Bitcoin exchange today. Hackers made off with another $228,000 in Bitcoins from online services earlier this year.

Bitcoin's peer-to-peer design means that transactions are irreversible. Once a transaction appears in the blockchain, the global record of Bitcoin transactions, no one has the authority to reverse it. And the pseudonymous nature of Bitcoin makes it difficult to trace stolen Bitcoins to their new owners.

Continued : http://arstechnica.com/tech-policy/2012/09/hacker-steals-250k-in-bitcoins-from-online-exchange-bitfloor/

Also:
Future of top US Bitcoin exchange in doubt after hackers grab $250,000
BitCoin exchange BitFloor loses $250,0000 after unencrypted keys stolen
Bitcoin Exchange Hacked, $US250K Stolen, Trading Operations Suspended
Virtual Bank Robber Gets Away with $250,000 in Bitcoin Heist

Over the past couple of months, researchers at AV-Comparatives.org torture-tested mobile security products from fourteen well-known vendors. They used real phones, not emulators, for the test, specifically Samsung Galaxy S plus phones running Android 2.3. For once, every tested product did well. The earned good or great detection scores against real-world malware, with no score lower than 93 percent and many much higher. The products all did well in the rigorous battery-drain test too.

Avast, Bitdefender, ESET, F-Secure, Ikarus, Kaspersky, Qihoo, Trend Micro, and TrustGo all detected 98 to 100 percent of the samples. AV-Comparatives suggests these be considered equally effective, without worrying about tiny differences in the actual scores. Lookout, McAfee, Sophos, and Webroot all fell into the next sample range, from 93 to 98 percent detection. This is still a good result, according to the report. Click the image below for a full chart of results.

Continued : http://securitywatch.pcmag.com/none/302302-report-mobile-security-apps-generally-effective

Also: AV test lab examines Android security programs

I spent several hours this past week watching video footage from hidden cameras that skimmer thieves placed at ATMs to surreptitiously record customers entering their PINs. I was surprised to see that out of the dozens of customers that used the compromised cash machines, only one bothered to take the simple but effective security precaution of covering his hand when entering his 4-digit code.

In February 2011, I wrote about geek gear used in a 2009 ATM skimmer incident at a Bank of America branch in California. The theft devices employed in that foiled attack included a card skimmer that fit over the real card acceptance slot, and a hidden ball camera.

I recently obtained the video footage recorded by that hidden ball camera. The first segment shows the crook installing the skimmer cam at a drive-up ATM early on a Sunday morning. The first customer arrives just seconds after the fraudster drives away, entering his PIN without shielding the keypad and allowing the camera to record his code. Dozens of customers after him would do the same. One of the customers in the video clip below voices a suspicion that something isn't quite right about the ATM, but he proceeds to enter his PIN and withdraw cash anyhow. A few seconds later, the hidden camera records him reciting the PIN for his ATM card, and asking his passenger to verify the code. [VIDEO]

Continued : http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/

Unknown attackers are attempting to persuade email recipients to open attachments that contain a trojan by claiming to be from The Google Accounts Team. A new email supposedly from "accounts-noreply@google.com" with the subject "Suspicious sign in prevented" is being sent en masse claiming that a hijacker has attempted to access the mail recipient's Google Account. The message says that the sign-in attempt was prevented but asks users to refer to the attached file for details of the attempted intrusion.

However, instead of containing information such as the IP address of the log-in attempt, the attached zip file contains a Windows executable file that will install a trojan onto a victim's system. While Google does sometimes send emails like this to users, they never contain attachments; users that receive such an email are advised to delete them. According to VirusTotal, the trojan is currently only detected by just half of 42 anti-virus programs used by the online virus scanner service.

http://www.h-online.com/security/news/item/Google-suspicious-sign-in-alert-contains-a-trojan-1698349.html

Also: Google users targeted with malware-laden "Suspicious sign in" notices

From the F-Secure Antivirus Research Weblog:

So, according to our recent poll, only 12% of you don't have Java Runtime Environment (JRE) installed. And the rest of you (88%) are Java junkies to one degree or another. [Screenshot]

Okay, well, for the 41% of you that have Java installed and also have browser plugins enabled, we hope you're at least using Java via Google Chrome, which prompts the user for permissions each time it comes across Java. [Screenshot]

Are you a Firefox user? Perhaps Plugins Toggler, an extension by Trinh Nguyen will encourage you to disable Java in your browser. [Screenshot]

It's a very simple and easy to use toolbar button that lets you open and "toggle" any installed plugins. So then you could leave Java disabled by default, but enable it when needed without having to dig through options menus. [Screenshot]

(A dedicated Java toggler button extension would be nice. Hint, hint.)

If you're now tempted to limit your Java plugins, why stop there? Why not inhibit all of your plugins? (As in Adobe Flash.)

Google Chrome includes an option for "Click to play" in Content settings (chrome://chrome/settings/content). [Screenshot]

Continued : http://www.f-secure.com/weblog/archives/00002419.html

From the F-Secure Antivirus Research Weblog:

Excerpted from our Threat Report H1 2012:

In the last year ZeuS has separated into more than one separately developed crimeware families after the source code for version 2.0.8.9 was leaked. An interesting development is a peer-to-peer version of ZeuS, which has been dubbed "Gameover".

The Gameover peer-to-peer (P2P) version was the second ZeuS derivative to appear in the wild and uses a peer-to-peer network to fetch configuration files and updates from other infected computers. The extensive changes incorporated into the derivative focus almost exclusively on the configuration file, and appear to be aimed at hindering retrieval and analysis. Many of the changes are to code sections that have been unaltered for years, such as the binary structure and compression method, which has not changed since 2008 (version 1.2).

The date this version was released to the public can be estimated from the registration data for the domains created by its Domain Generation Algorithm (DGA). The trojan uses these domains as "backup servers" if it cannot connect to other machines on the P2P network. As the first domain registration occurred on September 5th 2011, the trojan was likely let loose close to that date. These backup servers only host another list of infected machines from which the trojan could retrieve the actual configuration file. This backup system means that the configuration file is never stored on an external web server, but is handled entirely within the botnet itself.

All analyzed P2P samples have contained the same RSA public key used to check the digital signatures of incoming files.

Continued : http://www.f-secure.com/weblog/archives/00002421.html