Spyware, viruses, & security forum: NEWS - September 14, 2012

Ransomware is malicious software that attempts to extort money out of unsuspecting users, normally by locking them out of their machines. This isn't the first time (or even the second) that we've seen such malware in the last few months, but lately there has been a trend of a more sinister type of ransomware.

Instead of simply employing tricks to lock you out of your computer, crypto-ransomware holds your files (documents, photos, music, movies, etc.) hostage by encrypting them. This makes remediation a lot more difficult than just removing the malicious infection, as your files also need to be decrypted.

Last week, SophosLabs saw new ransomware samples employing this technique. On infection, the malware searches for specific types of files (using a list of over 110 file extensions; .doc, .jpg, .pdf, etc), encrypts them, and renames the now unreadable file with a .BLOCKAGE extension. The following ransom message is then displayed to the user: [Screenshot]

Continued : http://nakedsecurity.sophos.com/2012/09/14/new-technique-in-ransomware-explained/

China's Huawei and ZTE Grilled by U.S. Committee Over Spying Concerns

A U.S. congressional committee appeared to come away still in doubt about the security of networking equipment from Chinese firms Huawei Technologies and ZTE after holding a Thursday hearing in which the two companies tried to dispel allegations that they were tied to the Chinese government.

"I'm a little disappointed today. I was hoping for more transparency, more directness," said the Chairman of the U.S. House Intelligence Committee, Representative Mike Rogers. "There is a sphere of government influence in your companies of which you either can't identify their roles and responsibilities or won't. Either way, its unacceptable."

Thursday's hearing was held as part of an investigation launched by the U.S. House Intelligence Committee to find if Huawei and ZTE posed a security threat to the nation given the increasing cyber attacks allegedly coming from China. U.S. officials are concerned networking gear bought from Huawei and ZTE could in fact be used by the Chinese government to spy on U.S. activities and steal sensitive information.

Continued : http://www.pcworld.com/businesscenter/article/262310/chinas_huawei_and_zte_grilled_by_us_committee_over_spying_concerns.html

Also:
US Congress Slam Huawei and ZTE as Companies Deny Espionage Charges
Huawei, ZTE deny U.S. charges; House lawmakers unconvinced
Huawei and ZTE deny US spying charges at hearing

FireEye reported today it had detected a new critical PDF attack targeting the aviation defense industry.

Malware Page exploits a stack-based buffer overflow vulnerability in Adobe Acrobat and Adobe Reader. An attacker would be able to execute code remotely via a crafted argument to the getIcon method of a Collab object, according to the CVE alert.

When a user opens the infected PDF, the exploit creates an executable file, which drops a DLL and opens a backdoor connection on TCP port 49163, FireEye said in its analysis. The malware opens connections to IP addresses in Germany and the Bahamas and maintains a detailed log of all network communications.

Simultaneously, the attack drops a decoy PDF document which is an invitation to an actual defense industry event.

https://threatpost.com/en_us/blogs/new-pdf-attack-targets-aviation-defense-industry-091312

US schools track teens by putting chips into students' ID cards

A Texas school district in the US is putting tracking chips into new, mandatory student IDs to keep tabs on students' whereabouts at all times.

The one-year pilot test is being rolled out in October for some 4,200 students in the John Jay High School and Anson Jones Middle School, which are two of the 112 schools in the district.

Students will be required to wear the cards on a lanyard around their necks and will be charged a fee for losing them.

Their location will be beamed out to electronic readers throughout the campuses, Northside Independent School District spokesman Pascual Gonzalez told FoxNews.com.

Some parents are protesting, comparing the tags to RFID chips used to track cattle.

Steven Hernandez, a father of a student who attends the Texas school and the only local parent to attend a protest late last month, told KSN News that the new badges amount to "a spy chip".

Continued : http://nakedsecurity.sophos.com/2012/09/14/us-schools-track-teens-by-putting-chips-into-students-id-cards/

TrendLabs Malware Blog:

Recently it was announced via posts in underground forums and Pastebin posts that a new version of the Blackhole Exploit Kit (BHEK), version 2.0, had been released. (The original announcement was in Russian; an English translation has been provided by researcher Denis Laskov and may be found here.)

We cannot confirm that BHEK 2.0 has been fully deployed by cybercriminals yet. However, intriguing evidence suggests that some parts of BHEK version 2.0 are already being beta-tested in the wild.

The announcement explicitly called out changes in the URLs that BHEK uses:

In version 1. * link to malicious payload unfortunately was recognizable for AV companies and reversers, she [sic] looked this kind,. /Main.php?Varname=lgjlrewgjlrwbnvl2. The new version of the link to the malicious payload you can choose yourself, here are some examples: /news/index.php,/contacts.php and so on, now for the moment no one AV can not catch.

Let's look at three recent BHEK spam runs to see where they fit here. One spam run, using the name of the Federal Deposit Insurance Corporation (FDIC), was a classic BHEK 1.x spam run with an infection chain of this format:

hxxp://{compromised domain}/achsec.html
hxxp://{landing page}/main.php?page=0f123fe645ddf8d7
[Screenshot: FDIC]

In contrast to this, both the eFax and ADP spam runs used the new URL format. eFax used the following format:

Continued : http://blog.trendmicro.com/blackhole-2-0-beta-tests-in-the-wild/

From Bitdefender Labs "HotforSecurity" Blog:

"Passwords are the last, and sometimes only, line of defense against online criminals. The average computer users know not to leave their critical passwords lying around for all to see."

Some iOS app developers, however, are apparently less careful when handling users' vital information. Bitdefender Labs analyzed some highly-rated free iOS apps starting from the premise that they should handle credentials wisely, only to find out that some of them don't.

With 65,427 three-and-a-half customer-rated stars at the time of writing, Wi-Fi Finder By JiWire Inc. was found to broadcast passwords in plaintext. The app, which enables users to find free or paid Wi-Fi networks, does not seem to encrypt any broadcasted passwords, making it easy for someone with minimum spoofing knowledge to peek at them.

An iOS app that offers "to keep track of your expenses and personal finances on the go" also sends plaintext passwords. Texthog has more than 1,526 customer-rated stars, suggesting that it's quite popular. Auto sync with your texthog.com account could be risky if you're doing it over a Wi-Fi network while somebody is monitoring your traffic.

Continued : http://www.hotforsecurity.com/blog/beware-of-ios-apps-that-send-plaintext-passwords-3481.html

"AlienVault identified the suspect by traces of his personal information scattered online"

Security experts at AlienVault have tracked down the creator of the PlugX Remote Access Tool (RAT), used in hacker attacks around the world. To their surprise, the brains behind the software was actually one of the directors of a Chinese IT company.

The sleuths analysed the traces of PlugX activity, and identified the suspected programmer, which led them to his address, photo and the name of the company he was working for - ChinaNSL Technology.

Digital detective work

AlienVault has been tracking PlugX, also known as Korplug, for the past few months, analysing the payloads of the attacks and collecting intelligence.

PlugX is a backdoor malware with a high damage potential. Once on the system, it executes commands from a remote malicious user, effectively compromising the affected computer.

The tool was mainly used by hackers in Japan, Taiwan, China, Korea and against Tibetan organizations. The security experts were almost certain that the creator of the malware has been participating in the attacks himself.

Continued : http://www.techweekeurope.co.uk/news/plugx-rat-malware-creator-is-an-it-company-director-92780

Also:
AlienVault doxes the man behind the PlugX RAT
Is 'Virus Expert' Tied To PlugX RAT Malware?
AlientVault Tracks Down Developer of PlugX RAT

PlugX RAT related: PlugX: New Tool For a Not So New Campaign