Spyware, viruses, & security forum: NEWS - September 17, 2012

A Web site that sells Social Security numbers, bank account information and other sensitive data on millions of Americans appears to be obtaining at least some of its records from a network of hacked or complicit payday loan sites.

Usearching.info boasts the "most updated database about USA," and offers the ability to purchase personal information on countless Americans, including SSN, mother's maiden name, date of birth, email address, and physical address, as well as and driver license data for approximately 75 million citizens in Florida, Idaho, Iowa, Minnesota, Mississippi, Ohio, Texas and Wisconsin. [Screenshot]

Users can search for an individual's information by name, city and state (for .3 credits per search), and from there it costs 2.7 credits per SSN or DOB record (between $1.61 to $2.24 per record, depending on the volume of credits purchased). This portion of the service is remarkably similar to an underground site I profiled last year which sold the same type of information, even offering a reseller plan.

What sets this service apart is the addition of more than 330,000 records (plus more being added each day) that appear to be connected to a satellite of Web sites that negotiate with a variety of lenders to offer payday loans.

Continued : http://krebsonsecurity.com/2012/09/id-theft-service-tied-to-payday-loan-sites/

.. targeting Iran

"Data suggests Flame was created by an advanced, nation-sponsored group with cash."

[Screenshot]
The client applications and related communications protocols supported by the Newsforyou control server used to coordinate Flame attacks. Kaspersky researchers found that at least one of the clients, SP, is still actively infecting computers.

The operators behind Flame, the highly advanced espionage malware that targeted Iran, began their campaign no later than 2006 and supported three other pieces of malicious software, one of which is still circulating on the Internet, researchers said.

The revelations are the result of a forensic investigation of control servers used to help execute the Flame operation. They show the state-sponsored campaign was even more far-reaching than previously believed. The servers were disguised as publishing platforms running a fictitious content management application called Newsforyou and were programmed to destroy hard-drive data to prevent the espionage from ever coming to light. They also used strong cryptography to prevent lower-level operators from controlling infected computers or viewing the contents of data that was extracted from them.

Continued : http://arstechnica.com/security/2012/09/new-malware-linked-to-state-sponsored-flame/

Also: Flame C&C Server Analysis Reveals New Malware in the Wild

.. suits

Malwarebytes, the anti-virus firm best known for its freebie scanner software, branched out into the enterprise with the launch of corporate products on Monday.

Malwarebytes Enterprise Edition (MEE) is designed to catch malware that other anti-virus programs sometimes miss, including some strains of blended attacks (for example, malware with characteristics not only of viruses but also of Trojans or worms) and "polymorphic" threats - which are capable of morphing their own code to evade detection. The technology runs in batch mode and is designed to avoid conflicts with any regular anti-malware software already loaded on the same corporate desktop.

Malwarebytes achieves this by testing against all major anti-virus vendors as well as database whitelisting. The tech is designed to work in tandem with other security kit rather than as a replacement to existing anti-virus software.

"Modern malware is able to bypass many of the antivirus technologies currently deployed in today's enterprise, posing a serious risk to corporate data," said Malwarebytes chief exec Marcin Kleczynski. "MEE's heuristic and behavior-based analysis engine adds a powerful second layer of defence to today's corporate systems that more effectively safeguards sensitive corporate assets from the organised crime rings behind much of today's malware."

Continued : http://www.theregister.co.uk/2012/09/17/malwarebytes_enterprise_launch/

Sun Charger, the Latest Android.Sumzand Variant, Continues the Massive Spam Campaign

Symantec Security Response Blog:

Android.Sumzand, currently one of the most active malware programs in Japan, has recently transformed itself into the "Sun Charger" app. Advertised through spam, this series of variants pretending to be apps that allow mobile devices to be charged by holding the display towards the sun has been quite successful in stealing contact details from a large number of users. As the scammers collect large volumes of data stored on the device, they send more spam advertising the fake apps to the email addresses that they have acquired. The number of recipients of the spam is increasing exponentially as each day passes by.

Because this particular spam campaign has become so huge, it is a heavily discussed topic on Internet forums and social-networking sites. Some users question if anyone would even fall for the trick, whilst others who have never received spam in the past are confused why they are suddenly receiving spam. A small portion of users criticize the app because it did not work as advertised; however, as far as the scammer is concerned, the app performed its job perfectly, i.e. it has managed to steal personal data in the background.

To combat its notoriety, the scammers are regularly changing the apps in an attempt to keep a low profile. "Sun Charger" is the fourth variant that we have seen since we confirmed its existence in early August. But the scammers have been lazy at making the changes; either that or they are just too busy and lack the time and resources to make a major facelift. It is also possible that they were not aware of the sheer scale of the operation when they commenced their venture.

Continued : http://www.symantec.com/connect/blogs/sun-charger-latest-androidsumzand-variant-continues-massive-spam-campaign