Spyware, viruses, & security forum: NEWS - October 01, 2012

On Sunday night, news broke that hackers, allegedly linked to the Chinese government, managed to break into a system used by the White House Military Office (WHMO) for nuclear commands.

Bill Gertz of The Washington Free Beacon, broke the story, citing defense and intelligence officials familiar with the incident.

According to Gertz's sources, "the cyber breach was one of Beijing's most brazen cyber attacks against the United States and highlights a failure of the Obama administration to press China on its persistent cyber attacks."

While the attack may have been a bold attempt to gain access into one of Washington's most sensitive networks, the White House is downplaying the attack.

"This was a spear phishing attack against an unclassified network," a White House spokesperson told SecurityWeek. "These types of attacks are not infrequent and we have mitigation measures in place."

And according to the White House, while the attackers may have found an entry point into a sensitive network, the attack was identified and stopped quickly.

Continued : http://www.securityweek.com/officials-downplay-cyber-attack-against-white-house-military-office

.. Cadger Released! Sort of.

I picked a fine time to not go to DerbyCon.

We all remember Firesheep, a need little Firefox add-on from 2010 that allowed folks to intercept insecure cookies and have all sorts of fun with them, like impersonate people on Facebook. [Screenshot]

Well, Matt Sullivan has created Firesheep's scarier, more muscular half-brother Cookie Cadger. Sites are still using HTTP instead of SSL/TLS to secure communications, and Matt has put together a kick-ass tool that is more focused on being an open-source PEN-TESTING TOOL vs a toy.

From his site:

Cookie Cadger is a graphical utility which harnesses the power of the Wireshark suite and Java to provide a fully cross-platform, entirely open-source utility which can monitor wired Ethernet, insecure Wi-Fi, or load a packet capture file for offline analysis. The utility (+ source!) was released to the world on Sunday, September 30th during Matthew Sullivan's Derbycon talk.

Continued : http://it.toolbox.com/blogs/securitymonkey/firesheeps-scarier-more-muscular-halfbrother-cookie-cadger-released-sort-of-53182

.. Beware, it could be drug spam

Inventive spammers are up to their old tricks again, desperate to do whatever it takes to get you to click on a link to their websites.

The latest campaign we have seen involves messages which, to all intents and purposes, look like they have come from Twitter.

Certainly, without close inspection, there's nothing much to be suspicious about in regards to the email (although maybe they would have been more convincing if they had managed to reference your Twitter name if you have one). [Screenshot]

'Subject: Because you have more to show

We have something for you...

New Twitter profiles

Make your profile beautiful with a header image. Browse your new photo reel. Check out what other people are doing with their profiles.

The emails invite you to update your Twitter profile, to include the new format profile images that the micro-blogging site is attempting to push onto a slightly underwhelmed userbase.

But in this case the emails don't come from Twitter at all. Because if you click on the links you are actually taken to a "Canadian pharmacy" website claiming to sell sexual enhancement drugs.

Continued : http://nakedsecurity.sophos.com/2012/10/01/drug-spam-twitter/

.. Steal Your Life

"The US Naval Surface Warfare Center has created an Android app that secretly records your environment and reconstructs it as a 3D virtual model for a malicious user to browse"

The power of modern smartphones is one of the technological wonders of our age. These devices carry a suite of sensors capable of monitoring the environment in detail, powerful data processors and the ability to transmit and receive information at high rates.

So it's no surprise that smartphones are increasingly targeted by malware designed to exploit this newfound power. Examples include software that listens for spoken credit card numbers or uses the on-board accelerometers to monitor credit card details entered as keystrokes.

Today Robert Templeman at the Naval Surface Warfare Center in Crane, Indiana, and a few pals at Indiana University reveal an entirely new class of 'visual malware' capable of recording and reconstructing a user's environment in 3D. This then allows the theft of virtual objects such as financial information, data on computer screens and identity-related information.

Templeman and co call their visual malware PlaceRaider and have created it as an app capable of running in the background of any smartphone using the Android 2.3 operating system.

Their idea is that the malware would be embedded in a camera app that the user would download and run, a process that would give the malware the permissions it needs to take photos and send them.

Continued : http://www.technologyreview.com/view/429394/placeraider-the-military-smartphone-malware/

.. for Rio prostitutes

So, you think you're doing a pretty good job in terms of computer security on your home PC? You've kept your computer fully patched against the latest vulnerabilities? You've ensured that your PC is running the latest-and-greatest anti-virus updates?

Good for you.

Now, how about your router?

My suspicion is that the typical computer user doesn't give a second thought about whether their router could be harbouring a security threat, imagining that the devices don't need to be treated with suspicion.

But if you think that, you're quite wrong.

Fabio Assolini, a researcher for Kaspersky Labs, gave a fascinating presentation at the Virus Bulletin conference in Dallas last week, describing how more than 4.5 million home DSL routers in Brazil were found to have been silently hacked by cybercriminals last year.

Assolini described in his presentation, entitled "The tale of 1001 ADSL modems: Network devices in the sights of cybercriminals", how at some Brazilian ISPs, more than 50% of users were reported to have been affected by the attack.

Here's how the attack came about.

You're on Google's website, but you're not on Google's website

The first thing users may have noticed is that they would visit legitimate websites such as Google, Facebook and Orkut (a Google social network which is particularly popular in Brazil) and would be prompted to install software.

Continued : http://nakedsecurity.sophos.com/2012/10/01/hacked-routers-brazil-vb2012/

Also: DSL modem hack used to infect millions with banking fraud malware

"Do-not-track technology could hurt the ability of websites to deliver free services to users, the ITIF says"

he website for the Information Technology and Innovation Foundation (ITIF) now tells visitors it will not honor their browsers' do-not-track requests as a form of protest against the technology pushed by privacy groups and parts of the U.S. government.

The tech-focused think tank on Friday implemented a new website feature that detects whether visitors have do-not-track features enabled in their browsers and tells them their request has been denied.

"Do Not Track is a detrimental policy that undermines the economic foundation of the Internet," Daniel Castro, senior analyst at the ITIF wrote in a blog post. "Advertising revenue supports most of the free content, services, and apps available on the Internet."

Behavioral advertising, which tracks Web users in order to deliver relevant advertising to them, is a service in which "everyone wins," he added. "Ad-supported websites increase their revenue, users receive fewer irrelevant ads and more free content, and advertisers get to be in front of their target audiences."

Continued : http://www.computerworld.com/s/article/9231857/Tech_think_tank_s_website_rejects_browser_do_not_track_requests