Spyware, viruses, & security forum: NEWS - October 02, 2012

The Federal Trade Commission (FTC) said today that a federal court has inflicted a judgment of more than $163 million on the final defendant in its case against an operation that used "scareware" tactics in order to trick consumers into believing their computers were infected with malware, and selling them software to "fix" a non-existent problem.

In 2008, the FTC charged Kristy Ross and six other defendants with tricking more than a million Internet users into paying $39.95 or more for software to remove non-existent malware that appeared to be detected by scans.

The FTC said the operation utilized online ad networks and other popular web sites to promote "technologically sophisticated" Internet ads that displayed to consumers a "system scan" that would invariably detect a host of malicious or otherwise dangerous files and programs on consumers' computers. The bogus "scans" would then encourage consumers to buy the defendants' software for $40 to $60 to remove the said malware.

According to the FTC's original complaint, the fake security software included products such as WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus.

Continued : http://www.securityweek.com/scareware-marketer-gets-whacked-163-million-judgment

Also:
FTC wins $163 million from woman who tricked 1 million users into thinking their PCs had malware
FTC gets $163M judgment in scareware case

RIIS announced HoseDex2Jar, a mobile security tool that can prevent Android decompilation by hackers on mobile devices.

Android runs applications in .dex format. Dex2Jar is the only tool available to convert Android APK's back into Java .jar files. This allows someone to decompile the .jar file using JD-GUI or JAD into readable source code. Once done, all proprietary source code and other sensitive information stored on backend databases are vulnerable.

RIIS knew if they could figure out a way to stop Dex2Jar from functioning, they could protect Android apps from being decompiled at all, thus protecting the apps from attackers. RIIS started investigating to see if Dex2Jar had any limitations they could expose. HoseDex2Jar was born.

"Developers can take steps such as using tools like ProGuard to obfuscate their code, but up until now, it has been impossible to prevent someone from decompiling an app," said Nolan.

Continued : http://www.net-security.org/secworld.php?id=13702

Also:
Mobile App Development Company Fights Off Android Malware with Obfuscation Tool
Mobile Firm Takes on Android Decompiler With New Tool
RIIS Develops Unprecedented New Mobile Security Tool to Stop Android Decompilation

security issues.

For instance, the humorous anarchic puppet show about spam, the mindreader who has a little help from Facebook, and Sophos's own movie about what happens when you go cycling around London, hunting for unsecured Wifi access points.

Now we have an affectionate spoof of the "Crocodile Hunter" TV shows made famous by the late Steve Irwin, with the intention of helping raise the public's understanding of web safety issues. [VIDEO]

The video, timed to coincide with National Cyber Security Awareness Month, comes from the folks at StopBadware.org and Bluehost.

Here are some quick tips:

• Keep your computers protected with up-to-date software and security patches - not just on the computers you use to browse the web, but the servers you use to host your website too. Malicious hackers are always on the lookout for computers that are not running the latest versions of software, hoping to exploit vulnerabilities.

Continued : http://nakedsecurity.sophos.com/2012/10/02/tracking-malware-in-the-wild-crocodile-hunter-style-video/

Thanks to lax mobile security practices and the amount of sensitive information stored in your pocket, mobile devices provide a rich platform for attackers to conduct reconnaissance, or the gathering of personal information used to crack into people's accounts.

Julian Bhardwaj, an intern at Sophos, writing for Naked Security, demonstrated a very cheap way to harvest some interesting bits of personal information using no more than a $23.95 wireless router off of eBay and freely available software. He simply took advantage of a default Android setting that broadcasts the names (SSIDs) of preferred wireless networks when you switch on your WiFi radio.

First, he set up a laptop in his university to capture packet data from nearby devices. Within five hours, 246 devices came into his range, and 49 percent were actively searching for - and broadcasting - the names of preferred networks. He was able to see 365 SSIDs, all containing information that a savvy attacker could use.

Continued : http://securitywatch.pcmag.com/none/303429-android-devices-scream-wifi-network-names