Spyware, viruses, & security forum: NEWS - October 05, 2012

The kindness of friends is helping perpetuate an ongoing hoax that has spread widely across Facebook.

If you've seen a message like the following, posted by one of your Facebook friends, do them and the other billion users of Facebook a favour, and tell them that it's a hoax. [Screenshot]

FACEBOOK JUST RELEASED THEIR PRICE GRID FOR MEMBERSHIP. $9.99 PER MONTH FOR GOLD MEMBER SERVICES, $6.99 PER MONTH FOR SILVER MEMBER SERVICES, $3.99 PER MONTH FOR BRONZE MEMBER SERVICES, FREE IF YOU COPY AND PASTE THIS MESSAGE BEFORE MIDNIGHT TONIGHT. WHEN YOU SIGN ON TOMORROW MORNING YOU WILL BE PROMPTED FOR PAYMENT. IT IS OFFICIAL IT WAS EVEN ON THE NEWS. FACEBOOK WILL START CHARGING DUE TO THE NEW PROFILE CHANGES. IF YOU COPY THIS ON YOUR WALL YOUR ICON WILL TURN BLUE AND FACEBOOK WILL BE FREE FOR YOU. PLEASE PASS THIS MESSAGE ON...

Facebook's share price may have taken something of a stumble since the company floated on the stock market, but is not about to start charging you money to use its social network.

Continued : http://nakedsecurity.sophos.com/2012/10/05/facebook-price-grid/

A new auction website in New Zealand was taken down two days after its launch when IT professionals deemed it unsafe.

Wheedle.co.nz proved to lack consistent security policies and needed to postpone its activities until it properly addressed the multitude of "unforeseen technical problems."

Shortly after its launch, some wheedle visitors noticed and complained about how the password reset system was sending secret check words in plaintext in emails, while other account owners received multiple password-related emails which raised suspicions that a third party had illegally access to the software destined to send password reminders.

On top of that, there have been allegations with respect to users' being able to see and edit prices on someone else's auction in a public sale on the website.

People have every right to be concerned about the safety of their identity and money especially with a popular service. Carl Rees, Wheedle general manager, told NBR ONLINE that "according to Google Analytics, from launch October 1 to this morning we have had 79,800 individual hits to the site and over 1 million page views" which makes Wheedle.co.nz popular.

Continued : http://www.hotforsecurity.com/blog/brand-new-online-marketplace-fails-security-test-3774.html

Also: The trials and tribulations of the Trade Me wannabes

"By indexing customers who fail security tests, services flag vulnerable sites."

[Screenshot] from Oizys as it scans publicly available information to find sites that have recently had trust marks from McAfee Secure revoked.

Marketers at security giant McAfee peddle their Secure trust mark service as an easy way for online merchants to showcase the safety of their websites. These sites include a link to a seal showing it has passed a rigorous security scan that is performed daily. But a pair of security consultants say the program in many cases can tip off malicious hackers to easy-to-exploit vulnerabilities that might otherwise not be found.

That's because a design flaw in the service, and in competing services offered by Trust Guard and others, makes it easy to discover in almost real time when a customer has had the seal revoked. A revocation is a either a sign the site has failed to pay its bill, has been inaccessible for a sustained period of time, or most crucially, is no longer able to pass the daily security test.

"It's basically McAfee, Trust Guard, and all these other guys raising the flag, saying, 'Hey guys, these sites are vulnerable to attack. Go after them,'" Shane MacDougall, a security researcher with Tactical Intelligence, told Ars. "They all suffer from this fatal design flaw, which is you're raising a flag over your castle and you're pulling the flag down when you're vulnerable to attack. Who in their right mind would do that?"

Continued : http://arstechnica.com/security/2012/10/mcafee-trust-guard-certifications-can-make-websites-less-safe/

.. attacks

From the Websense Security Labs Blog:

Here at Websense Security Labs, we often blog about big malicious campaigns and how our products protect our customers from them. But what about smaller campaigns that are no less dangerous?

Broad campaigns often spoof notifications from well-known businesses, establishments, organizations, and agencies, and are very widespread these days. However, smaller volume campaigns sometimes can be as (or even more) dangerous by bypassing the victim's defenses.

Last week, the Websense ThreatSeeker Network intercepted one such campaign. This small-volume, malicious campaign targeted businesses with legitimate-looking email that refer to items like purchase orders, quotes, and supply information. All of these email had attachments that install variants of the popular Zeus malware on the victim's computer.

Websense Cloud Email Security quarantined these emails as containing a potential virus before most of the malicious attachments were detected by antivirus (AV) engines. ACE, our Advanced Classification Engine, provides the extra layers of protection that help Websense Cloud Email Security protect customers against a wide array of threats.

In many cases, AV signatures are behind the latest threats. But although ACE uses AV as one of its analytics, we found this example where AV was not detecting the threat. Other techniques such as using network behavior (volume vs. time) and reputation are very effective against big campaigns, but would not work in this case, since the volume was low. The content of these email messages looks benign most of the time, so traditional antispam rules would not work well either. This is where additional protection is needed. ACE can provide that protection and quarantine such suspicious messages by looking more deeply at their content and features, like the types of attachments, message attributes, Web links in each message, and telltale patterns in the content body.

Continued : http://community.websense.com/blogs/securitylabs/archive/2012/10/05/When-less-is-more-the-growing-impact-of-low-volume-email-attacks.aspx

"The Pirate Bay, used by millions worldwide to file-share copyrighted content and free-for-all works alike, is accused of collecting IP addresses of its registered users."

Torrent file and Magnet link sharing site The Pirate Bay has been accused of logging potentially identifiable information about its users, including email and IP addresses.

@pokex, who describes themselves as a "rootadmin at AnonOps," named after the website thought to be used by hacking collective Anonymous, took to Twitter this week to claim the Sweden-based site kept a database of information, including data that users might not want to end up in the hands of the authorities.

' Oh hey @tpbdotorg, how do you feel logging all your users IPs? pastie.org/4904080 Spread the truth about TPB. Pics > imgur.com/a/07i1f
— 'O.o (@pokex) October 3, 2012

The accusation could be damaging to the reputation of the site's integrity, as the torrent-linking site continues to be bombarded by authorities around the world in ongoing copyright infringement litigation.

Continued : http://www.zdnet.com/pirate-bay-accused-of-collecting-users-ip-addresses-7000005328/