Spyware, viruses, & security forum: NEWS - October 12, 2012

From Bitdefender's "Hot for Security" Blog:

Wireless carrier Verizon may sell data of new customers, including web search history, to marketers unless the clients opt-out within 30 days of signing the contract, revealed blogger Bryan Clark, a new Verizon customer himself.

New Verizon customers like us have 30 days to opt-out from them selling your Web history and device location to marketers," Bryan Clark's wrote.

The news raises further concerns that mobile phone and computer use is far from private, but rather used as marketing info to better sell products online. Localized marketing campaigns have been the debatable since aggressive Android adware was first spotted in Google Play, but companies often offer the defense that the info they're selling is not personally identifiable.

"Our customers can change their privacy preferences at any time," said a Verizon spokeswoman. "The 30-day window is essentially the initial time frame so customers can read and look at their options, but again, they can change them any time through MyVerizon."

Other carriers have admitted to collecting and offering marketers location-based services info, known as "Customer Proprietary Network Information." Sprint, AT&T and T-Mobile have similar policies and the customer privacy information says user consent on sharing this information "is sometimes implicit."

Continued : http://www.hotforsecurity.com/blog/de-facto-privacy-settings-on-verizon-puts-user-info-on-sale-3897.html

Also: Why you should check your Verizon Wireless privacy settings right now

From the GFI Labs Blog:

These past few days, our researchers in the AV Labs have been seeing a slew of spam campaigns purporting to have originated from the Automatic Data Processing, In., or ADP, a solutions provider to businesses with concerns involving outsourcing and computing services for the auto and heavy equipment industries.

The campaigns, which had been documented in real time, come in a number of varying content and appearance; however, these spam all lead to malware infection. Below are some of the samples we have captured:

[Screenshot] - [Screenshot] - [Screenshot]

Hyperlinks in the spam actually point to URLs that are inherently malicious or probably compromised, which then direct to IP addresses that host a bogus Adobe Flash Player page where users can download an equally bogus software. [Screenshot]

Similar to the Skype voicemail spam we have documented recently, these ADP spam campaigns are also associated with Blackhole-Zeus infections.

Continued : http://www.gfi.com/blog/adp-spam-campaigns-are-in-the-wild/

Attackers have been going after vulnerabilities in browser plugins and extensions for years now, as they know that users are slow about updating these components. Even if users have the browser set to update automatically, the third-party components are a separate issue and need to be patched on their own. With that in mind, Mozilla has added a new feature to Firefox that will, by default, block known vulnerable versions of plugins from running.

The new feature is in the beta version of Firefox right now and it works in conjunction with a blacklist of vulnerable versions of popular plugins. When a user lands on a site that requires the use of a plugin, say Adobe Flash, if the version running in the user's browser is on the list of known vulnerable applications, Mozilla will disable it and show the user a message saying that she needs to update the plugin.

The idea is to help protect users from themselves, something that security people have been trying to do for as long as there have been users.

"For instance, when browsing a reputable video sharing website, a user might feel safe enough to enable a vulnerable plugin in order to view the site's content (in fact, the trusted site can be whitelisted using the "Always activate plugins for this site" option in the button drop-down menu). Of course, it would be best if the user upgraded the plugin to a secure version, but perhaps they can't for one reason or another. In another scenario, they might not fully trust a site they arrive at after visiting a link sent from a friend. In this case, the blocklisted plugin would not automatically run, and the user would be protected," David Keeler of Mozilla wrote in a blog post.

Continued : https://threatpost.com/en_us/blogs/mozilla-adds-click-play-plugin-security-feature-firefox-beta-101212

"We all thought SOPA was dead, but new ransomware claims differently. Want your computer back? You'll pay the SOPA fee."

SOPA. The dearly-beloved anti-piracy bill rightfully quashed before it reared its ugly head and became signed into U.S. law. It only took months of worldwide protests, tech media outrage, site blackouts and the occasional satirical video or two.

A huge sigh of relief spread through the technology community when the bill was discarded -- at least for the moment. However, enterprising virus developers have piggy-backed on to the fear that copyright infringement and court cases produce for the general public -- using the recognizable SOPA branding to lure victims into parting with their hard-earned cash.

The so-called SOPA cryptovirus which warns users that their IP address is on a copyright infringement blacklist has been discovered. The 'ransomware' holds a computer hostage, warning that unless a victim hands over money, data will be wiped. U.S. and Canadian victims have to pay via a MoneyPak prepaid voucher, whereas others have to use Western Union.

Once accused of distributing illegal files, infected users are told they must pay $200 within three days. [Screenshot]

The warning screen above says:

Continued : http://www.zdnet.com/sopa-reincarnates-to-hold-your-computer-hostage-7000005684/

Do you still think that there's no need for an anti-virus on your Android smartphone? Soon you might not have any choice.

Judging by a report on the Android Police website, a new edition of the Google Play app (Android's equivalent to the iOS App Store) has put in place the foundations for some kind of anti-virus functionality.

Looking at the code seen inside the app, it appears that Google could soon have the capability to perform anti-malware scans on your smartphone. Our own examination has confirmed the existence of strings in the app's code such as:

"Allow Google to check all apps installed to this device for harmful behavior? To learn more, go to Settings > Security."

"Installing this app may harm your device"

"Installation has been blocked"

"To protect you, Google has blocked the installation of this app."

There are also some interesting-looking graphics (well, not that interesting.. but you can probably imagine how they might be used): [Screenshot]

Continued : http://nakedsecurity.sophos.com/2012/10/12/google-scanning-android-malware/

From the SANS ISC Diary:

We are seeing reports of Facebook Scam Spam trickle in. Rene provided us with a detailed anecdote that includes the following image. The url provided in the image was investigated a bit. TinyURL has since taken down the redirect and classified it as Spam. However, the image (and others like it) still propagate by FB users clicking on the link.

This type of scam is used mostly without the permission of the vendor noted, in this case Costco. The idea is to entice the user to click so they get redirected to a site where the business model depends on traffic volume. If the Facebook user count has hit 1 billion yet, (not something I'm keeping track of.) then even a small percentage of that makes the Facebook population an easy target, with an easy payout. [Screenshot]

If you are a Facebook user, then please be wary of any offers that entice you to "click" to receive. It's a really bad practice. The holiday shopping season is beginning and these vectors are going to be heavily used by the scammers in the coming months.

https://isc.sans.edu/diary.html?storyid=14281