Spyware, viruses, & security forum: NEWS - December 10, 2012

From the Trendlabs Security Intelligence Malware Blog:

Yes, it does. And depending on where you are located, it can even speak in your mother tongue.

As discussed in our paper Police Ransomware Update, the people behind police Trojan/Ransomware have implemented improvements to make this threat more effective. Gone are the days when ransomware simply showed a message that users' systems are "captured" and that they have to pay for a fee to have them back.

These days, this new breed of ransomware notifies users of the fee (or ransom) under the guise of the victim's local law enforcement agencies. Thus, a user with a ransomware-infected system from France will get a notification from the Gendarmerie Nationale, while a US-based one will likely receive a message from the FBI.

To level up the ante, we received a report that a new police Trojan variant even has a "voice". Detected as TROJ_REVETON.HM, it locks the infected system but instead of just showing a message, it now urges users to pay verbally. The user won't need a translator to understand what the malware is saying - it speaks the language of the country where the victim is located.
[Screenshot: Ransomware Warning Screen]

Continued : http://blog.trendmicro.com/trendlabs-security-intelligence/latest-on-police-ransomware-it-speaks/

The Security Street blog has found a botnet client, the operator of which is hiding behind the Tor network. This trick makes the work of security experts and criminal prosecutors much more difficult. The malicious botnet software, called "Skynet", is a trojan that Security Street found on Usenet. At 15MB, the malware is relatively large and, besides junk files intended to cover up the actual purpose of the download file, includes four different components: a conventional Zeus bot, the Tor client for Windows, the CGMiner bitcoin tool and a copy of OpenCL.dll, which CGMiner needs to crack CPU and GPU hashes.

Claudio Giarnieri and Mark Schloesser write that they recently stumbled on the unusual botnet and, at first, had problems figuring out its origin. Although they did notice parallels between Skynet and information posted by GData in September about a similar Tor botnet. An analysis of the client showed that it uses Tor hidden services, which were added to the Tor network to allow the use of internet services without letting their server IP addresses be tracked. This feature of the Tor network can protect whistleblowers, but it can also provide a sanctuary to botnet operators.

Continued : http://www.h-online.com/security/news/item/Botnet-hidden-in-the-Tor-network-1765530.html

Also:
Tor network used to command Skynet botnet
Researchers Discover Botnet Powered by TOR

... Nanotechnology Records

Hacktivist collective Team Ghostshell is claiming this morning to have spilled 1.6 million accounts from a handful of companies in the aerospace, nanotechnology, banking, law, education and government realm, a hack the group deems Project White Fox.

The group claims White Fox is its "final stand" this year in a lengthy diatribe posted to Pastebin. The post goes on about internet freedom, espionage and trolling before addressing the actual leak.

The leaked information was purportedly taken from the European Space Agency, NASA's Center for Advance Engineering and Bigelow Aerospace, along with about a dozen other companies. The divulged data appears to be a dump of names, passwords - some hashed, some plain text--resumes, admin logins, phone numbers and e-mail addresses, among other bits of information.

The group goes on to boast that it also sent a series of e-mails detailing vulnerable servers and general security flaws to the Washington and Seattle divisions of the FBI, ICS-CERT, and the Homeland Security Information Network, to name a few.

Continued : https://threatpost.com/en_us/blogs/team-ghostshell-allegedly-dumps-16-m-aerospace-nanotechnology-records-121012

Also:
Team GhostShell leaks 1.6M account details
GhostShell Hackers Leak 1.6 Million Records from over 30 High-Profile Sites

One of the enhancements in Android 4.2 was a new app verification service that tested applications being installed against a Google service in the cloud to see whether the app was known to contain malware or not. If the results of Xuxian Jiang's research are correct, Google will need to do a lot more work on the feature to make it useful, as only 15 per cent of the known malware samples tested on the service were detected.

Jiang, an associate professor at NC State University, took Nexus 10 tablets running Android 4.2 and, using semi-automated installations, loaded 1260 malware samples from the Android Malware Genome Project onto the devices. Of the 1260 samples only 193 were detected as malware. The researcher also performed a test comparing Google's verification against a range of ten different existing anti-virus applications through VirusTotal, looking at randomly selected malware samples from each malware family. The anti-virus applications run by VirusTotal ranged in efficacy from 100% to 51%, but the Android App verification system scored only 20.4%; VirusTotal was acquired by Google in September 2012.

Continued: http://www.h-online.com/security/news/item/Only-15-of-known-malware-caught-by-Android-4-2-s-verifier-1765724.html

Saudi Arabia's national oil company, Aramco, said on Sunday that a cyberattack against it in August that damaged some 30,000 computers was aimed at stopping oil and gas production in Saudi Arabia, the biggest exporter in the Organization of the Petroleum Exporting Countries.

The attack on Saudi Aramco — which supplies a tenth of the world's oil — failed to disrupt production, but was one of the most destructive hacker strikes against a single business.

"The main target in this attack was to stop the flow of oil and gas to local and international markets and thank God they were not able to achieve their goals," Abdullah al-Saadan, Aramco's vice president for corporate planning, said on Al Ekhbariya television. It was Aramco's first comments on the apparent aim of the attack.

Hackers from a group called Cutting Sword of Justice claimed responsibility for the attack, saying that their motives were political and that the virus gave them access to documents from Aramco's computers, which they threatened to release. No documents have yet been published.

Continued : http://www.nytimes.com/2012/12/10/business/global/saudi-aramco-says-hackers-took-aim-at-its-production.html

Related:
Saudi Aramco: Insiders Didn't Help Hackers Breach Our Systems
Saudi Aramco: Foreign hackers tried to cork our gas output