Spyware, viruses, & security forum: NEWS - December 19, 2012

Instagram cofounder Kevin Systrom responded to a firestorm of protests from users of the photo-sharing social network's proposed terms of service changes that could impact the privacy of its users.

Systrom blamed confusing legal jargon for the misunderstanding and said Instagram would not be selling users' photos once the terms go into effect Jan. 16.

"Our intention in updating the terms was to communicate that we'd like to experiment with innovative advertising that feels appropriate on Instagram. Instead it was interpreted by many that we were going to sell your photos to others without any compensation. This is not true and it is our mistake that this language is confusing," Systrom wrote in a blogpost. "To be clear: it is not our intention to sell your photos. We are working on updated language in the terms to make sure this is clear."

Systrom also addressed concerns that personal photos could suddenly appear in advertising without a user's permission, or compensation.

Continued : https://threatpost.com/en_us/blogs/privacy-protests-cause-instagram-rethink-changes-121812

Related:
Instagram Privacy Changes Start Clock Ticking for Users Who Want to Opt-Out
Instagram Updates Privacy Policies, Takes Heat for Twitter Talks

Analysis of a malicious Apache module, detected by ESET as Linux/Chapro.A, found that the world's most widely used web server, Apache, is being used to carry out these attacks, injecting malicious content into web pages served by an infected Linux server, without the knowledge of the website owner.

Although the malware can serve practically any type of content, in this specific case it installs a variant of Win32/Zbot, malware designed to steal information from online banking customers. While this particular version of Win32/Zbot targets European and Russian banking institutions, Linux/Chapro.A could eventually be used to mount attacks on American banks.

"The attack described in the present analysis shows the increased complexity of malware attacks," said Pierre-Marc Bureau, ESET security intelligence program manager. "This complicated case spreads across three different countries, targeting users from a fourth one, and making it very hard for law enforcement agencies to investigate and mitigate its effects."

Continued : http://www.net-security.org/malware_news.php?id=2364

Also:
New Apache Exploit Doling Out Zeus, Sweet Orange Exploit Kit
Apache Malware Variant Discovered With Links to 'Sweet Orange Exploit Kit'

From the Kaspersky Lab Weblog:

Like many others, I took advantage of Amazon.com's sale and ordered a Kindle Fire HD last week. When I got around to exploring the Amazon App Store, it didn't take long before running into malware.

While searching for a particular benchmarking app I was presented with some additional apps. One of them immediately looked suspicious. [Screenshot]

This app comes with the AirPush ad framework. That would potentially make this app AdWare. However, upon closer examination, it became clear the actual app doesn't do much of anything. It was very obviously put together quickly to make a buck.

This 'Internet Accelerator Speed Up' does nothing to optimize your connection. This is basically the core functionality of the app: [Screenshot]

When run, before showing some other messages, it will tell you that your connection has been optimized by 20-45%. That's it.

It's not the only app uploaded by this developer. Shake Battery Charger is another one. [Screenshot]

Continued : http://www.securelist.com/en/blog/208194054/Malware_in_the_Amazon_App_Store