Spyware, viruses, & security forum: NEWS - January 23, 2013

"Reporters without Borders is latest site used in "watering hole" campaign."

The website belonging to non-governmental organization Reporters Without Borders is the latest to be hit by attacks that use the recently patched Java and Internet Explorer vulnerabilities to surreptitiously hijack computers of visitors, security researchers said.

The compromise comes a week after similar attacks successfully commandeered sites belonging to major Hong Kong political parties, Jindrich Kubec, a security researcher with antivirus provider Avast, wrote in a blog post published Tuesday. It's most likely another example of a "watering hole" attack, in which attackers target the sites their victims are likely to visit, in much the way predators position themselves near a river or lake bed to lie in wait for thirsty prey.

"Such an organization is an ideal target for [a] watering-hole campaign, as it seems right now the miscreants concentrate only on human rights/political sites—many Tibetan, some Uygur, and some political parties in Hong Kong and Taiwan which are the latest hits in this operation," Kubec wrote. "In our opinion the finger could be safely pointed to China (again)."

Continued : http://arstechnica.com/security/2013/01/just-patched-java-ie-bugs-used-to-snare-human-rights-sites/

Related:
Reporters Without Borders website abused in malware campaign
Reporters Without Borders Site Hacked, Abused in Watering Hole Attacks

"Java is the newly crowned "king of foistware.""

Remember the Ask search engine? Oracle sure does—and by extension, so do Java users. Oracle has taken the practice of bundling useless add-ons and toolbars with legitimate software to new heights while collecting a commission each time it tricks a user into installing an Ask toolbar.

That's what Windows expert and legendary skeptic Ed Bott of ZDNet reports after examining Java's installation and update practices. Bott has done extensive reporting on "foistware," previously crowning Adobe and Skype as the worst offenders. But over the past year, Adobe and Skype have reformed themselves a little bit, while Oracle's Java now deserves the crown for "king of foistware," he wrote today.

"The evidence against Oracle is overwhelming," Bott wrote, continuing:

Continued : http://arstechnica.com/information-technology/2013/01/how-java-dumps-useless-add-ons-and-toolbars-on-pc-users/

Related : Oracle, please stop sneakily foisting third-party toolbars on us with your Java updates

From Ben Edelman within IAC Toolbars and Traffic Arbitrage in 2013::

The Special Problems of IAC Ask Toolbar Installed by Oracle's Java Updates

From the Trendlabs Security Intelligence blog:

The "post-PC era" is a phrase which has been a veritable buzzword for some time. However, 2012 saw cybercrime expanding to mobile platforms, highlighting how threats have entered the post-PC era, too.

Mobile Threats: 350,000 and Growing

By the end of 2012, the number of Android malware grew to 350,000. This was a monumental growth from the 1,000 mobile malware we saw at the end of 2011. Much of this growth was driven by adware and premium service abusers, which accounted for a sizable majority of the seen growth.

The popularity of Android in the mobile space means that it is now facing threats similar to what has faced Windows in the desktop space. This threat grew and became more sophisticated throughout the entire year, and we expect that this will continue into 2013.

Data breaches and Malware: Business as Usual

The year saw a continuation and evolution of many familiar threats. Data breaches and APTs continued to hit organizations large and small. Increasingly, the question is no longer if a system will suffer a data breach, but when. Throughout the year, we discovered and looked into various information theft campaigns, as well as the tools used.

Continued : http://blog.trendmicro.com/trendlabs-security-intelligence/2012-annual-security-roundup/

Related: Android malware could reach the 1 million mark by year's end

Representatives of newly launched file-storage and sharing service Mega addressed some of the concerns raised by security researchers in recent days about the site's architecture and the implementation of its cryptographic features.

In a blog post published Tuesday, Mega officials acknowledged that some of the security risks pointed out by researchers are valid, but said that users had already been informed about some of them through the FAQ (Frequently Asked Questions) section of the website. In the case of other issues, they promised some improvements.

For example, it has been pointed out that the encryption keys generated by users during the sign-up process, and which are later used to encrypt their files, are encrypted using the account password and are only stored on Mega's servers. Since there is no password recovery feature, users will lose the ability to decrypt their files if they forget their passwords, some people said.

Continued: http://www.computerworld.com/s/article/9236059/Mega_acknowledges_security_concerns_promises_changes

Related:
Mega facts
Mega's first crypto faux pas