Spyware, viruses, & security forum: NEWS - January 24, 2013

A broad variety of the latest firewall, spam filter and VPN appliances sold by Campbell, Calif. based Barracuda Networks Inc. contain undocumented backdoor accounts, the company disclosed today. Worse still, while the backdoor accounts are apparently set up so that they would only be accessible from Internet addresses assigned to Barracuda, they are in fact accessible to potentially hundreds of other companies and network owners.

Barracuda's hardware devices are broadly deployed in corporate environments, including the Barracuda Web Filter, Message Archiver, Web Application Firewall, Link Balancer, and SSL VPN. Stefan Viehbock, a security researcher at Vienna, Austria-based SEC Consult Vulnerability Lab., discovered in November 2012 that these devices all included undocumented operating system accounts that could be used to access the appliances remotely over the Internet via secure shell (SSH).

Viehbock found that the username "product" could be used to login and gain access to the device's MySQL database (root@localhost) with no password, which he said would allow an attacker to add new users with administrative privileges to the appliances. SEC Consult found a password file containing a number of other accounts and hashed passwords, some of which were uncomplicated and could be cracked with little effort.

Continued : http://krebsonsecurity.com/2013/01/backdoors-found-in-barracuda-networks-gear/

Also:
Backdoors in many Barracuda appliances
Barracuda Networks confirms exploitable backdoors in its appliances

From the GFI Labs blog:

We've seen a number of cases wherein phishers have used compromised Twitter accounts to send direct messages (DMs) to their followers. We're now beginning to see this same tactic used in Facebook in the form of private messages (PMs), and this isn't just some spam mail in your inbox claiming you have received a "private message".

As of writing, the PM looks like this: [Screenshot]

WARNING: Your account is reported to have violated the policies that are considered annoying or insulting Facebook users.system will disable your account within 24 hours if you do not do the reconfirmation. Please confirm your Facebook account below:

[URL redacted]

Recipients can act on this message in two ways: they can click the link to confirm their account, or simply ignore the message and delete it from their message inbox. Users who do the latter are guaranteed to be safe from this sort of scam. Users who do the former, however, are led to a single site where they can enter all personal information asked from them. Below are screenshots of the pages in the order of how they will appear to users:

Continued : http://www.gfi.com/blog/phishing-scam-spreads-via-facebook-pm/

Researchers at Symantec say a massive botnet impacting Google Android users in China is built on a new, sophisticated variant of the Backscript Trojan.

Last week, researchers at Kingsoft Security identified the MDK botnet, which they stated has infected up to one million devices. According to Symantec, an analysis of the code of MDK has shown strong similarities to Android.Backscript, and they use the same certificate to sign APKs (Android Application Packages). Unlike previous versions of the malware however, this new variant uses an Advanced Encryption Standard (AES) algorithm to encrypt data in a new file.

"Once installed, the Trojan enables the attacker to remotely control users' devices, consequently allowing the attacker to harvest user data, download additional APKs, and generate nuisance adware," blogged Symantec researcher Flora Liu.

The server app.looking3g.com is used to download scripts and additional APKs, according to Liu.

Continued : http://www.securityweek.com/massive-android-botnet-built-backscript-trojan

Also: Android MDK Trojan Found Lurking in 11K Apps, Using AES Encryption