Spyware, viruses, & security forum: NEWS - February 06, 2013

SpeedTest.net, a free service that tests the performance of Broadband connections, was compromised and made to serve malware, according to security vendor Invincea.

The situation has since been cleaned up. Details and pictures can be found here on Invincea's blog.

"The exploit analysis shows that potentially a large number of users were exposed to a Java-based exploit temporarily hosted by speedtest.net," according to Invincea. "Indicators show the exploit implemented by injected Javascript and used the "g01pack" exploit kit likely compromised speedtest.net as part of a malvertising campaign."

The exploit used a number of tactics and techniques to evade detection while exploiting the Java software plug-in, the company stated in a blog post. In addition, Invincea discovered this particular attack campaign utilized "the lesser-known" g01pack exploit kit, which is known to typically drive traffic to a landing page via malvertising where victims would be served with rogue antivirus.

Continued : http://www.securityweek.com/inside-attack-popular-broadband-analysis-site-speedtestnet

From the TrendLabs Security Intelligence Blog:

In our 2013 security predictions, Trend Micro Chief Technology Officer Raimund Genes predicted that we will be seeing new toolkits this year. True enough, there is news of an emerging exploit kit dubbed WhiteHole Exploit Kit. The name Whitehole Exploit kit is just a randomly selected name to differentiate it from BHEK. While it uses similar code as Blackhole Exploit kit, BHEK in particular uses JavaScript to hide its usage of plugindetect.js, while Whitehole does not. It directly uses it without obfuscating this.

We analysed the related samples, including the exploit malware cited in certain reports. The malware (detected as JAVA_EXPLOYT.NTW) takes advantage of the following vulnerabilities to download malicious files onto the system:

• CVE-2012-5076
• CVE-2011-3544
• CVE-2012-4681
• CVE-2012-1723
• CVE-2013-0422

Worth noting is CVE-2013-0422, which was involved in the zero-day incident that distributed REVETON variants and was used in toolkits like the Blackhole exploit kit and Cool exploit kit. Because of its serious security implication, Oracle immediately addressed this issue and released a software update, which was received with skepticism.

Continued : http://blog.trendmicro.com/trendlabs-security-intelligence/whitehole-exploit-kit-emerges/

Organized cyber criminals stole almost $11 million in two highly coordinated ATM heists in the final days of 2012, KrebsOnSecurity has learned. The events prompted Visa to warn U.S. payment card issuers to be on high-alert for additional ATM cash-out fraud schemes in the New Year.

According to sources in the financial industry and in law enforcement, the thieves first struck on Christmas Eve 2012. Using a small number of re-loadable prepaid debit cards tied to accounts that they controlled, scammers began pulling cash out of ATMs in at least a dozen countries. Within hours, the perpetrators had stolen approximately $9 million.

Then, just prior to New Year's Eve, the fraudsters struck again, this time attacking a card network in India and making off with slightly less than $2 million, investigators say.

The accounts that the perpetrators used to withdraw money from ATMs were tied to re-loadable prepaid debit cards, which can be replenished with additional funds once depleted. Prepaid card networks generally enforce low-dollar limits that restrict the amounts customers can withdraw from associated accounts in a 24 hour period. But in both ATM heists, sources said, the crooks were able to increase or eliminate the withdrawal limits for the prepaid accounts they controlled.

Continued : http://krebsonsecurity.com/2013/02/crooks-net-millions-in-coordinated-atm-heists/

Media figure Rupert Murdoch has said that cyberattacks apparently originating from China against publication The Wall Street Journal are still taking place.

Taking to Twitter, the Australian CEO of News Corp. claimed his publication was still the victim of hacking. Although no direct, substantial evidence has come to light over the attacks, the finger is being pointed at the Chinese:

Murdoch has not elaborated on the claims. The tweet comes soon after the Journal reinforced its security network in order to try and stop Chinese hackers having a poke around "for the apparent purpose of monitoring the newspaper's China coverage."

It came to light last week that the New York Times was a victim of persistent cyberattacks. The publication said that most-likely Chinese hackers had been "persistently" attacking it over the past four months, and not only managed to access the email accounts of journalists, but were also stealing credentials.

Continued : http://www.zdnet.com/murdoch-alleges-chinese-hackers-still-attacking-wsj-7000010904/

Last week security researcher HD Moore unveiled his latest paper "Unplug. Don't Play," which looked into vulnerabilities in popular Universal Plug and Play (UPnP) implementations.

What is UPnP? Paul Ducklin explained the principles and the reason behind it in his recent article about insecurity in video cameras, but the simple version is this: in my opinion, UPnP is one of the worst ideas ever.

Let's put it this way: UPnP is a protocol designed to automatically configure networking equipment without user intervention.

Sounds good, right? Until you think about it. UPnP allows things like XBoxes to tell your firewall to punch a hole through so you can play games.

UPnP also allows malware to punch holes in your firewall making access for criminals far easier.

Continued : http://nakedsecurity.sophos.com/2013/02/05/upnp-flaws-turn-millions-of-firewalls-into-doorstops/