Spyware, viruses, & security forum: NEWS - February 19, 2013

From the Kaspersky Labs Weblog:

We've recently experienced yet another case of a root certificate authority (CA from now on) losing control of its own certificates. And yet again, we have been waiting for either the CA or the browser to do something about it. This whole mess stems, once again, from both a governance and a technical problem. First, only the very same CA that issued a certificate can later revoke it. Second, although web browsers implement several techniques to check the certificate's revocation status, errors in the procedure are rarely considered hard failures. [Screenshot]

Of these, the first (and oldest) technique involves the CA creating a Certificate Revocation List (CRL). This requires the user to poll the CRL at regular intervals, download the whole list (a revision of the RFC allowed for delta updates), and use the list to verify the certificate revocation status. Since, by default policy, downloaded CRLs can be up to seven days old, it is clear that an adversary still has the possibility to use a compromised certificate. To make the situation worse, CAs normally disseminate CRLs by means of the HTTP protocol, hence replay attacks are possible. Further, even if the standard dictates otherwise, web browsers often consider failure to download the updated CRL a mere soft error, meaning that the connection will not be terminated (which makes the whole verification process useful as a seat-belt that snaps when you crash). [Screenshot]

Continued : http://www.securelist.com/en/blog/208194124/Trust_but_verify_when_CAs_fall_short

... cyberattacks

A U.S.-based security research firm says that a building associated with the Chinese military is the source of an "overwhelming" percentage of cyberattacks.

Hired by the New York Times, security firm Mandiant has released a 60-page report which alleges members of sophisticated hacking groups known as "Comment Crew" and "Shanghai Group" have been traced back to a 12-story building associated with the People's Liberation Army General Staff's 3rd Department, otherwise known as Unit 61398 in Shanghai.

The Virginia-based firm says within its latest report that although it cannot be determined if the hackers are present within the building, forensic investigations have managed to lead the security team to the unit's door. Either way, it seems likely, as founder of Mandiant Kevin Mandia told the publication:

Continued : http://www.zdnet.com/chinese-military-linked-to-overwhelming-number-of-cyberattacks-7000011484/

Also:
Chinese 'PLA 61398' army unit hacking US firms, Mandiant alleges
Unit In China's PLA Behind Massive Cyber Espionage Operation: Report
Mandiant Investigates Chinese Government-Sponsored Hackers - Video

Today, the independent testing lab AV-Test released their findings from a comprehensive review of 22 Android security apps, looking at how these portable protectors performed on handled Android devices. The competition was tight, but TrustGo and Lookout took the top slots.

The good news is that most apps faired very well in the test, with only GFI Mobile Security failing to receive AV-Test certification. Despite GFI's abysmal 71 percent detection rate for malicious software, the average detection rate across the apps was 94 percent with a median rate of 97 percent. In general, there were very few false-positive results generated during the test.

The Whole App
Of course, security companies no longer rely on mere malware identification to define their product. Many companies provide anti-theft, secure browsing, parental controls, and data encryption with their mobile apps. What's more, mobile security apps need to be unobtrusive and easy on battery life in order to actually be helpful. If it sucks up too much power, or disrupts the normal operation of the device, users will likely uninstall the app.

Continued : http://securitywatch.pcmag.com/none/308184-trustgo-and-lookout-top-android-mobile-security-test

... spyware

McAfee released the results of a new report, documenting sophisticated and complex risky apps containing multi-faceted scams, black market crimes, drive-by downloads and near-field communication threats. They identified a new wave of techniques hackers use to steal digital identities, commit financial fraud, and invade users' privacy on mobile devices. [Screenshot]

Mobile platforms have become increasingly attractive to cybercriminals as consumers live more of their digital lives on smartphones and tablets. According to IDC, mobile devices are surpassing PCs as the preferred way to access the Internet and the number of people using PCs to go online will shrink by 15 million over the next four years, while the number of mobile users will increase by 91 million.

With the mobile space becoming a more enticing platform for online mischief, the complexity and volume of threats targeting consumers will continue to increase. Using its extensive global threat intelligence network (GTI), McAfee Labs analysed mobile security data from the last three quarters.

Continued : http://www.net-security.org/secworld.php?id=14441

... Hijacks By 99 Percent

Gmail accounts are high-priority targets for attackers of all stripes, particularly spam crews and state-sponsored attackers who use them to monitor the activities of activists and journalists. Hijacking those accounts can be quite useful for spammers and malware gangs as well, but Google said that it has put security measures in place that have greatly reduced the number of successful hijack attempts.

In the last few years, the company has added a number of security systems to Gmail and its other services to help protect users' accounts. The most well-known and visible of those is the Gmail two-factor authentication option that requires users to enter a code that's either generated by an app on their mobile phones or sent via SMS, in addition to entering a password. That system helps prevent account compromises through the use of stolen passwords because even with the password, the attacker would still need the code in order to access the account. That system isn't enabled by default, however.

Continued : https://threatpost.com/en_us/blogs/google-says-gmail-security-measures-have-reduced-account-hijacks-99-percent-021913