Spyware, viruses, & security forum: NEWS - March 15, 2013

Apple Pushes Massive Wave of Security Updates Alongside OS X 10.8.3

Apple on Thursday released Mac OS X Mountain Lion v10.8.3 along with a wave of security updates spanning numerous products ranging from the operating system kernel to many components and applications and its Safari Web browser.

Available immediately, OS X v10.8.3 and the associated security update address security flaws in Apache, Identity Services, ImageIO, Messages, Messages Server, PostgreSQL, Podcast Producer Server, QuickTime, Ruby and more.

The software update also addresses an interesting issue (CVE-2013-0967) in CoreTypes that allows a malicious website to launch a Java application automatically even if the Java plug-in is disabled.

In addition to the software updates, Apple addressed an unauthorized digital certificates issue that linked back to Turkish certificate authority, TURKTRUST in an incident that was reported in January.

Continued : http://www.securityweek.com/apple-pushes-massive-wave-security-updates-alongside-os-x-1083

Related :
Apple Addresses 22 OS X Security Issues with First 2013 Update
Apple tears itself away from iThings to squash Mac OS X bugs
Apple ships OS X 10.8.3 - 11 remote code execution vulns patched, Snow Leopard and Lion get fixes too
About the Security Content of OS X Mountain Lion v10.8.3

See Vulnerabilities / Fixes:
Apple Mac OS X Multiple Vulnerabilities
Apple Safari Multiple Vulnerabilities

.. via rogue Apache modules

SophosLabs has been tracking an infection of Mal/Iframe-AL on Seagate's blog since late February.

SophosLabs informed Seagate of the issue back in February, but at the time of writing the site remains infected.

Two weeks ago, Fraser Howard reported how rogue Apache modules were pushing iFrame injections with the intention of driving traffic to the notorious Blackhole exploit kit.

SophosLabs has seen countless victims of this attack, with Mal/Iframe-AL remaining the most prevalent of the web threats encountered.

Seagate is just one of the high profile examples of a site that has been hit. [Screenshot]

Continued : http://nakedsecurity.sophos.com/2013/03/14/seagate-rogue-apache-modules/

It's not often that one has the opportunity to be the target of a cyber and kinetic attack at the same time. But that is exactly what's happened to me and my Web site over the past 24 hours. On Thursday afternoon, my site was the target of a fairly massive denial of service attack. That attack was punctuated by a visit from a heavily armed local police unit that was tricked into responding to a 911 call spoofed to look like it came from my home.

Well, as one gamer enthusiast who follows me on Twitter remarked, I guess I've now "unlocked that level."

Things began to get interesting early Thursday afternoon, when a technician from Prolexic, a company which protects Web sites (including KrebsOnSecurity.com) from denial-of-service attacks, forwarded a strange letter they'd received earlier in the day that appeared to have been sent from the FBI. The letter, a copy of which is reprinted in its entirety here, falsely stated that my site was hosting illegal content, profiting from cybercriminal activity, and that it should be shut down. Prolexic considered it a hoax, but forwarded it anyway. I similarly had no doubt it was a fake, and a short phone call to the FBI confirmed that fact.

Around the same time, my site came under a series of denial-of-service attacks, briefly knocking it offline. While Prolexic technicians worked to filter the attack traffic, I got busy tidying up the house (since we were expecting company for dinner). I heard the phone ring up in the office while I was downstairs vacuuming the living room and made a mental note to check my voicemail later. Vacuuming the rug near the front door, I noticed that some clear plastic tape I'd used to secure an extension cord for some outdoor lights was still straddling the threshold of the front door.

Continued : http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/#more-19437

.. Information from Customers

Computer and furniture leasing company Aaron's took 185,000 e-mails with highly sensitive information from its customers via spyware installed on the leased machines.

The spyware application provided by DesignerWare came preinstalled on the laptops leased through Aaron's. It was designed to allow the rental company to kill the laptop remotely if customers fell beyond payment, but also was able to record keystrokes, take screenshots or use the webcam to take pictures without the user's consent. The collected information was then sent to base via e-mail.

According to The Associated Press, Aaron's received about 185,000 such e-mails containing pictures of nude children, people having sex, screenshots with Social Security numbers, social media and email passwords, and customer keystrokes.

The case raised concerns last year, when it was moved to the Federal Trade Commission, but lack of cooperation from the leasing company amplified it into a class action lawsuit.

Continued : http://www.hotforsecurity.com/blog/computer-leasing-company-harvested-185000-e-mails-with-private-information-from-customers-5664.html

An ongoing malicious email campaign is masquerading as an unpaid invoice, a Kaspersky Lab researcher said Thursday.

In this recurring campaign, cyber-criminals are sending out emails with a malicious PDF attachment masquerading as notices and reminders to pay overdue bills, Ben Godwood, a researcher with Kaspersky Lab, wrote on the SecureList blog on Thursday. The email campaign appears to have been ongoing since November, and follow a set schedule, hitting victim inboxes either on the 4th or the 21st of the month.

Kaspersky Lab detected the latest batch of specially crafted PDF messages on March 4, Godwood said. Most of the emails were sent from German IP addresses, and appear to have been sent from compromised home computers, Godwood said. The attack emails were mostly sent from German IP addresses in the latest iteration of the campaign, Godwood said, previous messages appear to have been sent from infected bots in other countries.

Continued : http://www.securityweek.com/ongoing-invoice-attack-campaign-delivers-booby-trapped-pdfs

If you've yet to update Windows in recent days, do so now - especially if you have a proclivity towards plugging in random USB drives on your computer, or if there's someone else who uses your computer at home. A recently issued Windows update contains a patch that fixes a Windows vulnerability that allows your system to be exploited by malware introduced by thumb drives.

When compromised flash drives are plugged into a computer, the system can automatically execute malicious codes that could install viruses and keyloggers on your computer, giving attackers remote access to your sensitive files and data. Companies with huge networks of interconnected computers are the most at risk, as all it takes to be infected is one not-so-tech-savvy worker to use a USB stick of unknown origin. A notable example of a security breach caused by an infected thumb drive is the 2008 widespread virus infection at a U.S. military base in the Middle East. The malware that came from an unknown thumb drive plugged into a laptop went on to infect the base's whole network, even its computers containing classified information.

Continued : http://www.digitaltrends.com/computing/microsoft-usb-vulnerability-patch/

Also:
Microsoft Patches Hollywood-Style USB Windows Exploit
New Microsoft patch purges USB bug that allowed complete system hijack