Welcome to this week’s security review, which includes a detailed look at a new video scam sweeping Facebook and the return of a data-stealing malware dubbed Qbot.
The post The security review: Facebook scam, webcam security & Qbot appeared first on We Live Security.
Last March, we reported on Operation C-Major, an active information theft campaign that was able to steal sensitive information from high profile targets in India. The campaign was able to steal large amounts of data despite using relatively simple malware because it used clever social engineering tactics against its targets. In this post, we will focus on the mobile part of their operation and discuss in detail several Android and BlackBerry apps they are using. Based on our investigation, the actors behind Operation C-Major were able to keep their Android malware on Google Play for months and they advertised their apps on Facebook pages which have thousands of likes from high profile targets.
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
“Operation C-Major” Actors Also Used Android, BlackBerry Mobile Spyware Against Targets
In this research note, we analyze a malware campaign targeting Hong Kong democracy activists. Two new malware families are used in the campaign that we name UP007 and SLServer. Previous reports have shown overlap in the tactics, tools, and procedures used in this campaign in other operations targeting groups in Burma, Hong Kong, and the Tibetan community.
The post Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns appeared first on The Citizen Lab.
How secure is the healthcare ecosystem? Following a recent spate of breaches in the sector, we set out to determine the state of its cybersecurity.
The post Cybersecurity checkup: New Ponemon study reveals how healthcare sector is doing appeared first on We Live Security.
The last week has been characterized by the coming back (again) of yet another wave of Retefe mal ...(more)...
I just had to block a couple of IP addresses from access to our site because they flooded it with ...(more)...
Tippingpoints Zero Day Initiative made two vulnerabilities for Quicktime in Windows public yester ...(more)...
 |
|
| It’s pretty simple to understand where a file goes when you save it on your PC. It lives on your hard drive, possibly housed in a set of folders you’ve created and organized yourself. That file is only stored on your computer, unless you decide to email it to yourself or save it on an […]
Categories: Tags: cloud securitycloud storagethe cloud |
 |
|
| Thank you for your feedback on our PUP friday series. A list of changes based on that and some Q&A about PUPs.
Categories: Tags: feedbackPUP Fridayresultssurvey |
 |
|
| Showing an alternative method to recover a system from the Petya ransomware, including a video by malware analyst Hasherezade.
Categories: |
[Thanks to Felix aka @nexusnode for inspiring this post. Also, see his blog post [1] for more det ...(more)...
 |
|
| A compromised nude leak forum, dubious adverts, Malvertising, Ransomware and more besides - this one has it all.
Categories: Tags: APKhackhackedhackingleakmalvertisingMobilemobile securityransomware |
Apple customers are prime targets for cyberattacks as they are more likely to have a high disposable income, a security expert has suggested.
The post Scammers target Apple customers for bigger rewards appeared first on We Live Security.
The FBI has issued a warning on the dramatic increase of Business Email Compromise (BEC) scams, swindling over US$2.3 billion from companies worldwide, notably the US and Europe. The scams do not discriminate, with targets ranging from small businesses to large corporations. All the perpetrators need is the company executive’s email address (or someone close, like their personal assistant) and the ability to make a convincing fake email.
This kind of scam, where fraudsters identify themselves as high-level executives, is also known as “CEO Fraud”. It has been around for quite a while, targeting big companies mainly from US and Europe, with the rest in Australia and other regions:
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
My video, My first video, Private video: Don’t fall for this Facebook scam, which is infecting accounts around the world with a very high rate of success.
The post My video, My first video, Private video: Don’t fall for this Facebook scam appeared first on We Live Security.
Earlier this week, PFSense 2.3 was released ...(more)...
13 security bulletins were released in this month’s Patch Tuesday addressing vulnerabilities in Internet Explorer, Microsoft Edge, Microsoft Office, and Microsoft XML Core Services, among others. Out of these bulletins, six are rated as ‘Critical’ while seven are tagged as ‘Important.’ Both MS16-037 and MS16-038 which fixed vulnerabilities in Internet Explorer and Edge respectively, could allow...
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
April 2016 Patch Tuesday Releases 13 Security Patches; Addresses the Badlock Vulnerability
Security researchers have detected a new, updated strain of the data-stealing trojan Qbot that is “harder to detect and intercept”.
The post Qbot returns: New strain of data-stealing malware detected appeared first on We Live Security.
April 13, 2016
The infection begins with the ELF file, which is detected by Dr.Web as Linux.Downloader.77. It is noteworthy that this application is initially designed to send out UDP packets to a specified address. Linux.Downloader.77 is a trojanized version of this program. A potential victim downloads this utility and runs it on their computer by themselves. Then it prompts the user to grant it root privileges, without which its operation is impossible. Such flood programs are often able to execute additional covert functions—for example, download other dangerous applications from the Internet. Linux.Downloader.77 is not an exception.
Once Linux.Downloader.77 gets root access to the system, it downloads another script, Linux.Downloader.116, from the server and runs it. This script, in turn, downloads the main module of Linux.BackDoor.Xudp.1, saves it as /lib/.socket1 or /lib/.loves, locate the autorun script in the /etc/ folder under the name of rc.local, and enables the Trojan’s autorun in the cron job scheduler. In addition, while the Trojan is being installed to the system, the contents of the iptables utility is cleared.
Once launched, Linux.BackDoor.Xudp.1 decrypts configuration data, which is hard-coded in its body and is necessary for its correct operation, and sends a detailed information about the infected computer to the server. Then it runs three separate threads. In the first one, the backdoor uses HTTP protocol. The Trojan informs the server that it has been launched. The server sends an encryption key, information about the server to which requests should be sent, and a port number. After that, Linux.BackDoor.Xudp.1 periodically sends requests to the specified server, expecting to get a command. Supposedly, the Trojan can use this feature to update itself. All incoming instructions are encrypted. To decrypt them, the Trojan generates a special key.
In the second thread, Linux.BackDoor.Xudp.1 also waits for instructions from the server but uses UDP protocol. In the third one, the Trojan periodically sends a specific datagram to the server in order to inform that it is still active.
Security researchers registered that Linux.BackDoor.Xudp.1 can continuously send various requests to the specified remote server, carry out DDoS attacks, and execute arbitrary commands. In addition, it can scan ports within a specified range of IP addresses, run certain files, send any file to cybercriminals, and execute other functions. According to Doctor Web analytics, this Trojan is presumably in process of development, because its new modifications appear on a regular basis.
Its counterparts, Linux.BackDoor.Xudp.2 and Linux.BackDoor.Xudp.3, are, in fact, improved versions of Linux.BackDoor.Xudp.1. However, they can differ from each other by the name under which the Trojans are saved to the system, amount of information about the computer they send to the server, or by a set of commands they can execute. Dr.Web for Linux successfully detects all these malicious programs, so they do not pose any threat to our users.
California hospital pays the largest sum per plaintiff in history for its inability to secure the patients’ medical data.
The post Medical data breach leads to a record cash settlement appeared first on We Live Security.
The personal information of 44,000 FDIC customers has been breached by a former employee, who left the agency carrying the data on a personal storage device.
The post FDIC suffers ‘inadvertent’ data breach affecting 44,000 customers appeared first on We Live Security.
News about Badlock vulnerability affecting Windows computers and Samba servers, started showing up on twitter and media around 3 weeks ago. The site badlock[.]org was registered on 11th March according to WHOIS, a secure domain search engine. There has been a lot of guessing and speculation around this vulnerability. It’s time for reality check. How bad is Badlock actually?
Named vulnerabilities have resulted in being clichéd very quickly. Being a named vulnerability doesn’t qualify it as a serious widespread vulnerability. Badlock is somewhere in between.
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
 |
|
| Ransomware. So hot right now. Seems like everywhere you turn, there’s another story about a new ransomware threat. Unfortunately, this trend in cybercrime is not going away. Now here’s the bright side: As dangerous as ransomware can be, it’s not insurmountable. So instead of closing your eyes and praying it all goes away soon, take a look […]
Categories: Tags: encrypting ransomwareprevent ransomware attacksransomware |
Today, Microsoft and the SAMBA team jointly released a fix for CVE-2016-2118 , a vulnerability al ...(more)...
 |
|
| Steer clear of mails from the "BMW Lottery Department"...
Categories: Tags: 419BMWemailfakemailmoney mulescamspam |
Automated Teller Machines (ATM) are no longer just affected by the physical attempt of emptying the money safe. Now logical attacks on ATMs are slowly being recognized as an emerging threat by the security industry and law enforcement agencies. ATM malware had been detected by various researchers for a few years now and we have already seen incidents of their successful use. For this type of crime, malware, specifically targeting ATMs, is employed. The shift to the digital means of attack reveals a realization among criminal groups–that the use of malware is an easier and safer way to steal money and card information from ATMs. This tendency will only grow in the future and should make us mindful of the different pathways criminal groups have gained access to and have created for themselves.
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
Recently, FBI director James Comey revealed that he covers his webcam with tape to protect his privacy. It begs the question: How do you protect your webcam?
The post And how do you protect your webcam? appeared first on We Live Security.
 |
|
| Rokku is yet another ransomware, discovered in recent weeks. Currently, it’s most common distribution method is spam where a malicious executable is dropped by a VB script attached to an e-mail. The building blocks of Rokku reminded us of the Chimera ransomware. That’s why we decided to take a closer look, not only at the internal structure […]
Categories: Tags: ransomwareRokku |
 |
|
| A compilation of notable security news and blog posts from April 03 to April 09.
Categories: Tags: recapweekly blog roundup |
Recently a research who goes by @leo_and_stone has released a tool that will decrypt files on a P ...(more)...
 |
|
| A very persistent Tech Support Scam brought as a free installer for PC Cleaner Pro and making some money on the side if you don't fall for the scams.
Categories: Tags: Pieter Arntzscamteamviewertech support |
Welcome to this week’s security review, which includes an in-depth look at how the ransomware dubbed Locky is infiltrating computer systems.
The post The security review: Locky, Mumblehard takedown and Facebook scams appeared first on We Live Security.
Attacks against home routers have been going around for years—from malware that rigs routers to DNS rebinding attacks and backdoors, among others. Just last year one of our researchers reported a Domain Name System (DNS) changer malware that redirected users to malicious pages when they visited specific websites. This enabled cyber crooks to get hold of the...
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
Mobile Devices Used to Execute DNS Malware Against Home Routers
Porn and mobile malware; two things that can illicit the response “I didn’t know how it got there” when someone finds them. We have recently caught sight of a mobile ransomware distributed by fake adult websites. However, much like a lot of things in the adult industry, this malware doesn’t seem very logical.
This piece showcases an incident that can help users understand mobile threats and aims to boost user awareness to these threats. We believe that securing knowledge of common avenues cybercriminals use to spread mobile malware, as well as secure settings are one’s first line of defense. We also advise users to install Trend Micro Mobile Security Personal Edition as it detects malicious apps and secures devices from attacks.
Post from: Trendlabs Security Intelligence Blog - by Trend Micro
I often have to analyze malware samples on Windows machines.That is not always by choice ...(more)...
