Spyware, Viruses, & Security

Alert

NEWS - February 26, 2014

by Carol~ Forum moderator / February 26, 2014 5:46 AM PST
360 million recently compromised passwords for sale online

"Login credentials from multiple services available in underground crime forums"

Underscoring the insecurity of many online dating, job, and e-mail services, security researchers said that they have tracked almost 360 million compromised login credentials for sale in underground crime forums over the past three weeks.

The haul, which included an additional 1.25 billion records containing only e-mail addresses, came from multiple breaches, according to a statement posted Tuesday by Hold Security. The biggest single list contained 105 million details, making it among the bigger online finds, the firm told Reuters. The cache included e-mail addresses that most likely served as user names and corresponding passwords. It remains unclear what service the account credentials unlock.

Continued: http://arstechnica.com/security/2014/02/360-million-recently-compromised-passwords-for-sale-online/

Related:
360 million account credentials found in the wild, says security firm
Fresh Stash of 360 Million Credentials and 1.25 Billion Email Addresses Uncovered
Post a reply
Discussion is locked
You are posting a reply to: NEWS - February 26, 2014
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: NEWS - February 26, 2014
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
IE zero-day exploit being used in widespread attacks
by Carol~ Forum moderator / February 26, 2014 6:53 AM PST

"The exploit is being distributed from many compromised websites around the world, researchers from Symantec said"

The number of attacks exploiting a yet-to-be-patched vulnerability in Internet Explorer has increased dramatically over the past few days, indicating the exploit is no longer used just in targeted attacks against particular groups of people.

The vulnerability affects Internet Explorer 9 and 10 and was publicly revealed on Feb. 13 by researchers from security firm FireEye who found an exploit for the flaw being served from the Veterans of Foreign Wars (VFW) website. Researchers from security firm Websense later reported that the same vulnerability was being exploited from the compromised website of French aerospace association GIFAS (Groupement des Industries Francaises Aeronautiques et Spatiales).

Microsoft published a security advisory about the vulnerability, which is tracked as CVE-2014-0322, and released a "Fix It" tool as a temporary workaround. However, the company has not yet released a regular patch through the regular Windows update channel.

Continued : http://www.computerworld.com/s/article/9246603/IE_zero_day_exploit_being_used_in_widespread_attacks

@ Symantec: Internet Explorer 10 Zero-Day Vulnerability Exploited in Widespread Drive-by Downloads

Collapse -
New Virus Spreads Like The Common Cold - Via WiFi
by Carol~ Forum moderator / February 26, 2014 6:54 AM PST

It started in the laboratory of a university in England. An airborne virus was cultivated. One that could spread like the common cold in densely populated areas, infecting all it came into contact with. It was called Chameleon - and it was a computer virus.

Chameleon is the product of the University of Liverpool's School of Computer Science and Electrical Engineering and Electronics and shows for the first time that WiFi networks can be infected with a virus that moves through the air, jumping from access point to access point.

WiFi access points have long been known to be potentially weak spots onto networks, often left unprotected by passwords or encryption, or still using the manufacturer's or telecoms operator's default security codes. But up until now, there hasn't been a virus that could attack a WiFi network.

Continued : http://www.forbes.com/sites/bridaineparnell/2014/02/26/new-virus-spreads-like-the-common-cold-via-wifi/

Related: Wi-Fi 'virus' could be used to attack wireless access points, researchers discover

Collapse -
Are you sure you want to unsubscribe from our mailings?
by Carol~ Forum moderator / February 26, 2014 6:54 AM PST

Kaspersky Lab Weblog:

Spammers are relentless in their attempts to bypass anti-spam filters and confuse recipients of spam. Recently we detected a mass mailing disguised as an automated reply to a request to unsubscribe from a news blog. The authors noted their regret at losing one of their subscribers and asked if the user really wanted to unsubscribe. [Screenshot]

Phrases like "We regret your decision to unsubscribe" do indeed appear in responses sent following requests to unsubscribe. However, there followed some unusual text in which the senders also regretfully informed the recipient that they had also unsubscribed him from other information mailings on subjects such as:

Continued : http://www.securelist.com/en/blog/8186/Are_you_sure_you_want_to_unsubscribe_from_our_mailings

Collapse -
Grayware: Casting a Shadow over Mobile Software Marketplace
by Carol~ Forum moderator / February 26, 2014 6:54 AM PST

Symantec Security Response Blog:

One of the most problematic areas in mobile security today is "grayware." The dividing line between legitimate software and malware is not clearly drawn and grayware often occupies this murky middle ground. Grayware is applications that may not have any recognizable malware concealed within them but can nevertheless be in some way harmful or annoying to the user. For example, it might track their location, Web browsing habits or serve up unwanted ads. In many cases, grayware authors often maintain a veneer of legitimacy by outlining the application's capabilities in the small print of the software license agreement.

Grayware is not a new phenomenon and it first began to attract attention well over a decade ago when unwanted extras, such as spyware, were often packaged with free applications. As PC users became more savvy and aware of what they install, the controversy died down. However, the arrival of the new generation of smartphones has created a brand new software market. Consumers are prone to treat the mobile software market with the same degree of naivety that they may have treated the desktop space ten or fifteen years ago. Mobile apps are often installed with little or no consideration of what they may be capable of.

Continued : http://www.symantec.com/connect/blogs/grayware-casting-shadow-over-mobile-software-marketplace

Collapse -
Security Change Spam: "Your Hotmail Account Services Has ...
by Carol~ Forum moderator / February 26, 2014 6:57 AM PST
... Expired"

"Malwarebytes Unpacked" Blog:

You may have survived the Great Hotmail to Outlook changeover of 2013, but be advised there are emails doing the rounds which want to cause a Hotmail handover of their own.

From the spam traps: [Screenshot]

The email reads as follows:

Security Change

Dear User,

All Hotmail customers have been upgraded to Outlook.com. Your Hotmail Account services has expired.

Due to our new system upgrade to Outlook. In order for it to remain active follow the link Sign in Re-activate your account to Outlook. account.live.com

Thanks,
The Microsoft account team


Clicking the link won't immediately take potential victims to the phish, because the people behind the email managed to slightly bork the clickable link, and by "slightly bork" I mean "completely destroy":

Continued : http://blog.malwarebytes.org/fraud-scam/2014/02/security-change-spam-your-hotmail-account-services-has-expired/
Collapse -
Mac malware spread disguised as cracked versions of ...
by Carol~ Forum moderator / February 26, 2014 7:01 AM PST
... Angry Birds, Pixelmator and other top apps

Graham Cluley @ the ESET "We Live Security" blog.

Mac users are warned not to download pirated software from file-sharing peer-to-peer networks, as ESET researchers have discovered Bitcoin-stealing malware being spread via cracked apps.

The malware, OSX/CoinThief, was first discovered earlier this month by researchers at SecureMac, and was found to steal login credentials related to various Bitcoin-related exchanges and wallet sites via malicious browser add-ons.

Their researchers found that the malware had been disguised as trojanised versions of Bitcoin Ticker TTM (To The Moon), BitVanity, StealthBit and Litecoin Ticker, and distributed through popular download sites including Download.com and MacUpdate.com.

However, the malware experts at ESET labs have also seen OSX/CoinThief spread through torrents as cracked versions of the following popular Mac OS X applications:

Continued : http://www.welivesecurity.com/2014/02/25/mac-malware-cracked-angry-birds/

Related: Bitcoin-Stealing Mac Malware Disguised as Angry Birds Game
Popular Forums
icon
Computer Help 47,885 discussions
icon
Computer Newbies 10,322 discussions
icon
iPhones, iPods, & iPads 3,188 discussions
icon
Security 30,333 discussions
icon
TVs & Home Theaters 20,177 discussions
icon
HDTV Picture Setting 1,932 discussions
icon
Phones 15,713 discussions
icon
Windows 7 6,210 discussions
icon
Networking & Wireless 14,510 discussions

Tech for the holiday

Find recipes for July 4 with these foodie apps

The Fourth of July means fireworks, fun and food. If you're planning on a barbecue this weekend, we've got the apps to help you find holiday-inspired recipes.