NEWS - January 30, 2013

The developers of the VLC video player have warned of a crashing bug in the latest 2.0.5 version of the application, which might be exploited to execute arbitrary code. The issue is a problem in the ASF demuxer (libasf_plugin.*), which can be tricked into overflowing a buffer with a specially crafted ASF movie. The developers note that users would have to open that specially crafted file to be vulnerable and advise users to not open files from untrusted third parties or untrusted sites.

Another workaround is to delete the demuxer plugin - found in \VLC\plugins\demux\libasf_plugin.dll on Windows - to disable the vulnerable function. A patch has been developed which replaces the vulnerable macro with static inline code and better bounds checking, and that has been applied to the forthcoming version 2.0.6 release of VLC. Already patched versions of VLC for Windows and Mac OS X are available from the VLC nightlies site, but may have other bugs as they are ongoing development versions.

http://www.h-online.com/security/news/item/Latest-VLC-version-has-dangerous-hole-1794474.html

An unusual new strain of ransomware makes good on its threat, doing what the majority of other varieties only claim to do. The Trojan actually encrypts data on infected machines, effectively rendering certain files inaccessible to users on compromised computers in order to block removal.

This veracious new version of the otherwise well-known police ransomware Trojan is unique but only in the sincerity of its promise. According to a report by Hynek Blinka on the AVG News and Threats blog, most ransomeware campaigns deploy a familiar warning, asserting that some crime has been committed by the user and that the user's machine will remain locked down or encrypted until that user pays the fine associated with their transgression.

In most cases, the malware can be found and subsequently removed without paying the fine (which may or may not resolve the problem anyway). In this case however, Blinka has witnessed the Trojan encrypting images, documents and executables in an attempt to hinder any removal attempts. Whomever is responsible for the malware is not in the business of completely crippling machines, so Windows system files are not included in the forced encryption. Infected computers will still function for the most part, but data will be lost and many third-party programs will not work.

Continued : https://threatpost.com/en_us/blogs/new-ransomware-encrypts-victim-data-013013

Ransomware has taken a disturbing step forward by including illegal content in its demands. The German Federal Criminal Police (BKA) are warningGerman language link of a new piece of malware that accuses victims of distributing child pornography and demands payment of a fine. As is typical, the accusation is lent a spurious whiff of officialdom by displaying the logos of the German Federal Office for Information Security (BSI) and the German Society for the Prosecution of Copyright Infringement (GVU) and instructs victims to pay a €100 (approximately £85) fine to unlock their computers.

The new twist is that the malware also displays an child pornography image alongside the typical allegations that the infected computer has been used to distribute child pornography or for terrorist purposes, that it infringes copyright or has been utilised for other criminal acts. The BKA, which is roughly equivalent to the CID in the UK, and the BSI have also pointed out that saving or distributing the image would constitute illegal possession of child pornography.

Continued : http://www.h-online.com/security/news/item/BKA-malware-shocks-victims-with-child-pornography-1793910.html

You'd feel bad if a burglar broke into your house and stole your new tablet computer, for sure. But you'd probably feel worse if a slick door-to-door scammer convinced you to hand it over for a "factory recall."

You're smart; you wouldn't fall for that kind of snake oil. However, online scams that create convincing fraudulent websites can trick even smart people. That's why browsers and security suites alike now build in detection to help you avoid fraudulent "phishing" websites. A report released today by Austin-based NSS Labs reveals a surprising result: your browser alone is most likely better at phishing protection than your security suite.

A Short, Nasty Life

Phishing attacks are short-lived. To start, the scammers create a new Web page that perfectly resembles PayPal, or eBay, or your bank's website. Some even scam login pages for Facebook or online gaming. When the page is ready they use spam emails, Facebook scams, and other techniques to put it in front of as many users as possible. Within hours the new phishing URL will be blacklisted, but the scammers can fleece quite a few victims in the meantime.

Continued : http://securitywatch.pcmag.com/none/307527-browsers-beat-security-software-in-phishing-protection-test

Also: Web Browsers Beat Endpoint Products in Blocking Phishing Attacks: Report

A new discovered malware is potentially one of the most costly viruses yet discovered. Uncovered by NQ Mobile, the "Bill Shocker" (a.expense.Extension.a) virus has already impacted 620,000 users in China and poses a threat to unprotected Android devices worldwide.

The Bill Shocker is an SDK designed by malware developers that infects several of the most popular apps in China, including Tencent QQ Messenger and Sohu News. The infected versions of these apps are further distributed by third-party online app stores and retail installation channels.

Bill Shocker downloads in the background, without arousing the mobile device owner's suspicion. The infection can then take remote control of the device, including the contact list, Internet connections and dialing and texting functions. Once the malware has turned the phone into a "zombie," the infection uses the device to send text message to the profit of advertisers. In many cases, the threat will overrun the user's bundling quota, which subjects the user to additional charges.

Continued : http://www.net-security.org/malware_news.php?id=2391