NEWS - June 21, 2013

Bruce Scheier @ his "Schneier on Security" Blog:

This article, on the cozy relationship between the commercial personal-data industry and the intelligence industry, has new information on the security of Skype.

'Skype, the Internet-based calling service, began its own secret program, Project Chess, to explore the legal and technical issues in making Skype calls readily available to intelligence agencies and law enforcement officials, according to people briefed on the program who asked not to be named to avoid trouble with the intelligence agencies.

Project Chess, which has never been previously disclosed, was small, limited to fewer than a dozen people inside Skype, and was developed as the company had sometimes contentious talks with the government over legal issues, said one of the people briefed on the project. The project began about five years ago, before most of the company was sold by its parent, eBay, to outside investors in 2009. Microsoft acquired Skype in an $8.5 billion deal that was completed in October 2011.

A Skype executive denied last year in a blog post that recent changes in the way Skype operated were made at the behest of Microsoft to make snooping easier for law enforcement. ....'

Continued : http://www.schneier.com/blog/archives/2013/06/new_details_on.html

Also:
Skype 'Explored Making Government Snooping Easier'
Report: Skype set up Project Chess to enable official snooping

Researchers at FireEye have spotted a malware campaign using Google Docs to redirect victims and evade callback detection mechanisms.

Connecting the malicious server via Google Docs, offers the malicious communication the protection provided by the legitimate SSL offered by Google, explained FireEye researcher Chong Rong Hwa.

"One possible way to examine the SSL traffic is to make use of a hardware SSL decrypter within an organization," the researcher noted. "Alternatively, you may want to examine the usage pattern of the users. Suppose a particular user accesses Google Docs multiple times a day, the organization's Incident Response team may want to dig deeper to find out if the traffic is triggered by a human or by malware."

According to FireEye, the campaign uses on spear-phishing attacks targeting countries such as Laos, Singapore and Cambodia.

The document used in this attack exploits CVE-2012-0158, and creates a decoy document and a malware dropper named exp1ore.exe, blogged Chong Rong Hwa, a researcher at FireEye. This dropper will then drop wab.exe and wab32res.dll inside the temp folder. By running wab.exe, the malicious DLL will be loaded.

Continued : http://www.securityweek.com/google-docs-abused-protect-malicious-traffic

From the Symantec Security Response Blog:

FakeAV software is a type of scam using malware that intentionally misrepresents the security status of a computer and attempts to convince the user to purchase a full version of the software in order to remediate non-existing infections. Messages continue to pop up on the desktop until the payment is made or until the malware is removed. This type of fraud, which typically targets computers, began several years ago and has now become a household name. The scam has evolved over time and we are now seeing FakeAV threats making their way onto Android devices.

One interesting variant we have come across, detected by Symantec as Android.Fakedefender, locks up the device just like Ransomware. Ransomware is another well-known type of malware that takes a computer hostage, by denying the user access to their files for example, until a payment/ransom is handed over. [Screenshot: FakeAV Android app]

Once the malicious app has been installed, user experience varies as the app has compatibility issues with various devices. However, many users will not have the capability to uninstall the malicious app as the malware will attempt to prevent other apps from being launched. The threat will also change the settings of the operating system.

Continued (with video) here: http://www.symantec.com/connect/blogs/fakeav-holds-android-phones-ransom

Customers of Argos, the popular UK retailer, are warned about a fake Facebook page that scammers use to harvest Facebook "Likes."

According to Hoax Slayer, the bogus Argos page instructs users to "Like" and share the scam, promising them HD TVs.

Of course, no one gets to see any of the promised prizes. Instead, the scammers can make a hefty profit if they trick a large number of users into liking their Facebook page.

That's because they can later sell the page on the black market to other fraudsters who can use it to advertise their shady services and products, or simply to distribute other scams.

Argos is aware of the bogus Facebook page.

Continued : http://news.softpedia.com/news/Fake-Argos-Facebook-Page-Promises-HD-TV-s-in-Exchange-for-Likes-362584.shtml

To end the week on a lighter note...........

Compliments of Bruce Schneirer:

A fine piece: "A Love Letter to the NSA Agent who is Monitoring my Online Activity."

A similar sentiment is expressed in this video

http://www.schneier.com/blog/archives/2013/06/love_letter_to.html