NEWS - March 12, 2014

Apple has fixed a slew of vulnerabilities that could lead to code execution on the iPhone, along with a number of other security vulnerabilities in the latest version of its mobile operating system, iOS 7.1. The new release comes just a little more than two weeks after Apple released iOS 7.06 to fix the SSL certificate validation error.

Unlike that release, which fixed just the one vulnerability, significant though it was, iOS 7.1 is a major security release containing patches for a large number of vulnerabilities in a bunch of different components. Webkit, the framework underlying Safari, got a major security upgrade in iOS 7.1, with Apple fixing 19 separate memory corruption issues. Nearly half of those vulnerabilities were discovered by the Google Chrome security team, and many of the 19 bugs were identified last year.

Among the code-execution vulnerabilities patched in the new release are a pair of buffer overflows in ImageIO, a library that enables the reading and writing of multiple image formats. Apple also fixed a code-execution flaw in the kernel caused by an out of bounds memory access issue in the ARM ptmx_get_ioctl function. There also is a fix for a vulnerability in the way that Office Viewer handled certain Microsoft Word documents.

Continued : http://threatpost.com/apple-ios-7-1-fixes-more-than-20-code-execution-flaws/104705

Related: iOS 7.1 released, patching bugs and fixing the White Screen of Death

See Vulnerabilities / Fixes: Apple iOS Multiple Vulnerabilities

Last week Microsoft has announced that today's Patch Tuesday will include a fix for the critical IE zero-day vulnerability that was found exploited in watering hole attacks earlier this year - and none too soon, as a number of bad actors have been using the same exploit code in other similar attack since then.

Initially, the exploit was used to compromise the visitors of a fake French aerospace association GIFAS site and the legitimate but compromised website of the US Veterans of Foreign Wars. Seculert researchers believe that the two attacks weren't executed by the same group, but that the two groups bought the attack code from the same black market seller.

But in the last month or so, Websense has detected three more websites compromised to either redirect to the exploit or to serve it, as the exploit code has obviously ended up in the public domain.

Continued : http://www.net-security.org/secworld.php?id=16503

Related: Hackers Milk IE Zero Day Before Patch

* * * * * * * * * * * * * *

Critical Internet Explorer zero-day vulnerability patched by Microsoft

Graham Cluley @ ESET's' "We Live Security" Blog:

For this month's Patch Tuesday, Microsoft has released five bulletins, tackling a total of 23 different security holes in Microsoft Windows, Internet Explorer and Silverlight.

The most important security update is undoubtedly the one for Internet Explorer, applicable for virtually all versions of the browser, which includes a fix for a zero-day vulnerability (CVE-2014-0322) that has already been exploited by hackers in targeted attacks against some organisations.

Last month, Microsoft released a temporary fix it tool for the problem, so a proper patch has been keenly anticipated.

Details of how to take advantage of the security weakness have already been publicised on the net, increasing the chances of further attacks if computer owners do not take action.

So, what's the danger if you leave your computer unpatched?

Continued : http://www.welivesecurity.com/2014/03/12/critical-internet-explorer-zero-day/

For the second time since Aug. 2013, online retailer NoMoreRack.com has hired a computer forensics team after being notified by Discover about a potential breach of customer card data, KrebsOnSecurity has learned.
Over the past several weeks, a number of banks have shared information with this reporter indicating that they are seeing fraud on cards that were all recently used by nomorerack.com customers. Turns out, nomorerack.com has heard this as well, and for the second time in the last seven months has called in outside investigators to check for signs of a digital break-in.

Vishal Agarwal, director of business development for the New York City-based online retailer, said the company was first approached by Discover Card back in August 2013, when the card association said it had isolated nomorerack.com as a likely point-of-compromise.

"They requested then that we go through a forensics audit, and we did that late October by engaging with Trustwave," Agarwal said. "Trustwave came out with a report at end of October saying there was no clear cut evidence that our systems had been compromised. There were a few minor bugs reported, but not conclusive evidence of anything that caused a leakage in our systems."

Continued: http://krebsonsecurity.com/2014/03/nomorerack-com-probes-possible-card-breach/

"Malwarebytes Unpacked" Blog:

In yet another method for cyber criminals to utilize the world's most popular social networks for their own nefarious purposes, it appears a trojan is circulating through Facebook, stealing accounts and (probably) taking creds.

Thanks to the vigilant mind of Malwarebytes User, Showbizz, we were able to take a look at this new threat and what it could mean for the rest of the net.

Here is how it works:

1, User gets a Facebook instant message from a friend of their's, which includes the words 'lol' and a file waiting to be downloaded.
2. The user downloads the file because they can assume it can be trusted. The filename matches the usual filename of a photo: 'IMG_xxxx'.zip.

Continued : http://blog.malwarebytes.org/security-threat/2014/03/malicious-messages-foray-facebook/

"Malwarebytes Unpacked" Blog:

Most experts agree the best way to stay safe from Android malware is to stick to trusted sources-specifically the Play Store.

Unfortunately, those sources can sometimes be compromised. In the last week there have been two malware families found in Google's Play Store.

Dendroid

The first one, found by Lookout Security, is a remote administration tool called Dendroid. This particular malware is a variant of the publicly available remote tool AndroRAT.

Dendroid was advertised as "Parental Control" in the Play Store, which is a surprising name as they aren't really hiding the RAT functionality. There were minimal installs, less than 50, and is the only app-to date discovered in the Play Store with the Dendroid functionality. [Screenshot]

This Play Store version of Dendroid was discovered only a couple of days after Dendroid was uncovered from the underworld by Symantec, which means Google was unaware of the malicious code at the time of it being uploaded to the Play Store.

Continued : http://blog.malwarebytes.org/mobile-2/2014/03/malware-found-in-google-play-store/