Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Alert

NEWS - September 12, 2014

Sep 12, 2014 1:45AM PDT

Seth Rosenblatt @ CNET Security News...

Disconnect Mobile yanked again from Google Play

Disconnect Mobile returned to the Google Play Store yesterday for the first time since Google banned it in August, but overnight Google kicked the app out again.

CNET received an email from Disconnect co-founder Casey Oppenheim on Tuesday morning about the ousting.

"Our app got removed by Google again at around 2 a.m. [PT]," he said. "Ugh."

Disconnect Mobile, a malicious tracking and malicious advertising prevention app, was originally banned in August for violating section 4.4 of the Google Developer Distribution Agreement. That section prohibits Android apps hosted in Google Play from interfering with other apps or Android services.

Continued : http://www.cnet.com/news/disconnect-mobile-yanked-again-from-google-play/

Discussion is locked

- Collapse -
Does this mean Firewalls, anit-adware apps are in violation?
Sep 12, 2014 1:52AM PDT

Hmm, I wonder if that's why so many apps have adverts in them. No ad block apps are allowed?
Bob

- Collapse -
Good point ! So glad you brought it up !
Sep 12, 2014 2:23AM PDT

I would think it applies to more than firewalls and anti-adware apps. The possibilities seem endless.

.. .and to that I add .. a double "Ugh" Happy

Carol

- Collapse -
Google: No compromise, likely massive phishing database
Sep 12, 2014 2:23AM PDT

"Usernames and passwords for millions of Google accounts leaked? Company says no."

A large text file billed as a list of usernames and passwords for more than 4.9 million Google accounts is likely a collection of credentials from different sources, not from a breach of the company's systems, Google stated on Wednesday.

The file was leaked to the Bitcoin Security board on Tuesday by a user known as "tvskit" who claimed that more than 60 percent of the passwords were good, according to translated content on Russian news site RT. Yet, in its own analysis, Google found that only 2 percent of the credentials would have worked and an even smaller number been used successfully.

"Our automated anti-hijacking systems would have blocked many of those login attempts," the company's spam and abuse team said in the analysis. "We've protected the affected accounts and have required those users to reset their passwords."

Continued: http://arstechnica.com/security/2014/09/google-no-compromise-likely-massive-phishing-database/

Related:
A List of 5 Million 'Gmail Passwords' Leaked, But There's No Need to Panic
No, Gmail was not cracked! Don't believe bogus blogs
Massive Gmail credential leak is not result of a breach
5 Million Gmail Addresses and Passwords Exposed, 'No Evidence of Compromise,' Says Google

- Collapse -
85% of apps not up to scratch on privacy, study finds
Sep 12, 2014 2:24AM PDT

A coordinated study of apps run by a group of national privacy and data protection bodies from all around the world has found that the vast majority are failing to provide adequate information on the privacy implications of using the app.

The study, conducted by the Global Privacy Enforcement Network (GPEN), looked at over 1200 apps with participants each tasked with looking at a handful developed in, or targeting users in, their own region.

It found that only 15% provided clear information on how the app gathers, uses and shares private data on the user, to an extent that the user could feel confident in their understanding of how it works.

Continued : http://nakedsecurity.sophos.com/2014/09/12/85-of-apps-not-up-to-scratch-on-privacy-study-finds/

Related:
Users in Dark about Permissions Granted to Mobile Apps
Data protection authorities find privacy lapses in majority of mobile apps

- Collapse -
What security experts think about Apple Pay
Sep 12, 2014 2:26AM PDT

Apple announced Apple Pay, a new category of service that works with iPhone 6 and iPhone 6 Plus through a NFC antenna design, a dedicated chip called the Secure Element, and the security and convenience of Touch ID.

Apple Pay supports credit and debit cards from the three major payment networks, American Express, MasterCard and Visa, issued by the most popular banks including Bank of America, Capital One Bank, Chase, Citi and Wells Fargo.

Below are some of the comments that Help Net Security received from the security community.

Continued : http://www.net-security.org/secworld.php?id=17351

Related: How Apple Pay could make the Target and Home Depot breaches a thing of the past

- Collapse -
TorrentLocker Unlocked! Buggy Ransomware Allows Easy ..
Sep 12, 2014 2:30AM PDT
... Recovery for Victims

The Tripwire "State of Security" Blog:

Far from being the geniuses that the media like to portray, malicious hackers can make mistakes just as well as the next person.. and that's certainly true of whoever was behind the TorrentLocker ransomware.

Finnish boffins Taneli Kaivola, Patrik Nisen and Antti Nuopponen of Nixu Oy have discovered that there is a way for victims of TorrentLocker to recover the contents of their encrypted files, without handing any money over to the criminals behind the attack.

According to a blog post published by the trio, it is child's play to recover your files if you have an unencrypted backup version of just one of the files that has been meddled with by TorrentLocker.

Continued : http://www.tripwire.com/state-of-security/security-data-protection/torrentlocker-unlocked/
- Collapse -
76% of consumers worry about call centre security
Sep 12, 2014 2:37AM PDT
Consumers worried about call centre security, survey reveals

We're all becoming far too familiar with stories of large organisations being hacked and sensitive information being stolen.

In recent weeks more alarming stories of retailers like Home Depot and Supervalu being infected by point-of-sale malware that secretly siphons away payment card information, and transmits it into the hands of online criminals.

But you would be mistaken to think that the only organisations who might be putting our private information at risk from attack are retailers, or that the only threat is external hackers.

For instance, what about the increasing number of companies who run call centres, where thousands of staff members may have access to your personal account information?

Continued : http://grahamcluley.com/2014/09/call-centre-security-survey/
- Collapse -
Uncovering Malicious Browser Extensions in Chrome Web Store
Sep 12, 2014 5:19AM PDT

TrendLabs Security Intelligence Blog:

Months ago, Google published a blog post informing users of Google Chrome that they cannot install browser extensions from third parties. The reason: security. By only permitting extensions from official Chrome Web Store, Google claims they would be able to police these extensions in order to prevent malicious ones.

Unfortunately, such tactics aren't enough to deter cybercriminals. We have previously reported about a malware that manages to bypass this feature and install a malicious browser extension. We recently found that cybercriminals are also placing their malicious extensions in the official Web Store.

Spammed Facebook Messages

The first step of this particular attack begins on social media. A spammed message circulated on Facebook, with a link to a video related to drunk girls. Should the recipient click the link, he will be redirected to a site mimicking YouTube. A notification will appear stating that a particular Chrome extension must be installed so that the video can be viewed. [Screenshot]

Continued : http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-malicious-browser-extensions-in-chrome-web-store/

- Collapse -
US Government Threatened Yahoo With Massive Fines To Force..
Sep 12, 2014 5:19AM PDT
... NSA Compliance

Court documents unsealed Thursday reveal how the U.S. government forced Yahoo to cooperate with NSA's PRISM bulk Internet surveillance program in 2008 by threatening to fine the company $250,000 daily if it refused to turn over user data.

The Washington Post reports the web giant tried to fight the order it believed to be unconstitutional but ultimately failed to do so, making Yahoo one of the first Internet companies in a list including Google, Facebook, Microsoft, Apple and more to become complicit in the signals intelligence agency's net-wide warrantless data collection program.

"The released documents underscore how we had to fight every step of the way to challenge the U.S. government's surveillance efforts," Yahoo General Counsel Ron Bell said in a Tumblr post Thursday.

Continued : http://dailycaller.com/2014/09/11/u-s-government-threatened-yahoo-with-massive-fines-to-force-nsa-compliance/

Related: Documents in Long-Running Yahoo FISC Challenge Case Published
- Collapse -
Stupid Spammer Tricks - Reversing Characters
Sep 12, 2014 5:20AM PDT

Trustwave's "SpiderLabs" Blog:

Spammers engaged in phishing attacks constantly try to get their emails past spam filters. They try many different tactics, and these can include taking advantage of HTML coding characteristics. These HTML tricks can make the email look normal when rendered in a mail client, but the actual raw text is completely different. This can let it bypass spam content filters that are looking for the normal text. Here's an example of a normal looking email: [Screenshot]

This looks like a possibly real email notifying you about a problem with your account ("real", except for the grammatically poor "why you received this email ?"). This is really a phish using the HTML "Right-to-left override" code (http://www.fileformat.info/info/unicode/char/202e/index.htm). Here's the raw HTML markup: [Screenshot]

Continued : http://blog.spiderlabs.com/2014/09/stupid-spammer-tricks-reversing-characters.html

- Collapse -
Turning the tables on "Windows Support" scammers by ..
Sep 12, 2014 8:26AM PDT
... compromising their PCs

"Metasploit dev releases zero-day exploit as a deterrent against offshore conmen"

Tech support scams are nothing new—we first went in-depth almost two years ago on "scareware scammers" who cold-call unsuspecting victims and try to talk them into compromising their computers by installing remote control applications and handing the keys over to the scammers.

We even managed to engage with one for a protracted length of time, with deputy editor Nate Anderson playing the role of a computer neophyte and recording the entire mess. But one developer has taken things a step further, producing a tool that will enable you to fight back if targeted—if you don't mind a bit of bad acting yourself.

Matt Weeks is one of the developers who contributes code to the open source Metasploit Project, a sprawling and continually updated security framework that functions as a repository for software vulnerabilities and is frequently used as a Swiss Army Knife for penetration testing. Weeks has published a long report on his site detailing how he was able to reverse-engineer the encrypted communications protocol used by Ammyy Admin, one of the most popular remote control apps used by tech support scammers, and then use that knowledge to ferret out a vulnerability in the Ammyy Admin application

Continued : http://arstechnica.com/security/2014/09/turning-the-tables-on-windows-support-scammers-by-compromising-their-pcs/