NEWS - September 19, 2012

Hot on the heels of the malicious spam emails posing as Microsoft notifications about changes to Microsoft Services Agreement comes a Microsoft-themed phishing attempt.

"It has come to our attention that your Microsoft windows Installation records are out of date," claims the email. "Every Windows installation has to be tied to an email account for update. This requires you to verify your email account being the recipient of this update. Failure to verify your records will result in account suspension. Click on the Verify button below and enter your login information on the following page to Confirm your records."

By clicking on the offered link, the users are taken to a bogus website that asks them to choose their email service and login: [Screenshot]

Of course, any of the submitted credentials will end up in the phishers' hands, and the users will be redirected to a genuine Microsoft support page.

"While such phishing expeditions are all too common, this one casts a wider net than most by targeting users of several well-known email service providers rather than just one," points out Hoax-Slayer. "In fact, by including 'Other emails' as a choice on the scam website, the criminals are effectively targeting users of virtually any email service."

Continued : http://www.net-security.org/secworld.php?id=13624

"How long would it take a determined attacker to hack into Apple's iPhone 4S from scratch? A Dutch research team uses the Pwn2Own contest to provide the answer."

How long would it take a determined attacker to hack into Apple's iPhone device from scratch?

That was the intellectual challenge that drove a pair of Dutch researchers to start looking for an exploitable software vulnerability that would allow them to hijack the address book, photos, videos and browsing history from a fully patched iPhone 4S.

The hack, which netted a $30,000 cash prize at the mobile Pwn2Own contest here, exploited a WebKit vulnerability to launch a drive-by download when the target device simply surfs to a booby-trapped web site.

"It took about three weeks, starting from scratch, and we were only working on our private time," says Joost Pol (photo left), CEO of Certified Secure, a nine-person research outfit based in The Hague. Pol and his colleague Daan Keuper used code auditing techniques to ferret out the WebKit bug and then spent most of the three weeks chaining multiple clever techniques to get a "clean, working exploit."

Continued : http://www.zdnet.com/mobile-pwn2own-iphone-4s-hacked-by-dutch-team-7000004498/

Also: iPhone 4S exploited in Mobile Pwn2Own hacking contest in Amsterdam

ZeroAccess is a hugely widespread malware threat that has plagued individuals and enterprises for years. It has evolved over time to cater for new architectures and new versions of Windows.

Here at SophosLabs we have looked at previous incarnations of the ZeroAccess rootkit in depth, describing how it enslaves victim PCs, adding them to a peer-to-peer botnet which can receive commands to download further malware.

Most recently, Sophos's researchers explored how ZeroAccess took a major shift in strategy, operating entirely in user-mode memory.

Due to the continued high profile of this malware family we felt it was necessary to examine the threat in greater detail, not only the latest version of ZeroAccess, but also the ZeroAccess botnet as a whole.

SophosLabs researchers can reveal that the current version of ZeroAccess has been installed on computers over nine million times with the current number of active infected PCs numbering around one million. [Screenshot: Total Installs of ZeroAccess]

Continued : http://nakedsecurity.sophos.com/2012/09/19/zeroaccess-botnet-uncovered/

Last week, Microsoft Corp. made headlines when it scored an unconventional if not unprecedented legal victory: Convincing a U.S. court to let it seize control of a Chinese Internet service provider's network as part of a crackdown on piracy.

I caught up with Microsoft's chief legal strategist shortly after that order was executed, in a bid to better understand what they were seeing after seizing control over more than 70,000 domains that were closely associated with distributing hundreds of strains of malware. Microsoft said that within hours of the takeover order being granted, it saw more than 35 million unique Internet addresses phoning home those 70,000 malicious domains.

First, the short version of how we got here: Microsoft investigators found that computer stores in China were selling PCs equipped with Windows operating system versions that were pre-loaded with the "Nitol" malware, and that these systems were phoning home to subdomains at 3322.org. The software giant subsequently identified thousands of sites at 3322.org that were serving Nitol and hundreds of other malware strains, and convinced a federal court in Virginia to grant it temporary control over portions of the dynamic DNS provider. [Screenshot]

Microsoft was able to do that because - while 3322.org is owned by a firm in China — the dot-org registry is run by a company based in Virginia. Yet, as we can see from the graphic above provided by Microsoft, Nitol infections were actually the least of the problems hosted at 3322.org (more on this later).

Continued : http://krebsonsecurity.com/2012/09/malware-dragnet-snags-millions-of-infected-pcs/