Cybercriminals Use NSA Exploits To Attack Servers

Cyber criminals are currently actively using the NSA exploits last week by the hacker group Shadow Brokers were made public to provide servers backdoors and possibly spreading ransomware. Let know several security researchers.

Thus Double Pulsar tool found on the various servers. The NSA would use this tool after it has been through an exploit access to a server. In addition, security reports SenseCy that there is currently a "trend" going where the leaked NSA exploits used to infect Windows Servers with ransomware. The attackers were using either a vulnerability in Windows SMB Server make that Microsoft patched in March.

Further details are not given, however, about this ransomware attacks. Earlier researcher Kevin Beaumont predicted that the NSA exploits a ransomware worm would be used. "It's the next logical step yields for worms and criminals, because the money and is easy to do," says the researcher. Beaumont says that if known exploits are currently being used to servers a backdoor provide.

Adobe Close Critical Vulnerabilities In Flash Player And Photoshop

Adobe has patched critical vulnerabilities in Flash Player and Photoshop computers could allow an attacker to take complete. In the case of Flash Player is about 22 critical vulnerabilities which allowed an attacker to execute arbitrary code on the computer, such as installing malware by just visiting a hacked website or see it from an infected ad.

There was no further interaction required from users. As far as known vulnerabilities are not attacked on the Internet. Since attackers often develop after the release of Flash Player updates exploits to attack unpatched users, Adobe advises to update to Flash Player version 20.0.0.306 within 72 hours. This can be done via the automatic update function or Adobe.com. In the case of Google Chrome, Internet Explorer 10 and 11 on Windows 8 and 8.1 and Internet Explorer 11 and Microsoft Windows 10 Edge Embedded Flash Player will be updated using the browser. Through this Adobe page can be verified that the system version is installed.

There is also a security update for Adobe Photoshop CC and Adobe Bridge CC appeared. The update fixes three critical vulnerabilities that an attacker could take over your computer if opened a malicious file. Because Photoshop traditionally not been a target for attackers, Adobe advises users and administrators to install the update if it suits them. Updating via the built-in updater of drawing programs. In the case of Photoshop CC 02.04.2014 is the update to download only via Adobe.com.

Google: Anti-Virus Software, Kaspersky Still Leak

The anti-virus software of the Russian anti-virus firm Kaspersky Lab still contains multiple vulnerabilities, says Google researcher Tavis Ormandy. Recently released the virus fighter that's been a big leak could poem was found by Ormandy and the system could allow an attacker to take complete without users here had to do something.

The researcher Google has much more major vulnerabilities found in the anti-virus software, so Ormandy late in an analysis of the leak know that are already patched. The analysis was made ​​on the Project Zero blog from Google. Project Zero is a team consisting of Google hackers and researchers looking for vulnerabilities in popular software. This included the anti-virus software from Kaspersky scrutinized.

Not patched

"Many of the bug reports I submitted are still not patched, but Kaspersky has made enough progress that I can talk about some of the problems," as the researcher says. Ormandy had found dozens of bugs in the anti-virus software and reported. The research shows that some of the most dangerous leaks were very easy to abuse. The researcher is pleased that Kaspersky Lab here for additional security rolls out. The impact of a vulnerability will increase in anti-virus software because the virus often file system and network traffic intercepted.

Visiting a website or receive an e-mail is enough to be attacked. It is then not even be necessary to open the e-mail, since the input / output of the reception of the e-mail is sufficient to cause the vulnerability. Besides the discovered vulnerabilities Ormandy also found several major design flaws in other parts of the anti-virus software. These other vulnerabilities to attack his distance. As the updates previously been deferred, he will discuss these issues later.

Security software harmful?

According to Ormandy, there are strong indications that there is an active trade in exploits for antivirus software exists."Research shows that a readily accessible attack surface that exposure to targeted attacks increased enormously," says the researcher. Therefore, he believes that security software developers the strictest security guidelines when developing their software must implement in order to reduce problems caused by the software. Something that fail anti-virus companies. In the past Ormandy has major problems in the software of anti-virus company Sophos and ESET found.

The researcher concludes with a warning and request for anti-virus companies. They would parts of their software does not have to run with system privileges. "Do not wait for the network worm that it has provided in your software, or targeted attacks against your users. Add even today the development of a sandbox to your development plan." Regarding the outstanding vulnerabilities in the software of Kaspersky Ormandy says that the anti-virus company responds very quickly and that a number of critical vulnerabilities in the coming weeks will be patched.

Malware On Google Play Infected 200 000 Android Devices

Criminals have managed to place two infected apps on Google Play downloaded between 200,000 and 1 million times. These are two versions of an app called Brain Test. Once users have downloaded the app which tried four different exploits to gain root access. In case this was managed persistent malware installed posing as a system module.

Then the app installed additional applications on the infected machine. In order to prevent removal Brain Test uses two system applications in order to monitor the removal of one of the components. Once one of the parts is removed, the second reinstallation. The malware was discovered by a user who deleted the infected app, but then saw how returning to the unit by itself again.

After being briefed by security company Check Point has one of the infected apps September 15 removed. The first version was removed from Google Play on August 24th. Android Users whose phone has been infected are advised to delete the app. In the case which comes back to the persistent system module is installed, which means that the operating system via an official ROM must be re-installed.

Google Will Pay Researchers For Android Leaks

After reward programs for Chrome and other Google products, the Internet giant is now paying researchers for bug reports in Android . In addition there are rewards distributed to researchers who develop patches making the entire ecosystem safer.

The highest remuneration shall be for researchers who know how to circumvent the security of the Android platform and the sandbox security. For small leaks Google pays $ 500, while critical vulnerabilities are worth $ 2,000. If the investigator in addition to leak a patch and compatibility test suite (CTS) develops is paid $ 8,000. A series of exploits that an app or an attacker with physical access to the kernel can compromise providing $ 10,000. In case the verified boot is compromised researchers receive $ 20,000.

Is an attack carried out remotely, wait for an amount of $ 30,000. The reward program applies to vulnerabilities in the latest versions of Android Nexus phones and tablets that are currently offered in the US Google Store. It still comes to the Nexus and Nexus 6 9. "Open security research is a strong point of the Android platform. The more security research focuses on Android, the safer it will be," said Android security engineer Jon Larimer.

Google Expands Chrome Hacking Contest Day

Every year Google organized during a security conference in Canada, a one-day competition in which hackers and researchers were rewarded for demonstrating vulnerabilities in Google Chrome. The Internet giant has now decided to expand the competition. Instead of a one-day hacking contest, researchers can now throughout the year for millions of Pwnium competition qualify.

Last year there was 2.71828 million dollars prize money available for new vulnerabilities. That prize is "infinity". According to Tim Willis of the Google Chrome Security Team has the game for various reasons changed . So researchers had to be physically on site in Canada to demonstrate their vulnerabilities and exploits. In addition, researchers decided to collect their leak to the Pwnium contest. "This is a bad scenario for all parties," said Willis.

Google was told the leak because later allowing users were more risk. Also, other researchers not to Pwnium participated vulnerabilities can find and report. The contest now to let a whole year, researchers found last report bugs directly, which should prevent them from doing the same work. Besides Chrome Chrome OS is also eligible for the new rules, wherein the top beloning now $ 50,000.

Prize For Hacking Chrome During Pwn2Own

During a hacker contest next month in Vancouver held hackers and researchers can win the grand prize by hacking Google Chrome. Who a vulnerability in Google's browser on Windows 8.1 knows how to find can earn $ 75,000.

This is more than for leaks is offered in other browsers. The game in question is the annual Pwn2Own contest, which takes place during the CanSecWest conference. Every year, researchers and hackers at the event to test the security of browsers.After the prize for Google Chrome follows Internet Explore 11 where a reward of $ 65,000 to be offered. Apple Safari on Mac OS X Yosemite follows with $ 50,000 in the third. Finally provides a successful hack of Mozilla Firefox at $ 30,000.

Besides the four browsers will be tested also the security of Adobe Reader and Adobe Flash Player. A successful attack on both programs make $ 60,000 on. This year, the difficulty for participants is much higher than previous years because the exploits that should be developed with Microsoft's free security tool EMET works.

The Enhanced Mitigation Experience Toolkit (EMET) is precisely designed to neutralize the effect of exploits. As a result, researchers now take two hurdles. Researchers who through their exploits on a Windows computer code with SYSTEM privileges can perform get an extra $ 25,000 reward. In addition, Google will in the case of a Chrome hack pay an additional reward of $ 10,000. Pwn2Own will take place on 18th and 19th March.

1800 Subdomains Used For Flash Player Attack

Cybercriminals last week a large number of subdomains created and used for attacking Flash Player users. For carrying out the attack, the attackers used more than 50 legitimate GoDaddy accounts that they had hijacked. GoDaddy is an Internet domain registrar where to register. In addition, customers can through the GoDaddy account to manage their domain names. By this steal account information the attackers had access to a large number of domain names.

They used the access to create subdomains , which were then used to host a Flash Player exploit. This is an exploit for a vulnerability in Adobe Flash Player that on January 26 was patched this year. The use of subdomains took place between 26th and 30th of January. Unlike many attacks where cyber criminals hacking and using legitimate websites to infect visitors were not adjusted in this case the main domains.

The attackers used the subdomains created to host the Flash Player operates as well as an exploit for Microsoft Silverlight.Contaminated ads was then made ​​to these subdomains. Users with vulnerable Flash Player who got to see could be infected with malware in this way the ads, according to Cisco . Statistics from VirusTotal shows that exploits barely detected by virus scanners, which indicates that it is important to immediately install the available updates.

Critical vulnerabilities Found in Network Time Protocol (NTP)

Researchers at Google have critical vulnerabilities in the Network Time Protocol (NTP) allowing attackers discovered on systems that use NTP can execute code. NTP is a protocol that allows systems to synchronize the time for different services and applications.

It is used among other things on a large scale industrial systems. Neel Mehta and Stephen Roettger of the Google Security Team discovered several vulnerabilities in the protocol. In the worst case, an attacker by sending a single packet to cause a buffer overflow, and it is now possible to carry out on the attacked system code with the rights of the NAP-process. This vulnerability is present in all versions of NTP NTP-4.2.8.

Before warn the the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the US Government, the US Computer Emergency Readiness Team ( US-CERT ) and the CERT Coordination Center ( CERT-CC ) at Carnegie Mellon University. Administrators also are advised to upgrade to NTP 4.2.8. Furthermore, this version fixes vulnerabilities in the random number generator allow an attacker to retrieve certain information. Exploits that make the leak abuse have been found on the Internet, according to the ICS-CERT