Qakbot Botnet: "Infects Systems US Police"

Police in the US city of Baltimore has been hit by a computer virus which systems worked slower than normal. IT staff of the police was doing a research on what the inertia of the police systems caused the last few months, when they discovered the virus.

It was a variant of the Qakbot. This malware can data for online banking login credentials for social networks, Hotmail, Gmail, Yahoo !, credit card information, FTP, POP and IMAP logins, certificates and even steal the browsing history. Also can install additional malware Qakbot. Last year there was still a Qakbot botnet discovered from 500,000 computers existed.

How many computers have been infected with the police of Baltimore by the malware is unknown, but according to officials it could involve hundreds of machines, reports the Baltimore Sun . Police believe that the lack of security updates and other security has ensured that the virus could spread. The police do not think that information has been compromised or stolen.Meanwhile, outside help is enabled and started an investigation into the infection.

Google Removes Malware From Google Play Store

Google has removed a malicious app from Google Play that occurred as a backup service, but in reality, text messages, call information, and device information was trying to steal. The app was called "Save Me" and claimed that users through the service could save their contact information. In order for the service to notify users had to specify information such as name, email address, phone number, country and there had to be a personal photo will be uploaded.

Once activated the malware did however connect to a server and send contact information, text messages, call information, such as numbers, date and time and device information back. Also removed the malware own icon. The attackers behind the malware used a spam campaign by Bit.ly shortened links to spread the app. Analysis of Bit.ly -Left show that was nearly 6,000 times clicked, mainly in Africa. It is unknown how many people actually have the app installed.

Security firm Lookout discovered the malware and then warned Google that the malicious app removed. To prevent infection by this type of malware, users advised to only download the official market place and then only apps from known developers.Users therefore have first read the reviews and research the developer so that they are sure that it is a reliable product."Especially if it is a tool that promises to protect sensitive information," says Jeremy Linden Lookout.

AVG: Login Via Fingerprint Positive Development

In late December showed a German hacker still see him with a picture fingerprint had copied the German Minister of Defence, but according to Tony Anscombe anti-virus company AVG login via fingerprint correct a positive development. Anscombe also criticizes the negative coverage of biometric authentication, which would let users believe that fingerprint logon is not safe.

"The process to copy someone's fingerprint in this way is difficult and time-consuming, and it is therefore unlikely that the masses will be a problem," says AVG security evangelist. "I think we just have to celebrate that authentication mechanisms that initially only used by companies and governments have now found a place in our daily lives."

Anscombe notes that as biometric security ensures that more people lock their phone, this is a positive development. "It shows that more consumers than ever protect their devices in a certain way in order to prevent their information being stolen." The security evangelist says he understands that research into this type of security is necessary, but he would prefer to see that people are encouraged to use the security on their phone than that they are trying to undermine the systems that can protect them.

Gogo Inflight Internet Issues - "Wifi Service In Aircraft Used Fake Google Certificate"

An American company that offers WiFi in aircraft appears to use a fake Google certificate to filter YouTube, as discovered an employee of Google. It is Gogo Inflight Internet, which include flights on American Airlines, Delta Air Lines and United Airlines offered.

During her flight decided Adrienne Porter Felt, security researcher at the Google Chrome Security Team, YouTube visit and saw a fake certificate was used, in which they have a public tweet sent to Gogo. In response to the controversy surrounding the wifi provider gave yesterday a response. In it, the director that Gogo due to the limited bandwidth some streaming services does not support and various techniques used to block or restrict video streaming.

"Whatever technique we use to limit the bandwidth, the only impact on certain secure video streaming sites and not on the normal safe Internet traffic," says director Anand Chari. "These techniques are used so that anyone who wants the internet during the flight has a consistent browsing experience." Charitable stressed that no user information is collected by the techniques used Critics , however, are outraged and say that the company for blocking or filtering YouTube no need to use fake Google certificate.

The Tor Network Is Under Attack

Tor users in the coming days may have problems with the use of its services. As representatives warn Tor, detected an attempt to take control of specialized servers, referred to as directory Authorities that support this network. They did not disclose what the hacker group or organization is behind this attack. "We have taken steps to ensure the safety of users of our services. Tor already uses redundancy mechanisms that will keep their anonymity, even if the planned attack will be executed. Tor is safe "provides" arma "on the blog associated with the project . "Arma" is a nickname associated with the project leader Roger Dingledine.

The Tor network packets are exchanged directly between the source and the receiver, and pass through several randomly selected relay servers, which mask the path of the flow of information and thus allow the anonymity of the users of the network. "Even if the attacker take control of the majority of servers, they will not be able to force the Tor client software to resign from the other relays communication and as a result will still be safe and anonymous "provides" arma ".

If you use Tor - you may want to note down and temporarily avoid these affected mirrors in a below pic

Affected Mirrors

Currently, Tor uses 9 servers to manage traffic in the network. They are located in the USA and Europe. At the moment (Monday 22/12/2014) there was no information about the planned attack on Tor. Representatives of the project promise that all information on the current situation will be immediately posted on the blog design . -providing anonymity on the Internet.

Tor network is used by users who want to avoid censorship and track their content published by the secret services, especially in non-democratic countries. Representatives say the Tor project, the network is also used by millions of people who want to ensure the security of the communication itself when connecting to the Internet in public areas. Unfortunately, it is also used by criminals, such as drug trafficking network Silk Road. It was closed down in October 2013 years by the US police, but there is another version - Silk Road 2.0. Despite these controversies, Tor network is one of the symbols of freedom and privacy of Internet communication and any attempt to attack this system probably will lead to big stir among users global network.

Critical vulnerabilities Found in Network Time Protocol (NTP)

Researchers at Google have critical vulnerabilities in the Network Time Protocol (NTP) allowing attackers discovered on systems that use NTP can execute code. NTP is a protocol that allows systems to synchronize the time for different services and applications.

It is used among other things on a large scale industrial systems. Neel Mehta and Stephen Roettger of the Google Security Team discovered several vulnerabilities in the protocol. In the worst case, an attacker by sending a single packet to cause a buffer overflow, and it is now possible to carry out on the attacked system code with the rights of the NAP-process. This vulnerability is present in all versions of NTP NTP-4.2.8.

Before warn the the Industrial Control Systems Cyber ​​Emergency Response Team (ICS-CERT) of the US Government, the US Computer Emergency Readiness Team ( US-CERT ) and the CERT Coordination Center ( CERT-CC ) at Carnegie Mellon University. Administrators also are advised to upgrade to NTP 4.2.8. Furthermore, this version fixes vulnerabilities in the random number generator allow an attacker to retrieve certain information. Exploits that make the leak abuse have been found on the Internet, according to the ICS-CERT

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/

Operation Windigo: 25,000 Linux servers infected by malware

In cooperation with the CERT-Bund, the Swedish National Infrastructure for Computing and other institutes, ESET's malware researchers have uncovered an attack by cyber-criminals, currently more than 25,000 Unix monitored worldwide server.

High level perspective of Windigo’s components and their relationship

Due to the attack, the security experts "Operation Windigo" call servers are infected, which then send out millions of spam e-mails. But the criminals have developed a complex system of sophisticated malware components. This pirate servers, infect visiting computers and steal information. Among the victims of "Operation Windigo" include cPanel and kernel.org.

ESET released today under welivesecurity.com / windigo a detailed document that represents the results of the studies and an analysis of malware. A guide provides information about how users can check their own system for infection. In addition, ESET shows how the malicious code can be removed.

Operation Windigo: Over three years have gone unnoticed

While experts have encountered early on parts of Windigo, the full extent and complexity of these cyber criminal organization in the professional sector has remained undetected.

Flowchart of Windigo’s credential stealing scenario

"Windigo has largely won unnoticed by the security community in more than two and a half years in strength and taken control of over 10,000 servers," says ESET security researcher Marc-Etienne Leveille. "More than 35 million spam messages sent every day to the e-mail accounts of innocent users. These clog inboxes and compromise computer systems.'s Worse is that every day half a million computers are running the risk of becoming newly infected. Visiting a web page whose server has been infected by the 'Operation Windigo', ends on dangerous exploit kits or with unwanted advertising. "

Although sites were infected by Windigo Windows computers only contaminate an exploit kit with malware, even Mac users get advertisements for dating sites. iPhone owners will be redirected to pages with pornographic content.

Sysadmins are encouraged to take action against Windigo

About 60 percent of the world's websites run on a Linux server. ESET researchers ask webmasters and system administrators to review their systems to infection.

"Webmasters and IT professionals generally have much going on why we're sorry that we can make them even more work -.. However it is important it is to protect their opportunity and perhaps even duty, other Internet users," says Leveille. "Everyone should strive to prevent the spread of malware and spam. A few minutes can make a big difference and contribute to the solution."

Timeline of Events

Quick-Check for Server

The ESET experts advise Unix server administrators and webmasters, perform the following command. He is quick indication of whether the own server is compromised:
$ ssh-G 2> & 1 | grep-e-e illegally unknown> / dev / null && echo "System clean" | | echo "system infected"

In the case of an established infection ESET recommends to clean the affected computer completely and reinstall the operating system and the software. It is imperative to use new passwords and private keys. The existing credentials might be compromised.

Bitter medicine for Windigo victims

"The Ebury backdoor that was used by 'Operation Windigo', does not use the weaknesses of Linux or OpenSSH from" Leveille continues. "Instead, they will be installed manually by the attacker. It's scary that the cyber criminal group has done this successfully on thousands of different servers. During antivirus programs and two-factor authentication on clients are common, they are rarely on the protection of servers employed. This makes in relation to the theft of access and malware rankings quite vulnerable. "

Should therefore be message in the future about it for a greater degree of protection, also use technologies, such as two-factor authentication.

"We know that cleaning the server and the rebuilding of the systems is a very bitter pill. If attackers have but stolen or cracked administrators access data and were able to establish a remote access to the server, which is the only safe way," said Leveille. "Unfortunately, some of the victims, to whom we have contact, so far done nothing to clean up their systems - and thus bringing other Internet users at risk." All computer users should always remember never to use passwords that are easy to crack or have been used.

More information
A Detailed report on "Operation Windigo" is located here: Eset