Man Charged Steal $ 600,000 Via E-mail

In the United States a 28-year-old man charged with steal more than $ 600,000 through e-mail and an attempt to similarly $ 1.3 million prize. The man is suspected to have emails sent to companies with payment orders for the finance department.

The emails seem to stop coming to the company and include a PDF document with instructions for payment. To the e-mail appear to have legitimate domain names were registered that looked very much like the domain names of the attacked companies. This type of fraud is called "Business E-Mail Compromise" scam. The suspect was in the crosshairs of the FBI after two businesses were defrauded in this way. Both companies made ​​over $ 100,000. The used PDF files were sent to the accused traced suspect. The suspect is guilty, if to a prison term of up to 30 years and a fine of $ 1 million will be condemned.

Worldwide, there are, according to the FBI by now more than 8,000 companies ripped off in this way, of which 7,000 in the United States. The damage amounted to $ 800 million, again the majority, $ 750 million in the US In addition to the 800 million dollars that the FBI recorded in the first eight months of this year, other investigative agencies have a loss amount of $ 400 million observed, causing total damage at $ 1.2 billion comes out.

World Map Showing Cyber Attacks Live Weather

The US security Norse launched last year a world map that cyber attacks live stated and this week a new version of the card launched . The new " Live Map Attack "is visually appealing and entertaining for users.

In addition, it should provide insight into the origin and nature of cyber attacks. The improved interface allows users to zoom in on certain areas. The data displayed on the map are derived from a network of honeypots, crawlers and sensors attacked.The sensors showed at the time of writing that most attacks come from China and the US is the main target.

Voicemail Leads To Malware Attack Via OneDrive

A group of attackers used voicemail messages in combination with malware hosted at onedrive to attack organizations, as several security companies warn. The attack on the organizations begins with targeted phishing mails which contain a self-extracting archive file as an attachment. The attachment occurs when voice mail.

If a user opens the attachment is there as a distraction play a .wav file that looks like a real voice. In the background, however connection with OneDrive made the cloud service from Microsoft. The ultimate malware is then downloaded. Sergey Lozhkin of the Russian anti-virus firm Kaspersky Lab wonders whether this method will be applied by more cyber criminals.

"It is possible because it provides an easy way for attackers to hide malicious behavior. Detecting malicious traffic in legitimate cloud services is much more complex because it involves legitimate services to be blocked," said Lozhkin.Security company Palo Alto Networks has more details about the malware used, which was detected at the time of discovery by 3 of the 54 scanners on VirusTotal.

Research: Critical Infrastructure US Attacked Regularly

Organisations responsible for vital infrastructure in the United States, such as banks, telecom companies and public entities, would make regular cyber attacks have, according to research anti-virus company Trend Micro which 575 respondents were interviewed.

The research was for the Organization of American States carried out and will appear online later today, but news agencyReuters got the report already owned. It shows that 60% of participants had to deal with attacks in which there was an attempt to steal data. 54% saw attempts to operate control systems, while 44% of respondents attempted to remove files.

Furthermore, 40% of the participants have seen attempts to turn off the network. Reuters reports not in how many of the attempts that respondents perceived it also managed to delete files, equipment or networks to operate off.

Victim Fanny-Espionage Worm Early In 2010 Already To Help

A victim of this week unveiled Fanny spy worm, which through two zero-day vulnerabilities in Windows spread that later were used by Stuxnet, early in 2010, all Internet users for help. However, they received no answer. That discovered Maarten van Dantzig Fox-IT.

A Malaysian forum posted a user with the alias "dkk" a call on July 13, 2010 how he could prevent his computer became infected with this virus. The user notes that he is infected via its USB stick, even though they are Autorun and Autoplay disabled. Much to the surprise of the user, different files found on the USB stick and the names also mentioned this, including Fanny.bmp. He also added a copy of the virus. However, there was no response.

Fanny.bmp is the same file that the report ( pdf ) from anti-virus firm Kaspersky Lab is known about the malware. The report also stated that Malaysia is among the countries where the worm is still active. Opposite Ars Technica confirms Kaspersky Lab that files who names the forum user match those of the Fanny worm. The worm was developed by a highly sophisticated espionage group and would have been deployed since 2008.

Desert Falcons Malware: "Million Files Stolen By Rtlo-Trick And RAR Attachments"

A group of cyber spies has managed through various social engineering tricks more than 3,000 computers to infect, with about 1 million files were stolen. Also in the Netherlands observed one or more infections, as reported anti-virus firm Kaspersky Lab.

The attackers, who would operate from the Middle East, had to cater to political and military intelligence. To infect victims were applied various tricks. So were sent spear phishing mails with attached RAR files. This RAR files contained and SCR and EXE files. The attackers used a trick with shortcuts.

Targets were given a RAR file sent to that extracted yielded several files, including two .doc files. One file, however, was a shortcut. Once users opened the shortcut malware was performed. Another trick used was using rtlo, which stands for Right-to-Left Override and ensures that through a special Unicode character sequence of characters of a filename can be reversed.

This will SexyPictureGirlAl [rtlo] gpj.exe appear in Windows as SexyPictureGirlAlexe.jpg. In the case of these attacks did the malware via rtlo for as a PDF document includes corresponding icon, but was in fact an executable SCR file. Users can recognize rtlo attacks by setting the detail view in Windows folders. Behind the file name also appears the file type. In this case there would be stated that this was an application.

The attackers were also active on Facebook, where she targets via the social networking approached. Once the trust was won were sent RAR files that contained malware. For large-scale infections among activists and political figures Facebook was also used. In this case, Facebook Messages posted there were pointing to malicious pages that malware was offered. Or again, the attackers to a page with an example being censored video. To view the video had offered "RealPlayer plug-in" installation. The file offered, however, was malware.

After the new computers were infected targets were divided into groups. Next, a list of all XLS, DOC, JPG and WAV files on the hard drive and connected USB sticks sent to the attackers. The attackers then used to connect to the computer to steal interesting photos and images. Also gathered there chats and screenshots. Depending on the targeted surveillance was then intensified or discontinued. In total, the attackers managed to steal more than 800,000 files from hard drives and more than 80,000 files from USB sticks.

Malware Discovered In League Of Legends And Path Of Exile

Researchers have official versions of the popular games League of Legends and Path of Exile malware discovered. Gamers could become infected when they downloaded a legitimate installer or updates to the games with an Asian provider. Contaminated "game launcher" set three files on the system, namely an official game launcher, a "cleaner" that infected game launcher replaced by the official and the PlugX remote access Trojan.

This Trojan attackers full control over the computer. According to the Japanese anti-virus company Trend Micro users in certain Asian countries were the target of the attack. Research into the infection led to Garena, an Internet platform provider for consumers in Asia. Garena is working with game developers, Riot Games, S2 Games and Electronic Arts, which the company has the exclusive rights to certain games.

In a statement Garena argues that the servers were compromised, causing infectious installation files League of Legends and Path of Exile are scattered. Meanwhile, all infected files are removed. Most infections were observed in Taiwan, followed by Singapore and Thailand. Garena gives gamers advised to scan their computers with a virus, update the games, change passwords, and use two-factor authentication.

Hashes: 

f920e6b34fb25f54c5f9b9b3a85dca6575708631 (FO3Launcher.exe)
bd33a49347ef6b175fb9bdbf2b295763e79016d6 (NtUserEx.dll)
f3eabaf2d7c21994cd2d79ad8a6c0acf610bbf78 (NtUserEx.dat)

Researchers Steal Data From Jailbroken iPhone Via Siri

Researchers have developed a way which makes it possible to steal data from infected jailbroken iPhone via the Siri voice control. When users communicate with Siri is processed their voice to data and sent it to Apple, where the voice input is translated into text.

Researchers Luca Caviglione and Wojciech Mazurczy an attack developed Siri which is used to set up a secret channel between an infected machine and a botmaster so they can steal sensitive data like passwords, credit card numbers and Apple IDs. The malware on the device processes the data to an audio clip that is offered to Siri. Siri will then send the data to a remote server. An attacker who has access to network traffic can thus extract the encoded information.

In addition to the requirement that access to the network traffic, the iPhone must be jailbroken, so the researchers in their report to know. By using the "iStegSiri-attack" can be 0.5 bytes sent per second. Sending a credit card number with 16 digits in this way takes about 2 minutes. The researchers say opposite IEEE they especially want to see how their research steganography, hiding information in innocent looking objects such as images, text or sound clips can be used by attackers.