MEGA Warns Against An Infected Chrome Extension That Steals Data

The popular cloud storage service MEGA has warned users of an infected version of its own Chrome extension that was distributed through the official download channel and tried to steal all kinds of user data. According to MEGA, the cloud storage service of internet entrepreneur Kim Dotcom, an attacker has gained access to the official Chrome Web Store account of the company.

Then an infected version of the MEGA Chrome extension was placed in the Web Store and automatically offered to existing users. This version required permission to read data on all websites. As soon as users granted this permission, the extension tried to steal private keys for cryptocurrency wallets and user names and passwords for Amazon, GitHub, Google and Microsoft accounts.

After five hours, the infected Chrome extension was removed from the Chrome Web Store by Google. MEGA states that it has initiated an investigation to find out how the Web Store account could be taken over. The cloud storage service also gets to Google because it does not allow developers to sign their Chrome extensions. The extensions are now automatically signed after being uploaded to the Chrome Web Store. According to MEGA, this will remove an important measure that must protect against attackers.

Before MEGA gave the warning, Jeremy Nation of MetaCert already came up with an analysis of the infected extension. It is not the first time that attackers get access to the Web Store account of an extension developer and then distribute an infected update or version. At the end of last year, eight Chrome extensions were discovered that had been hacked and adware was installed by the 4.6 million users. The attackers had been able to trace the login data for the Web Store through these phishing attacks.

Decrypting Tool For GandCrab Ransomware Available

Victims of the GandCrab ransomware can regain access to their encrypted files. The decrypting tool for GandCrab was made available today on the site nomoreransom.org by the Romanian police in cooperation with Bitdefender and the European police organization Europol.

GandCrab has been observed in the wild for about a month and has now made more than 50,000 victims worldwide, including many Europeans. It is therefore one of the most aggressive forms of ransomware this year, according to Europol .

GandCrab spreads via manipulated advertisements on websites and via fake invoices that are sent as attachments by e-mail. When the malware is installed, the files on the victim's computer are encrypted and an amount of 300 to 500 dollars in ransom is demanded, to be paid in the virtual currency DASH.

As far as we know, GandCrab is the first ransomware copy that requires payment in DASH. GandCrab also has an affiliate program where the ransomware is offered as a service (ransomware-as-a-service) and the developers receive a commission for each ransom payment received.

Developer Medoc Confirms Backdoor In Update

Ukrainian software company tax and accounting Medoc develops confirmed that attackers malicious code added to an update allowing the Petya-ransomware is installed. Initially the company denied even attackers had used the company's software to install Petya-ransomware. On Facebook , the company has been now confirms that the victim of a hack.

Previously, researchers at antivirus company ESET discovered attackers had added a backdoor on an update for Medoc which was released on June 22. The software company announced that it has developed an update that should fix the problem. The servers of the software have been seized by the police, so the update that addresses the issues and to prevent new attacks still can not be rolled. Ukrainian Police advise on Facebook to use non Medoc temporary and computers it is installed to disconnect from the network.

Attackers Behind Petya-Ransomware Emptying Bitcoin Wallet

The attackers behind Petya-ransomware have 9,000 euros paid by victims transferred to another bitcoin wallet. That leaves Aleks Gostev on Twitter know, chief security expert at anti-virus firm Kaspersky Lab. The ransomware which last Tuesday infected several organizations showed users see a screen where they were instructed to make about $ 300 to the specified bitcoin wallet.

Unlike many other ransomware became for all victims the same bitcoin wallet used. Last night decided the attackers 9,000 victims who had paid to worry about another wallet. In addition, there appeared on Pastebin message that bitcoin 100 (225 000 euro) were asked for the decryption key to decrypt all infected systems by Petya.

However, it is unclear whether the persons who placed the Pastebin message also behind the Petya-ransomware. According to researcher Matt Suiche attackers try to confuse the public by the story Petya actually a wiper which data could again turn into a story about ransomware, let him opposite Vice Magazine know.

Cyber Security Council Wants More Companies To Be Notified Of Cyber Attack

The Cyber Security Council, the advisory body of the Cabinet when it comes to cyber security, wants more companies to be notified of a cyber attack, rather than just the vital sectors. According to Ron Moss, a member of the Council, the loss of Petya attack could have been less if companies such as APM Terminals and parcel TNT were warned before, let it faces BNR know.

In the case of the Petya-ransomware though there were no signs or information that the attack would take place, and the news was known until the outbreak had occurred. "If the attacks take place, then the damage is already done, then there is not much point to inform," said Ronald Prins of security firm Fox-IT. He points to the outbreak of the WannaCry-ransomware, which spread very rapidly. "And so there was no warning as possible."

D66 MP Kees Verhoeven endorses the opinion of the Cyber ​​Security Council and wants the government will implement it. "There could be considered a National Computer Emergency Response Team. A team which companies can exchange knowledge and information about cyber attacks." According to Verhoeven should be informed on the one hand on attacks and malware, but companies have on the other hand are structurally better prepared. "This is largely the responsibility of the companies themselves, but the government can play a supporting role. We have the National Cyber ​​Security Center. The infrastructure to do it so, but apparently works not yet."

Update

The opinion of the Cyber Security Council has now been published online ( pdf ). It calls for a nationwide system of information centers for information exchange covering all Dutch businesses. In addition, suppliers must of internet products and services have an active stance when it comes to offering safe products and have to do the simple declaration to cybercrime to the police.

Cybercriminals Use NSA Exploits To Attack Servers

Cyber criminals are currently actively using the NSA exploits last week by the hacker group Shadow Brokers were made public to provide servers backdoors and possibly spreading ransomware. Let know several security researchers.

Thus Double Pulsar tool found on the various servers. The NSA would use this tool after it has been through an exploit access to a server. In addition, security reports SenseCy that there is currently a "trend" going where the leaked NSA exploits used to infect Windows Servers with ransomware. The attackers were using either a vulnerability in Windows SMB Server make that Microsoft patched in March.

Further details are not given, however, about this ransomware attacks. Earlier researcher Kevin Beaumont predicted that the NSA exploits a ransomware worm would be used. "It's the next logical step yields for worms and criminals, because the money and is easy to do," says the researcher. Beaumont says that if known exploits are currently being used to servers a backdoor provide.

Google Stops Support Chrome On XP And Vista In 2016

A little more than four months and then stop supporting Google Chrome on Windows XP, Vista and Mac OS X 10.6, 10.7 and 10.8, as Google has announced. The browser will still continue to work, but will not receive security updates and other fixes more.


The reason that Google discontinues the support is that the operating systems are no longer supported by Apple and Microsoft. Users of Windows XP, Vista and the older OS X versions get Google advised to upgrade to a newer operating system. According to the Internet giant walk unsupported platforms such as Windows XP, a greater risk of becoming infected by malware.

The Google story is remarkable. Support for Windows XP expired last April, but Vista until April 11, 2017 supported by Microsoft security updates, according to the Windows life cycle.

Website Court Of Arbitration Spread Malware

Attackers have to hack this summer the website of the Permanent Court of Arbitration knowledge and provide malicious code to infect visitors with malware tried, reports Bloomberg. The incident occurred in July, when there is a dispute played between the Philippines and China over the South China Sea.


The case was already submitted in 2013, but last summer found the first hearings took place. According to the US Threat Connect was also hacked the Court's website and includes malware. The attack would have been native to China and aimed at diplomats, lawyers and journalists who are interested in the case. Details about the malware and hacking are not mentioned, but it would go to malware to steal information along. The Court leaves in a statement that the website was inaccessible for several days in July because of technical difficulties. What was the cause of this is unknown. The Court was certainly not of the alleged attack on the pitch.

Apple Removes Violate Privacy Apps From App Store

Apple certainly has 256 apps for iOS from the App Store removed because they collected users' personal information, including email addresses and device IDs, and it sent them. The apps used the advertising platform of the Chinese mobile ad provider Youmi.

The developers had added platform Youmi their apps to generate ad revenue. Via so-called 'private application programming interfaces (APIs) clears the platform, however, to collect all kinds of information users. In iOS 8, ​​Apple has taken measures to prevent the unwanted apps can collect through this interface information, but Youmi found a solution to this by peripheral devices, such as the battery system, enumereren and use it as a hardware identification, as discovered the American SourceDNA.

According to the company it is primarily app developers in China who are unaware that the advertising platform collected the data. Apple now has teamed up with the developers so they quickly add new versions of the removed apps in the App Store, where users' privacy is not at stake, according to a response from Apple. Recently, Apple had already all kinds of apps from the App Store removed because they were infected with malware.

Apologies

Chinese Youmi has since made ​​excuses, reports the Wall Street Journal. The ad provider is currently working together with Apple and will compensate the affected app developers.

Whistleblower Site Cryptome Leaked IP Addresses Visitors

Whistleblower site Cryptome has accidentally leaked the IP addresses of visitors when co-founder John Young different USB sticks sent to a supporter. This was reported by The Daily Dot. The USB sticks were hundreds of logs from the statistics program AWStats.

Also, .htaccess files and a password file were on the sticks. Initially Young denied leaking the logs and suggested that the supporter had falsified the data. Then decided supporter Michael Best to publish the data. It turned out to be the IP logs from certain Cryptome pages that were visited in 2009 and 2010 for four months. Young also later known that the data of Best knocked.

Meanwhile, Best of the data removed. Cryptome was founded in 1996 and has since published numerous confidential documents. Last month, Young did not know yet that the PGP keys of both himself and the website had been compromised. Two years ago, both the website and the Twitter account of Young hacked and in 2012 knew attackers malware to be placed on the website.

Criminals Steal 11,000 Passwords Through Outlook Server

Criminals have by infecting an Outlook mail server of a US company more than 11,000 passwords associated with user names managed to steal. That security Cybereason said in a report (pdf). What company will be concerned was not disclosed.

In the attack, the attackers had a rogue module to the Microsoft Outlook Web Application (OWA) is added, the webmail server where the company made use of. The attackers were able to save all log data through the module. In addition, the module also served as a back door. The company attacked OWA used to give remote users access to Outlook.

According to the security company made this configuration, OWA ideal attack platform, because the server was exposed both internally and externally. Because OWA authentication domain passwords is based, an attacker with access to the OWA server can get your hands on as the domain passwords for the entire organization. The module was found to have more than 11,000 passwords stored. How not know the OWA server initially could become infected Cybereason late.

New iOS Malware Infected iPhones In China And Taiwan

Researchers have new iOS malware discovered both jailbroken and non-jailbroken iPhones can also infect and spread by the actions of internet providers. The malware is by Palo Alto Networks YiSpecter mentioned. According to the security company differs from other iOS malware, because it is the first malware that the private interfaces (APIs) used in iOS to add malicious functionalities.

The malware spreads in several ways, including a text messaging worm on Windows, hijacked Internet traffic, promotion on Chinese social media and offline app installation YiSpecter would be more than 10 months to run, but by far most anti-virus companies are not recognized . This is partly because the Chinese anti-virus company, the ones that it has found not want to share with other anti-virus companies, according to Palo Alto Networks.

YiSpecter consists of four different parts, each with an enterprise-signed certificate. In this way, they can also be installed on non-jailbroken devices. Through the use of the private APIs may install the components to each other from a command and control server. In case a user the malware is removed which reinstalled. On infected iPhones malware can install any iOS apps, replace existing apps, show ads, send information about your device and adjust the search engine in Safari bookmarks and open pages.

Spread

The malware would have been operating since October 2014 and poses as a video player for playing porn videos. One of the ways to spread is through the hijacking of Internet traffic. According to Palo Alto Networks have local Chinese Internet providers in past years the DNS and Internet traffic of their customers hijacked. For example, for the injection of advertisements. Last year, for example, the downloads were of Chinese Internet users changed.

Providers who saw that their customers an APK file to download tried were offered another APK file. For the dissemination of the YiSpecter-malware is also hijacked Internet traffic. When Internet users visit certain websites, they get a pop-up that asks if they want to install the video player to watch "special videos". In reality, the malware is offered. Most victims of YiSpecter are located in China and Taiwan.

How many devices have been infected with the malware is unknown, but according to Palo Alto Networks infections are preventable very simple. Users must follow the basic rules: namely, no download iOS apps from unreliable sources, no install unknown developers rely only apps from the official Apple App Store.


Samples of YiSpecter

57cc101ee4a9f306236d1d4fb5ccb3bb96fa76210142a5ec483a49321d2bd603 ADPage

4938b9861b7c55fbbe47d2ba04e9aff2da186e282f1e9ff0a15bbb22a5f6e0e7 ADPage.ipa

fc55c5ced1027b48885780c87980a286181d3639dfc97d03ebe04ec012a1b677 DaPian

5259854994945a165996d994e6484c1afc1c7e628cb5df2dc3750f4f9f92202e DaPian.ipa

7714dbb85c5ebcd85cd1d93299479cff2cc82ad0ed11803c24c44106530d2e2f HYQvod

ddd16577b458a5ec21ea0f57084033435a46f61dc5482f224c1fe54f47d295bc HYQvod.ipa

8fa135fc74583e05be208752e8ce191060b1617447815a007efac78662b425d0 HYQvod_3.3.3

526e1dc893629c00c017fbe62b53392cb26bc6b15947e7b8b7df10a62f40cbad HYQvod_3.3.3.ipa

41176825ba0627f61981280b27689a0c5cc6bfb310a408fa623515e6239b8647 NoIcon

98e9e65d6e674620eccaf3d024af1e7b736cc889e94a698685623d146d4fb15f NoIcon.ipa

e7f071929a4304447cf638057d9499df9970b2a3d53d328a609f191a4bc29ffd NoIconUpdate

8873908061f9c8d563de26fe6fa671080a90a2d60f795cc0664ef686e1162955 NoIconUpdate.ipa

Samples of Worm.Win32.Lingdun

2771276596981c0ff189c27e6869b147c3c3665fd8b94b14d68695ea6ea3d09d inst.exe

8d113243da8992220e73a2fd02ae28d209b326b191aeef95f3c8e223c1c6db96 leba99_setup_220041398.exe

9e538a58aed94a7748df9262ae0343dea9efce8d9117e0868eb404e1098747b6 u.exe

1607cf9625d7bf4ef39f8c1383fa0b1b1edcd13939d5d49fba5cdc14a73a2d95 ziyt.scr

6bd56dd4cc6a97912531fcb8d9f79f814fd45c9e97600f170646308868b1097b 亲情视频秀.exe

a8456f50c47b5248a93bcaebd05cb07bbf61527d5c7537767df1aaabb64bad95 天使嫩女视频全集.msi

Porn XHamster Spread Malware Weather

For the third time in a year there are again infected ads on the most popular porn xHamster published that attempted to infect visitors with malware. XHamster receives nearly half a billion monthly visitors and is on the 71st place of most visited websites on the internet.

The infected ads first carried out various checks. Thus, it ensures that the visitor Internet Explorer and certain security tools such as Wireshark and Fiddler active, said anti-malware company Malwarebytes. In case it IE users without said security tools went unnoticed was a page loaded with the Nuclear-exploitkit. This exploitkit uses known vulnerabilities include Adobe Flash Player and Internet Explorer users have not patched.

In the case the attack was successful was ransomware and other malware installed. After being informed removed the ad network TrafficHaus infected ads. A few days later appeared again malicious ads on xHamster. This time the browser was based Brow lock ransomware spread. This ransomware is not on the computer, but locks the browser via a special JavaScript and states that the user must pay to get access again.

Again TrafficHaus was informed. Malwarebytes but does not know if the second round with malicious ads has been removed. In January and April also appeared already contaminated ads on xHamster.

PGP Keys Whistleblower Site Cryptome Compromised

The whistleblower site Cryptome who has been all kinds of sensitive documents and information publishes visitors has warned that PGP keys from both the website and founder John Young have been compromised. The PGP keys are used to communicate encrypted.

How the keys jya@pipeline.com and cryptome@earthlink.net could be compromised is not listed. Meanwhile, the corresponding keys are canceled and there are newly issued. It is not the first time that Cryptome to do with an attack gets.Two years ago, both the website and the Twitter account of Young hacked and in 2012 knew attackers malware to be placed on the website.

Windows User Reports Malware Often Than Mac User

Windows users are more in touch with malware than Mac users, according to research (pdf) from Kaspersky Lab and B2B International among 12,000 consumers worldwide. 45% of consumers surveyed faced the last year at least once with malware.

Windows users was 83%, while 6% of Mac users reported a malware incident. 13% of Android owners came to own say in the last twelve months in touch with malware. Windows users with malware came in contact 89% said they do not know how the infection occurred, but 81% points to visit a suspect or unreliable website. According to 77% of the computer became infected after visiting a hacked website.

According to 78% of the infection was contracted through an infected USB stick, while just over 70% of the debt puts when opening an email attachment. Reduced performance were the main consequences of an infection. 35% of users said that the system after the infection was slow or not working well. 30% were redirected to websites and ads, and 20% had to do with the installation of unwanted software.

Damage

33% of malware incidents led to charges by victims. This mainly involves repair costs, the purchase of a virus, recover lost data, purchase a cleaning tool, replacement of damaged parts, purchasing an entirely new system and the payment of ransom to restore access to the system or data to get. On average, the loss $ 160.

Microsoft Checks On Millions Of Computers Ransomware

Since yesterday evening, Microsoft has millions of Windows computers on the presence of an active ransomware family-controlled. It involves the Teerac-ransomware, which has been active since early 2014. In recent months, hundreds of thousands of computers with ransomware in touch.

These are essentially computers in Australia, Germany and Turkey. Teerac spreads via email attachments. When a user opens the attachment kinds of files are encrypted and there should be a fee of $ 500 in bitcoin paid to recover the files.According to Microsoft appear every day new instances of ransomware to avoid being detected by anti-virus software.

Due to the increasing activity of Teerac decided the Microsoft Malicious Software Removal Tool (MSRT) update in Windows so that the program can recognize and remove ransomware. The MSRT is a removal tool which is updated every month with new virus definitions and then scan the computer. In the case of an infection, the malware found is then removed. According to Microsoft, prevention is better than cure. Users also are advised to make backups, to keep software up to date, use a pop-up blocker and not to open attachments from strangers.

Leak In OS X Keychain Late Attacker Steal Passwords

A vulnerability in Keychain, the default password manager for Mac OS X makes it possible for attackers to steal passwords stored by users without much interaction. Via terminal commands it appears possible to retrieve passwords stored in the Keychain.

In this case, the password manager would not ask for a password, but a window to show the user which then must click on Allow. Two researchers from Beirut developed an exploit where they retrieve saved passwords, but then simulate the mouse click of the user. This happens in a few milliseconds, so that users do not see through. Once this automated action occurs are stored passwords via SMS sent to the researchers, as it turns out this demonstration video on YouTube.

In order to perform the attack, the code that performs terminal-and-click command simulates still be performed on the user's system. The code that the researchers developed, however, as "wrapper" to be added to innocent files. Once the user opens the file, such as an image, executes the code. According to the researchers security software will not detect the attack, because there is running legitimate code in principle.

Apple

As a solution, Apple should modify the way Keychain handles the terminal assignments and the user just need to ask for a password as it actually supposed to do. The researchers decided to inform Apple, but received no response from the software company. Because of the impact they decided their discovery through CSO disclose. "The vulnerability is very serious. Everyone can thus steal your passwords by just downloading a file that is not evil looks," said Antoine Vincent Jebara.

According to researchers, the attack can be carried out in various ways. So an attacker can a malicious file via e-mail to the user, spread malicious code through a torrent file or add in the event of a man-in-the-middle attack, the malicious code to download user .

Kaspersky Accused Of Sabotage Anti-virus Companies

The Russian anti-virus firm Kaspersky Lab would have the virus for years of competing anti-virus companies sabotaged to show to clean files for malware, so important files were deleted or quarantined.

Let two former employees facing Reuters know. Kaspersky Lab, however, denies any wrongdoing. According to former employees, there was a secret campaign against Microsoft, AVG, Avast and other competitors that lasted for ten years. The plan would be carried out with the knowledge of Kaspersky founder Eugene Kaspersky. According to former employees, who wish to remain anonymous, Kaspersky found that the competition software imitated.

Microsoft, AVG and Avast showed earlier told Reuters that unknown parties in recent years had tried to cause false positives, such as the improper detection of clean files as malware is called. According to the former employees of Kaspersky were provided important files from malicious code, to upload them then to VirusTotal. This website Google scans files with dozens virus. Uploaded files are then shared with connected anti-virus companies.

If the malicious file seemed adequate to the original, the virus would clean file as malware can label. Microsoft says that in 2013 discovered thousands of these files and warned here at that time also ( pdf ). Kaspersky Lab said in a statement that it has never carried out such a secret campaign to mislead competitors with false positives. "Such actions are unethical, unfair, and if it is legal, at least questionable," said the Russian virus fighter.

Update

Eugene Kaspersky cites Reuters story on Twitter complete nonsense. "Usually I do not read to Reuters, but when I do I see false positives. This story was complete nonsense."

Internet Again Exposed To Contaminated Ads

In recent weeks several popular websites appeared infected ads, making the potential for at least 10 million Internet users have run risk of infection. The actual number of people that the received ads to see infected and as a consequence thereof became infected is not known. The ads pointed to a copy of the Angler Exploitkit.

This exploitkit tries users silently through vulnerabilities in popular software such as Adobe Flash Player to infect with malware. It regularly happens that the ads or exploits are displayed only to visitors from certain countries. In case the infected advert appears the attack can only succeed if the visitor uses the attacked software or browser plug-in instance is not up to date.

The sites where the ads would appear according to statistics from security Cyphort SimilarWeb and get at least 10 million visitors per month. The most popular websites showing the infected ads were found in Vietnam, Greece, Indonesia and Thailand. Earlier this month, the ads were also found on the Japanese edition of the Huffington Post. Earlier this year warned Cyphort even for infected ads on popular websites. Even when it came to the Huffington Post.

Criminals Use Malware To Empty ATMs

In the first months of this year, criminals in four European countries malware used to empty the contents of ATMs. These are so-called 'cash out' or 'jackpot ting' attacks, reports the European ATM Security Team (EAST) in a new report ( pdf ).

Which countries will be concerned and how many do not know when the attack was captured late EAST. Malware to empty with ATMs is not new and was last year for the first time in Western Europe discovered . Criminals with physical access to the machine and then install the malware via a USB connection or CD-ROM. Through the malware and entering a special key combination can then be emptied the contents of the cash cassettes. Late last year, however, there were also discovered attacks in Russia where attackers remote ATMs with malware had infected by first banks to attack .

Most countries had so far mainly due to skimming, although seven countries recorded a decline in the number of skimming incidents and two countries saw an increase. There is also avoid a growing trend skimmers countries with an EMV chip. The greatest damage was skimming through this years ago in Indonesia, followed by the United States and the Philippines. The data from the EAST report come from 19 countries in the Single Euro Payments Area (SEPA) and two non-SEPA countries.