Gmail Notifies Users Of Unencrypted Messages

Google Gmail users will now warn if they receive unencrypted messages, as the Internet giant has on Safer Internet Day 2016 announced . Google itself uses TLS encryption for encrypting messages. Gmail users can send encrypted messages to each other in this way. TLS is not yet used by all email providers.

This allows messages that Gmail users received via this e-mail providers, or send to this, be read. Gmail will therefore present a warning showing that the email provider of the addressee no encryption support, or if a message is received that is not encrypted via TLS. There will also be a warning if the sender's domain could not be authenticated. Gmail recently did not know that more and more support major email providers tls and domain authentication.

From investigation of Google, the University of Michigan and the University of Illinois show that from December 2013 to October 2015 the number of encrypted emails rose Gmail non-Gmail users received from 33% to 61%. In the same period, the number of emails were encrypted using TLS and Gmail to non-Gmail users was sent from 60% to 80%. Further uses 94% of the incoming email for Gmail, a form of authentication to protect against phishing and spoofing.

John Rae-Grant Google argues that not all e-mails which warned is dangerous. "But we advise you to be extra careful when answering or opening links in messages that you have doubts about. And by this update, you have the resources to make that decision."

GitHub Introduces Logging Via USB Key

The popular online platform for developers GitHub has a new method added to allow users to login securely and advises developers to also to add their own software to the login method. It is the Universal 2nd Factor (U2F) standard of FIDO Alliance.

It is an authentication standard that during the next logon password also checks the presence of a U2F USB key. This hardware key acts as a second security factor. The key works only on the real website of GitHub, which as phishing and man-in-the-middle attacks must be prevented. U2F standard supports several platforms and browsers and requires no installation of drivers or software.

There are several manufacturers that offer U2F USB keys, which can all be used, but GitHub has launched an action with Yubico, provider of the YubiKey. Before developers on GitHub can log in via the USB key they need to be first through their account register. Last year, decided Google already U2F in to Google Accounts and set in August did Dropbox so. U2F as said from the FIDO Alliance, an alliance of IT companies like Microsoft, ING, Google and Intel, who want an end to the password and therefore working on alternative solutions.

Developer Encryption Software Targeted By Cyber Espionage

The director of a Russian company that develops encryption software has been attacked by a group who are more concerned with attacking NATO, the White House and the German parliament. It claims the Japanese anti-virus company Trend Micro. It would go to a group of Russian spies.

Although several organizations abroad were the target group, there are attacks carried out in Russia. This involves phishing attacks whereby refined manner attempts to steal login details for email accounts. According to Trend Micro, members of the rock band Pussy Riot, politicians, journalists and software developers have been targeted. Besides the director of the company that develops encryption software was also a developer of web mail service Mail.ru attacked.

Phishing

The attacks on the Russian people were part of a larger campaign involving tens of thousands of people were targeted with phishing emails. This relates to users of well-known webmail providers such as Gmail, Yahoo, Hushmail, Outlook and other providers in the Ukraine, Iran, Norway and China. The way the attacks occur varies. Some campaigns use malware and vulnerabilities. The group of attackers have used at least six zero-day vulnerabilities in the past.

In addition, also targeted phishing attacks used to obtain login details. The phishing e-mails claim, for example that a new service is to deliver guaranteed emails. It then attempts to get through OAuth, an open authentication protocol for example, Yahoo offers to app developers to access the user's mailbox. The links in the phishing email while pointing to a legitimate website of Yahoo for OAuth. So users may think that it is a harmless link. What is the goal of the attackers know Trend Micro, but they may try to keep potential threats to Russia in the eye.

32 Zero-Day Vulnerabilities Announced At Black Hat Conference

For another two weeks and then starts the American edition of the Black Hat conference, one of the most important conferences in the field of IT security. This year especially defense against malware and mobile technologies popular topics, but there will also be all sorts of unknown vulnerabilities are demonstrated.

"We have 32 different zero-day vulnerabilities disclosed during the event," said Stevie Wylie, general director of the conference, compared to eWeek . "The zero days come from a variety of areas, including mobile and SCADA (supervisory control and data acquisition) systems." In addition, the conference for the first time a study ( pdf ) published among 460 security experts. The experts suggest that refined attacks directly against the organization are focused and phishing and social engineering are the main concerns. Furthermore, the experts most daily time spent on vulnerabilities that are introduced by their own application developers.

When it comes to expenditure are incidental data leaks that cause end users because they do not follow the policy as well as targeted attacks, the greatest costs. When asked what the weakest link in the enterprise security indicates 33% of the surveyed experts to end users who violate security policy and easily be misled by social engineering attacks. According to Black Hat, the survey shows that the current IT security model of enterprises should be reconsidered and that security professionals do not spend their time and money to make the issues they are most concerned about.

Chinese Phishing Sites Doubled To 93,000

With an online population of 649 million people, cyber criminals are increasingly turning to the Chinese market, according to a new report from the Chinese Computer Network Emergency Response Technical Team / Coordination Center (CNCERT / CC). Last year there were observed more than 93,000 phishing sites in China, a doubling from the previous year.

Furthermore, the Chinese authorities discovered 37,000 sites that were adapted, while 40,000 websites were equipped with a backdoor. Nearly 6,000 of the websites with a backdoor were controlled by American IP addresses, reports the Chinese state press agency Xinhua .

Microsoft Removes Superfish 240,000 Lenovo Laptops

In a week's time Microsoft about 240,000 Lenovo laptops have removed the Super Fish-adware, according to figures that released the software giant. Because of the vulnerability that was caused by Superfish decided to release on February 19, Microsoft updates its own virus scanners so that they could remove the adware and the corresponding certificate. In a week's time, Microsoft has identified about 240,000 machines Superfish.

The adware was Lenovo laptops at more than 40 models installed and aimed to intercept SSL connections to then inject ads.The adware used for this purpose its own root certificate. Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed.

In a blog posting , Microsoft explains the different ways in which Lenovo users could be attacked. This could be via a malicious WiFi network, phishing domain or DNS poisoning can. Lenovo provides all in January for carrying laptops with Superfish, although in February even laptops with Superfish sold. In addition, different virus scanners now detect and remove Superfish. In the case does not recognize the installed security software Superfish, Microsoft recommends that a single scan using the Microsoft Safety Scanner to perform.

Gemalto Denies Scale Theft Encryption Keys

SIM card manufacturer Gemalto denies that the American and British secret services widely encryption keys of SIM cards have been stolen. That leaves the Netherlands-based company after research know.Last week The Intercept came with the message that the US NSA and the British GCHQ in 2010 had obtained access to the network of Gemalto there and had the encryption keys sim captured.

According to the SIM card manufacturer is discovered in 2010 and 2011, two sophisticated attacks against the company that seem to correspond to the attack methods that are defined in the document of The Intercept. In 2010, the company discovered suspicious activity on one of the French sites where a "third party" the office trying to spy.

In July 2010 a second incident was discovered, which were sent phishing e-mails to a telecommunications company seemed from Gemalto and contained an infected attachment. Also, this time it happen several times tried to gain access to the computers of Gemalto staff. The company calls it "likely" that an operation has been carried by the NSA and GCHQ. This would, however, only the office have been compromised.

There has therefore been no large-scale theft of encryption keys. In addition, Gemalto says it had already rolled out a secure exchange system in 2010 for the exchange of these keys with telecom providers, which is the risk of theft would create exceptional. However if keys are captured, they would only intelligence second generation 2G networks can eavesdrop. 3G and 4G networks would not be vulnerable to such attacks.

Ransomware Disguises Himself As Google Chrome Update

There are currently going around emails posing as security for Google Chrome, but in reality spread ransomware. The messages would come from the "Google Security Center" and have the subject line "Google Chrome Security". According to the email, the Chrome version of the receiver is potentially vulnerable and outdated.

Instead of an e-mail attachment, the recipient gets instructions to enter a particular search that points to a compromised website and on which the so-called security is offered. The update is in reality a ransomware variant called CTB Locker, which stands for Curve Tor Bitcoin. The ransomware is also known as Citroni.

The malware encrypts all kinds of files on the computer and then prompts the user to pay an amount in bitcoin for decryption, as reported security Malwarebytes. How many people have been kicked in the e-mail is unknown. Users do in the case of Google Chrome namely itself to install updates because the browser on most computers will update automatically.

Phishing Attack On LinkedIn Users With HTML Attachment

LinkedIn users have become the target of a phishing attack that through html files attempting to steal credentials. The email has the subject "LinkedIn Alert" and argues that there is a mandatory security update is necessary due to unusual activity.

LinkedIn phishing email

For this check is sent an html file. When users open the file, they get to see a copy of the real LinkedIn site. However, the code has been modified so that users via the HTML page to try to log their data forwarding to the attackers, warns anti-virus company Symantec. The IT security advises users to turn on two-factor authentication. Even if the credentials are stolen an attacker can therefore not on the account login.

New Variant of Emotet Malware - "Microsoft Warns of Malware That Steals Passwords"

Microsoft warned their users about malware that steals passwords for various programs and login details for online banking. The Emotet malware is distributed via a spam campaign that is aimed primarily at German Internet users, although 2.3% of the infections was observed in the Netherlands. The email contains a link to a zip file with a known deposit of the bank.

In reality, the zip file contains an .exe file that malware. Once active Emotet tries to steal login details for several German banks. In addition, the passwords for Eudora, Google Desktop, Google Talk, IncrediMail, Mozilla Thunderbird, MSN or Windows Live Messenger, Netscape 6 and Netscape 7, Outlook 2000, Outlook 2002 and Outlook Express, Windows Mail and Windows Live Mail and Yahoo! Messenger sent back to the attackers.

The linked website can download a .zip file that contains an executable file with a long file name to hide its .exe extension such as:

• de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
• E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
• Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe

According to the software giant let the malware show that it is important to keep security software up-to-date. To share in the event Microsoft's security software is used, users taking the advice to data with the Microsoft Active Protection Service Community (MAPS).

Malware Traffic Analysis

Spammers bypass spam filters with non-Latin characters

Spammers use a variety of ways, such as images and ASCII text, to bypass spam filters and get. As phishing emails and other messages delivered to the mailbox of Internet users but recently the use of non-Latin characters, a trend to be.

This allows anti-virus firm Kaspersky Lab. It concerns in particular Italian phishing emails, which spammers use certain non-Latin characters to replace. Latin characters This is possible thanks to the UTF-8 encoding system, in which characters from different writing systems can be combined in the same e-mails said analyst Maria Rubinstein. In the image below, several of the non-Latin characters underlined in red.

Fake poll as a lure for Facebook Phishing Scam

The Facebook application asks users to register their votes

Cyber criminals have again found a new way to Facebook to trick users into entering their login details. They run a fake online poll for the purpose of luring. Potential victims to a phishing site.

A pop-up window requesting for user account information

Symantec reports that the scammers run an online poll with the question: "Who better boys or girls" Once the visitor has cast his vote will be prompted to log in to the Facebook account and asked whether the visitor is male or female. After logging the victim sees the message that his voice has been sent. Scammers host the site on a subdomain ([http://] Smart Apps. [deleted]. com) to indicate that it is an application and the to appear. matter professionally in this context is the number of voters also raised periodically.

A comparison of the previous vote count and the current vote count

While it does seem that way at first glance Facebook has nothing to do with the campaign. When visitors log in reality they give their login information to the cyber criminals.

The scammers probably realize only too well that many Facebook users, this kind of thing every day without too much thought do. It is not inconceivable that they have already succeeded in many account data store.

Prevent
To a victim of a Facebook scam to be, it is important that you never put your password on domain other than facebook.com enter. The real login page of Facebook is secured with an SSL certificate which can be used by the padlock in the address bar of the browser and the HTTPS recognized connection.

Windows Spyware WinSpy and GimmeRAT monitors Android devices

If you are using Android Phone and syncing with the Windows Operating System for backup and transferring files, Then Be Careful.

Mechanism of attack on financial institution employing WinSpy

Researchers have found by analysis of an attack on a U.S. financial institution Windows spyware that is also able to monitor. Android devices The institution was attacked by a spear phishing email, which had a large NSIS file as an attachment.

Once the file was opened, the recipient was a picture of a payslip to see while installed in the background. WinSpy This is commercially available Windows-spyware which makes it possible to monitor, according to the authors. Computers but also Android devices In a second attack on the institution was again used WinSpy, only the malware was now hiding in an Excel document with a macro.

Once the malware on your computer is active, the attacker can control the webcam, capture screenshots, saving keystrokes, disable security software, downloading and surfing habits chat conversations via the microphone shoot, upload and download files and send messages to the computer.

Android

During the analysis of the malware security company FireEye also discovered various Android components that can be used to monitor the victim. It involves three different applications, one of which only works when the device is connected to the Windows computer while the other two make it possible to control. Android device via SMS

Deployment Scenarios for Android Components

To install the Android spyware must be connected, then the installation takes place. On the infected computer Windows phone Through the Android spyware screenshots can be stolen and it is possible to find out. The location of the target

"These attacks and tools to confirm that we live in an age of digital surveillance and theft of intellectual property. Commercial Remote Administration Tools (RATs) continue to proliferate and are increasingly being used by attackers," said analyst Thoufique Haq. He notes that the rise of mobile platforms like Android, a new market has emerged which also asked about RATs that support these platforms.

Phishing Attack on Google users hosted by Google

In a recent phishing attack on users of Google Docs and Google Drive cybercriminals have the phishing page where victims had to introduce hosted on the servers of Google. Their credentials Something the phishing attack is both refined and remarkable, says Symantec.

Google Docs phishing login page

The anti-virus company discovered the attack, which starts with an email subject "Documents" has. The email prompts the recipient to view an important document. The link does not point to Google Docs, but after a fake Google login page. The neppagina however hosted on Google's servers and then ran over an SSL-secured connection, which makes the attack seem more convincing.

In this case, the scammers a folder in a Google Drive account is created, placed it in a file and then put the public folder. The preview feature of Google Drive they got this way a publicly accessible URL that was added. To the phishing emails When users their information on the phishing page fill go directly to the criminals behind the attack, while the victim to the real Google Docs page is redirected and possibly nothing by it.

Click Here For Symantec Report