Domain registrar and hosting company Web.com has 93 000 customers warned that their credit card information, name and address details are stolen in a recent attack. On August 13, discovered the company, which has 3.3 million customers, an intrusion on one of the computer systems.
Web.com states in the announcement of the intrusion that the credit card information of 93 000 clients, "possibly" stolen. In the FAQ, however, with further explanation let the company know that the credit card data has actually been stolen.Affected customers will be notified by mail. In addition, a year of free credit monitoring are offered. Also, different credit card processors would be informed now. How the attackers could strike late Web.com not know. "Despite our efforts is not a company immune from cyber crime," said a response from the company.
Because Mac users install anti-virus software is difficult for anti-virus companies to estimate how big the problem of Mac malware is actually. That says Bogdan Botezatu, an analyst of the Romanian antivirus company BitDefender. Previously, Apple had yet know that users could install a virus, but now it no longer does so.
"Apple is promoting these products as virus-free. They say you do not need a virus scanner, because they know that people hate anti-virus software. The tools often slow down your computer, so they themselves will not promote," Botezatu said front Digital Trends . Mac OS X, according to the analyst to deal with more serious vulnerabilities than all the different Windows versions added. Because Microsoft has always been attacked over the years would have learned to respond quickly to security threats.
Having vulnerabilities still says nothing about attacks on the platform. However, when it comes to Mac computers is missing important information to say something about this, the analyst noted. "The absence of virus scanners on Mac OS X hides the reality, because the malware is not reported. We know it happens on Windows because it is visible to us here, but with Mac OS X, there is often no anti-virus to give something back report. "
In addition, Mac users would not know that their computer is infected, because most malware these days is hardly noticeable."It's the same as with the PC. Hackers realized how silent they are, the longer they go unnoticed. Modern Mac and Windows malware slows down your computer, unless the bitcoin-miners are," said Botezatu. The large market share of Windows would, according to the analyst still ensure that cyber criminals are targeting this platform.
Every day, hundreds of thousands of people using the Tor network to protect their online identity and privacy. Yet there is still much confusion about how the Tor network and the importance of online anonymity. Therefore, the Tor Project has several informative flyers ( pdf ) made for police and citizens explaining the operation of the Tor network and the importance of anonymous internet.
Through the Tor network users can hide their IP address such as "hidden" visit websites that are only accessible through the Tor network. In recent months, several of these sites by the authorities off the air. The most Tor users are ordinary citizens who want to keep control over their privacy, so the Tor Project has announced in the flyer for police and investigative services.
The network is also used by journalists, activists and people in countries with totalitarian regimes or internet censorship. It is also handy for police and undercover operations. So use investigative services also the Tor network for their research."Because of the identity and location of hiding researchers Tor can be a valuable tool for successful online undercover operations," so let the flyer.
There is created a flyer for citizens showing the importance of anonymous Internet and online freedom is explained. According to the Tor Project is anonymity under fire as never before, allowing the ability to share free information on the Internet is undermined. "Countries monitors on each other and their citizens, block websites, watching the contents of traffic and reduce important world news." Organizations that deal with internet freedom can also order the flyers.
Early this month unveiled the Czech anti-virus company AVG privacy glasses designed to prevent face and now the virus fighter has a demonstration online put. The glasses are developed because it more and more places appear cameras and face recognition develops.
It involves, for example pictures made in public places and shared via social media. Someone might thus inadvertently on websites like Facebook may end up and be "tagged". In order to prevent this, the eyeglasses of a reflective material is provided. If someone has a picture with a flash makes the light is reflected and dazzles the camera, making the face of the wearer is not visible.
In the event no flash is used has the glasses on infrared light. That disturbs the sensor of the camera. "If you're worried about your privacy and want to be invisible, then you can ever buy this privacy glasses in the future," said Tony Anscombe AVG.Whether the virus fighter plans to bring the glasses on the market is not yet known.
Microsoft released an update for the virus Security Essentials and Windows Defender that addresses the Super Fish-adware on Lenovo laptops as well as the self-signed certificate that the adware used will be deleted. Also the free Microsoft Safety Scanner is able to detect and remove Superfish.This was discovered by Filippo Valsorda of the CloudFlare Security Team.
Meanwhile, Microsoft has also the definition put the Super Fish-adware line, where the threat as a Trojan horse is described.In addition to Microsoft also have several other providers of anti-virus solutions now released an update to detect and remove Superfish. A survey on VirusTotal shows that Superfish yesterday by 17 of the 55 virus was detected. Earlier in the day there were still six .
Besides the anti-virus companies warn the American and Dutch government for Superfish. The Computer Emergency Readiness Team (US-CERT) that part of the US Department of Homeland Security has issued this warning off. Consumers get it advised to remove the adware and the certificate installed. The Dutch government through veiliginternetten.nl published, an initiative of Economic Affairs, the National Cyber Security Center and the ECP, a short article about Superfish.
The amount of spam that is sent to WhatsApp users has increased in recent times, which would also come by the end-to-end encryption that uses mobile messaging, say experts. By using this form of encryption WhatsApp can not see the content of messages and filter on, like many other messaging services do.
Adaptive Mobile security firm says that in recent months there is an increase in the number of spam messages has been to WhatsApp users. Indeed, it is quite cheap to distribute spam via the message. It would in particular be advertisements for luxury fakes. "
WhatsApp Investment Spam
WhatsApp Spam
WhatsApp Indian Spam
The total size of these individual spam attacks WhatsApp is difficult to determine, but it is clear that WhatsApp now one of the messaging services with a fully functioning and active spam ecosystem," said Cathal McDaid Adaptive Mobile.
He argues that WhatsApp in fighting spam is hampered by the use of encryption. Although commendable to encrypt messages from users is the end result that it is difficult to filter the contents of WhatsApp messages. McDaid argues that it is not the end of the world, but problematic. Also Martijn Grooten Virus Bulletin notes that end-to-end encryption, spam filtering is difficult.
According Grooten WhatsApp may see if some users send large numbers of messages, but it is not possible for example to watch sent linkers. One solution would be to look for example at the phone to the content, but if, for example linkers a blacklist of a third party comparison would bring this user privacy again questioning.
Great is like McDaid positive about the deployment of end-to-end encryption and hopes that more will follow. "But as with all measures that improve security and / or privacy, it has a price tag. We have to be more creative in our fight against spam."
Cybercriminals have used Google Adsense to display ads on all sorts of malicious websites that visitors to these sites for several scam sites by sent. Numerous webmasters complained about the ads that ensured that visitors were redirected automatically.
The scam sites where visitors ended up offered all kinds of products to lose weight, aging combat, combat skin problems or improve IQ. The websites looked like blogs and magazines with so-called scientific studies and research on the products, complemented by all kinds of false responses from people who supposedly had tried the products.
The problem with the malicious ads would play since mid-December, but was last Friday, January 9th widely felt. On the Google AdSense forum, more than 180 responses from angry webmasters inside. Webmasters who use Google Adsense on their websites and see how visitors were redirected by the malicious ads.
On January 10, Google would have solved the problem. According to security firm Sucuri used the attackers behind the attack two legitimate AdSense campaigns, they probably via guessed or stolen credentials managed to hijack. However, it is not excluded that the scammers Adsense accounts have created yourself and initially did occur that it was legitimate campaigns. Code
Researcher Denis Sinegubko of Sucuri is wondering why Google allows advertisers may use this type of potentially dangerous code. "I realize that Google advertisers flexibility in managing their campaigns and the use of scripts will give their own pages. And I realize that at the first check these scripts did nothing malicious, and is only misbehaved after they were approved. But there would have to be more in control of third-party scripts. "
Sinegubko further notes that nobody likes ads, but they are indispensable for many websites. "I will not tell you to remove all ads from your site," he says to webmasters. "But I ask you to think about the safety and reputation effects that may have bad ads for your site. Consider each script from a third party that you place on your website as a potential threat. Especially those scripts that others who do not knows, allow you to place content on your site. "
Programmers create code and hackers find errors in it and use them. Discovered a hole in the most widespread cryptographic the OpenSSL could potentially lead to data theft almost all Internet users.
Seventh of April came security bulletin CVE-2014-0160, from which it became aware of the continued existence of a critical vulnerability in the cryptographic package OpenSSL.
Found that implementation algorithms TLS and SSL are used today in most versions of OpenSSL properly handle expansion packs Heartbeat (because of what the error was called HeartBleed). This allows hackers to gain remote access to confidential information from RAM active network process outside the buffer.
An error in the system has learned the Finnish-American company Codenomicon, what hastened to inform the world through a special website heartbleed.com. Heart Bleed - is the name given error experts, loosely translated it means "bleeding heart."
Such dramatic name was not chosen randomly. An error was detected in the package heartbeat (heart beat, heart rate) used for fault detection and resource management server cluster. The result was a play on words in the heart of the leak occurred.
Surprisingly, the critical vulnerability did not notice for two years. It affects all versions from 1.0.1 to OpenSSL 1.0.1f inclusive and 1.0.2-beta1.
As a result of that error in them is not checked in the recording of the actual length of SSLv3. This allows you to read without authorization to 64 Kbytes of RAM process on the connected client or server for each request. In many cases this is enough to get the keys, passwords or other sensitive data. Vulnerable versions of OpenSSL cryptographic package from March 2012 are included in many distributions and BSD OS family of almost all branches of the Linux Debian, RedHat and Slackware.
The first error affects servers Apache, nginx, project Tor (via the web server https://www.torproject.org), as well as many websites that use the HTTPS, even if access to them is carried out by VPN.
Unlike all the other "helpers hackers» Heart Bleed intercepts encryption keys - the cornerstone of secure connections, which encrypts the data transmission between servers. By themselves, the captured data is not worth anything, because the same encrypted PIN bank card might look like, «dkgh # k87u». Without the key, which will allow to decipher the code, it's just a set of symbols. But if the key will be in the hands of criminals, then get the raw data for them there is no trouble.
The greatest danger lies in the fact that this hack does not leave absolutely no trace in the case of data theft is not possible to know about this.
It would seem, what's this, because such errors are almost every day. However encryption package OpenSSL - the most widespread in the world. It is used mostly in the Apache web server and nginx. According to research company Netcraft, on these architectures employ about 66% of all sites on the Internet. Thus, only every third site does not represent a potential threat in terms of data theft. Among the endangered sites include such popular services like Twitter, Dropbox, Yahoo!, Steam and others. OpenSSL packages are used to everything else for the operation of e-mail servers and diverse client software.
To determine the degree of risk of error Codenomicon tried to kidnap their own data as it would make professional hackers.
As a result, they managed to make an attack on their own servers, without leaving any traces. Using only a hole in the system, Codenomicon received encryption keys. Using them, experts have collected from servers usernames and passwords, correspondence employees through messengers and email, as well as confidential company records stored on your computer.
Of course, such a dangerous hole could not remain uncovered. As a result, on April 7 was released a new version of OpenSSL, in which the error is no longer present. However, a simple upgrade package is not enough. If criminals have stolen encryption keys, they can use them in the same way as in the previous version, and for security administrators need to get a new security certificates and to generate new keys.
Of course, for large projects should not worry, because the price of their negligence administrators too great. It can be assumed that the relevant work already done on the servers.
In Codenomicon even see the positive side of Heart Bleed: because administrators can not ignore the fact that hole detection, they have to update the system data encryption on their servers. Along with them are likely to be installed, and other updates that have been postponed for a certain period.
While common in the bulletin and news reports officially recommend the following steps:
Install a patched version of OpenSSL 1.0.1g or 1.0.2-beta2 or recompile OpenSSL package with key OPENSSL_NO_HEARTBEATS;
reissue the SSL-certificate;
lures (honeypot), simulating the presence of a vulnerable server package OpenSSL, and check to connect to them.
We recommend that if you do not use in public places WiFi network, then try to put this kind of functionality is temporarily closed. Personal use of computers when not readily allow strangers remote control of their computer to prevent personal information from being stolen. Once the leakage of information to remind consumers to timely remedy, keep relevant evidence, take the initiative to safeguard their rights.
According to Symantec, a new era of "mega-data leaks' dawned. Cyber attacks are becoming larger and cost tens of millions of dollars in damage.
At the end of 2013, the most damaging cyber attacks occurred in history, according to the annual Internet Security Threat Report (ISTR) from Symantec. The report shows a significant change seen in the way cybercriminals operate. Kept criminals rather mainly with fast attacks that had a small profit result, now they take months to prepare that generate a lot of money. Larger data leaks for
"A mega attack produces sometimes the same as 50 smaller attacks," said Tom Welling, Security Expert at Symantec Benelux. "Although the level of attacks continues to rise, more and more criminals have more patience and they wait until they can commit to deliver more money with a major attack."
Netherlands
The report also reveals that cyber criminals often use networks in the Netherlands to commit cyber attacks. If so-called "threat-source country rises Netherlands internationally from place to place 7 4. In the top ten of threat-source countries, only the Netherlands and Russia increased relatively strongly in 2013.
Increase
The number of data breaches in 2013 increased by 62 percent compared with 2012. As a result, more than 552 million online identities exposed to cyber criminals. So Cybercrime remains a real and damaging threat to both consumers and businesses. In the Netherlands, the favorite sector of cybercriminals each attack varies. The telecom industry is the biggest target for spam (77 percent), followed by the financial sector (64 percent). When it comes to malware, it is the largest retail target.
Compared to 2012, targeted attacks increased by 91 percent in 2013. Moreover, the attacks in 2013 lasted on average three times as long. Looking at occupations, personal assistants and PR staff are most attacked, because they are often a prelude to prominent figures such as celebrities or executives of large corporations.
Protect
According to Symantec, there are certain steps that businesses and consumers can take to protect against possible data leaks, targeted attacks, or general spam better.
Tips for Business
Know your data: information should be the focus of protection are not the devices or the data center. Knowing where sensitive information is located and where it is flowing, helps determine the best policy and the best procedures to protect the data.
Organization
Inform employees supervised workers in protecting their information. Give them an insight into the corporate policies and procedures for protecting sensitive data on personal and corporate devices.
Implement proper security infrastructure: strengthen the security infrastructure through prevention practices aimed at data loss, network security, endpoint security, encryption, strong authentication and defensive measures, such as reputation-based technologies.
Tips for consumers
Be smart in the field of security: Choose a strong password and update all your devices with the latest security software.
Pay attention: check bank and credit card statements for irregularities and be careful when responding to unsolicited or unexpected emails. Also be alert for online deals that seem too good to be true, because usually they are just that.
Know with whom you work, make sure you are familiar with the policies of retailers and online services that can retrieve bank or personal information. If this information should be shared, please do so via the official website of the company and not through an email link.
Barracuda Networks, the provider associated with the cloud storage solutions and ICT security, introduces Threat Glass, an online tool for searching, analysis and exchange of information on websites with malware. With Threat Glass users can see reviews of the infected websites with screenshots of the stages of infection and analyze network issues.
Daily popular websites cyber criminals exploited to. Malware to visitors loose Threat Glass of Barracuda Networks offers both casual users and the research community the opportunity to bring this persistent problem, identify and understand better. Threat Glass was developed as a front-end to a large-scale automated system that uses lightweight visualization for the independent detection of vulnerabilities and abuse thereof (exploits). The platform analyzes millions of websites every week. The websites that are submitted for inspection from various data feeds, including the top 25,000 websites by Alexa, social feeds and suspicious sites that are detected by the worldwide network of customers Barracuda, which spans more than one hundred fifty thousand organizations. Besides screenshots of the infection Threat Glass offers different views of network traffic, including DNS, HTTP and Net flow, in both graphic and text format. The system has about ten thousand live web-based malware attacks mapped to date and adds daily information on new events added.Detection engines from Barracuda Labs have numerous malware infections found in reputable websites. In recent months Barracuda Labs has published analyzes of popular websites like Cracked.com, Php.net and Hasbro.com.Information on this and thousands of other infected websites is now available through Threat Glass.
Sellers offer BlackPOS (“Dump, CC Memory Grabber”) for purchase online.
Online marketplaces for stolen credit card numbers are thriving.
McAfee report released 2013 Q4 mobile platform malware threats jumped 197%
2013 fourth quarter, Target and other well-known retailers, consumer credit card information was leaked events, and McAfee's 2013 Q4 report that the malware used by attackers, is derived from 'cyber crime as a Service' ( Cybercrime-as-a-Service) communities.
In addition, McAfee also updated the malware data mobile platform - the company's called "Malware Zoo". Compared to last year, the situation did not diminish - soared 197%.
As ever (probably) the largest credit card information leak case together, despite its place in the point of sale POS system, but the company for the conclusion of the event, but it paints a depressing picture.
Vincent Weafer (McAfee Labs), senior vice president of McAfee Labs wrote: "What is more worrying is that the malicious software industry is how their customer service."
After buying a ready-made version of the POS network malware (Target's case, this stock is called BlackPOS), hackers also specifically modified it for their own use.
The McAfee After working with different organizations to extract and identify different data (domain name and user accounts, etc.), and returns the data to the hacker's code (as shown below).
The Target malware included hardcoded scripts to steal domain names, user accounts, and other data
Vincent Weafer added: "They even had a ready-made, highly efficient black market to sell stolen credit card information, and even includes an anonymous virtual currency payment system based POS raw materials, manufacturing, marketing, trading support - nothing is there. " McAfee expects these stolen credit card data (reported 40 million), in Lampeduza Republic and other black market price, between one million to four million U.S. dollars. McAfee's report, there are many noteworthy: For example, malicious binary signature rise. McAfee said the distribution of content on the network, the "ambiguous" (dubious) more and more. CA certificate malware abuse cases are also quite common. 2013 fourth quarter, the company found that the more than 2.3 million malicious binaries signed, an increase of 52% over the third quarter. The amount of 2013 year was 5.7 million, which is already three times in 2012 and more. McAfee wrote: "This threat is not only the proliferation of faster, are becoming increasingly complex." As for the mobile platform, the number of malicious software also continues to climb. Total 2013 collected has reached 2.47 million, of which there are 744000 in the fourth quarter - an increase of 197 percent from a year ago. McAfee did not pick out a platform, but given Android is already the world's most popular smartphone platform, these words are clearly not self evident. McAfee noted that malware mobile platform, its mode of transmission and computer platforms roughly the same - be infected through the application, or web browsing. 2013, when the company tracked 200 new malware samples per minute. Distribution, North America still "tops the list." Although the "hacker hotbed" "is on the rise in other countries and regions," but suspicious content and spam links to the United States is still "excellent." Overall, the browser is still the most common malicious hacker attacks approaches.
This script sent credit card data to the Target attackers.
MtGox2014 Zip Contains One Malware: TibanneBackOffice.exe MD5:c4e99fdcd40bee6eb6ce85167969348d Virus Total Link Detail from McAfee Report is available: Here
