Millions Of Android Phones Vulnerable By New Leak

Researchers have discovered a serious vulnerability in Android which makes it possible to gain access to devices simply by sending an MMS message. Then an attacker can steal information, read emails, activate the microphone and perform other tasks. The vulnerability is in Stage Fright, a media library that handles various popular media formats.

Security Zimperium discovered vulnerability in the Android part, that the self worst Android leak calls so far. An attacker only needs namely to send an MMS message to execute code on the device. It is thereby even possible to remove the message before the user gets to see it. Only the acknowledgement is all that is visible. The researchers warn that the vulnerability is very serious, because there is no interaction from the victim is required.

Estimates suggest that 950 million Android devices running risk. The problem is particularly acute among Android versions Jelly Bean, which is about 11% of all Android devices. Zimperium warned Google that has already rolled out patches for Android. In many cases, telecoms providers and manufacturers are, however, responsible for distributing updates to their users and the security company also fears that it may take a long time before everyone is protected.

Two manufacturers, however, are a positive exception. Meanwhile the Black Phone Silent Circle is patched and Mozilla Firefox is protected from the issue. At the upcoming Black Hat conference in Las Vegas will have more details about the vulnerability are announced.

Microsoft Tool Blocks Unwanted Windows 10 Updates

Microsoft Windows 10 Home front will roll out updates automatically among users and is the standard no longer possible to block certain updates or drivers, like other Windows versions is the case. And that can be a problem if, for example faulty drivers or updates are rolled out via the automatic update mechanism.

Nevertheless, users do not blindly accept all the updates because Microsoft has recently been a " troubleshooter package released "to block unwanted updates. The troubleshooter provides an interface for showing and hiding updates and drivers.Once a user or an unwanted update driver has been removed which will no longer be available after installing the troubleshooter. In the description of Microsoft is that the tool is for the Windows 10 Preview, but Windows Follower Ed Bott notes that the troubleshooter, based on the latest test version of the Windows 10 Preview, including the final version will work.

Secure FTP Server Vsftpd Improves SSL Support

For users of FTP (File Transfer Protocol) which further improves safe way to exchange files existed for some time the FTP server "vsftpd" and the latest version is the support for SSL. By default, files and log data is not encrypted when using FTP. An attacker can eavesdrop on the connection can thus discover a range of data.

Chris Evans , head of Google Chrome Security Team, developed a few years ago why vsftpd, which stands for very secure FTP daemon . According to Evans vsftpd is "probably the safest and fastest FTP server for UNIX-like systems." If the FTP server supports SSL. Therefore, it is possible to log in encrypted on vsftpd-servers and to exchange data. The latest version of vsftpd was dated September 18, 2012, but now there's a new version appeared.

Therein Evans has further enhanced SSL support and various measures aimed at preventing attacks. There is also support for Elliptic Curve Diffie-Hellman (ECDH) added. According to Evans is the use of SSL, in combination with FTP still "tricky" and are not yet solved all of the problems 100%. Nevertheless, a combination of the latest version of the FTP client FileZilla with vsftpd a good start for users who need to use FTP over SSL, as he notes.

Fraudulent Mobile Ads Consume Gigabytes Of Data

Fraudulent apps for both Android, iOS and Windows Mobile posing as popular games allow devices actually charging thousands of ads a day, without users having this in the first instance. However, the applications run continuously in the background, may consume gigabytes of data, ensure that the battery previously absorbed and are able to download more than 16,000 ads per day.

Then there are simulated random clicks on the ads, which get the developers of the paid apps. Average would be the apps on a device 700 ads download per hour, which amounts to 16 800 ads per day. It consumes about 2GB of data. Globally, there are more than 12 million devices with rogue apps are infected.

According to the US Forensiq have rogue apps produced last year for $ 857 million in damages and this year will be $ 1 billion to be passed. It should be noted that Forensiq a company engaged in the fight of advertising and click fraud. Google has already removed several of the rogue apps from Google Play, but would not say how many, reports AdvertisingAge .

US Government Attacked Via Flash Player Flaw

Several agencies of the US government in June and July attacked via a Flash Player vulnerability that was discovered by the Italian Hacking Team and true at the time of the attacks had no patch yet, says the FBI. Details about the vulnerability were found in the data that were stolen from the Italian surveillance company. However, the break-in at Hacking Team was made ​​public on July 6.

Now, according to information from the FBI's Flash Player flaw had been since June 8 by assailants known and actively used to penetrate US government agencies. Previously had anti-virus company Trend Micro already know that the vulnerability before the disclosure in targeted attacks against targets in Korea and Japan had begun, namely July 1 . The FBI goes in the case for the attacks against US government agencies for two campaigns which probably gathering information aim.

Campaigns

The first phishing campaign took place on 8, 9 and 11 June, the second was observed on July 8, according to a warning that spread the FBI and by Public Intelligence online ( pdf is put). Both attacks emails were sent with a link. The link pointed to an exploit that took advantage of the vulnerability in Flash Player. The attack on July 8, the FBI more information mentioned in the warning. Thus, the government received a spear phishing e-mail with a link to a PDF document. When users opened a website loaded there the link containing JavaScript code. This code then loaded a malicious Flash file that vulnerability in Flash Player attacked to infect your computer with malware.

The spear phishing emails had different topics such as 'BBW Analysis report - 2015', 'Tomorrow Morning New Starts', "Perry Dale Club for Leadership: Financial Literacy 101", "FAS Analysis Report - 2015", "AEP Energy Program Update: 2015 Program Year Kick Off ',' Review Link "and" PLS Account A42660861. All spear phishing emails that were submitted in July had the same sender. The timing of the attack in July is remarkable, because on July 8 wrote poetry namely the vulnerability in Adobe Flash Player version 18.0.0.194 and earlier on an emergency patch . In the warning, the FBI also recorded several IP addresses and domains that were used by the attackers and can help detect a possible attack.

Apple Allows Users To Rogue Pop-Up Blocker In iOS 9

Apple has added a feature to iOS Safari 9 which allows users to block malicious pop-ups. IOS users for some time been the target of fraudulent pop-ups that occur as crash reports. The popups use JavaScript to ensure that they do not close on a normal way.

In the so-called crash message is called to call a specific phone number. The number of telephone scammers then ask users amounts of between 40 and 70 euros for solving the "problem". On the Apple forum in recent months dozens of topics and responses to find the people who report to see were . Users who have to deal with the pop-up to close Safari by tapping twice on the home button and then clear the browser history, as Apple on this page explains.

In iOS 9 However, it will also be possible to block pop-ups, as discovered Mac developer Rosyna Keller in the beta version of iOS 9. The Finnish anti-virus firm F-Secure affirms that pop-ups with fraudulent JavaScript indeed simple be closed. All expected to appear iOS 9th September.

Chrysler Raises 1.4 Million Cars Back Because Of Vulnerability

Carmaker Chrysler raises some 1.4 million cars and trucks back because of a vulnerability in the software that allow attackers over the internet can access the vehicles. It is then possible to switch on the brakes, to turn off and to turn off the motor at low speeds.

The vulnerability was by researchers Charlie Miller and Chris Valasek discovered . The problem is in Uconnect, a component that gives the cars online capabilities and that the entertainment and navigation are operable. The functionality even offers a wifi hotspot and makes phone calls possible. Uconnect allows anyone with a vehicle connection as long as the IP address of the car is known.

After the connection was made with a car, the researchers succeeded in order to adapt the firmware of the system. This custom firmware can then send instructions via the internal network of the car to the physical components such as the engine and the wheels.

Recall

After Chrysler nine months ago was informed, was the manufacturer on July 16 with a security update . The update must be installed via a USB stick by car owners. The fear was that many owners would not do this. Therefore Chrysler now launched a voluntary recall, let the manufacturer through their own website to know. It is about 1.4 million vehicles. According to Chrysler there are no attacks still in the "wild" that have been observed using the vulnerability.

The problem is present in the MY Dodge Viper and different models of RAM pickup, the Jeep Grand Cherokee and Cherokee SUVs, Dodge Durango SUVs, different My Chrysler and Dodge Charger sedans and Dodge Challenger sports coupe.Customers of an affected vehicle will have received a USB device that they can use to upgrade the car software. The upgrade not only resolves the vulnerability, but also adds additional security measures, according to Chrysler.

FBI Warns Businesses For Extortion Through DDoS Attacks

The FBI has warned businesses through extortion DDoS attacks on their websites, as these attacks take place more often. The past few months have also several security companies to this form of extortion warned .

The attacks are carried out by a group that DD4BC (DDoS for Bitcoin) names and since last July is active. The FBI warning that Public Intelligence published ( PDF ), the group is not mentioned, but the method does is mentioned is identical. There is first a DDoS attack on the website of the company which usually takes place about an hour and has a size of 20 to 40 Gbps.You then send an e-mail with the demands of the attackers. That require an amount to be paid in bitcoin.

If the victim does not meet the requirements there will be a powerful DDoS attack within 24 hours, which lasts an hour and again has a size of 40 to 50 Gbps. This attack is succeeded by a warning. According to the FBI know most attacked companies to turn down the DDoS attacks by enabling the anti-DDoS services from third parties instead of paying the ransom. Where the attackers had first mainly on gambling sites provide, since April this year, other sectors targeted and larger amounts are required.

Red Hat Patches Leak That Gave Local Users Root Privileges

Red Hat has released security updates for two vulnerabilities allowing a local user to the file / etc / passwd could adapt and root privileges could get. The vulnerabilities are in the libuser library, which is standard on all Red Hat-derived Linux distributions is present.

During an internal investigation discovered security company Qualys different libuser-related vulnerabilities. The first vulnerability is present in the "user helper" and a local user allows to edit the file / etc / passwd. This would be possible to cause a local denial of service. Qualys does not exclude that it is possible for a local user to gain root privileges on the system, but to make the company failed an exploit that realizes this. That did succeed with a second leak in libuser itself.This allows a local user to gain root privileges.

Red Hat released yesterday updates to the vulnerabilities of, after being informed in advance. However, there is a commotion about the publication of Qualys. The company would information about the vulnerabilities, including exploits, published before the Red Hat updates to users could be deployed. Something for discussion on the oss-sec mailing list and Reddit made.

No New Data Ashley Madison Users Put Online

Several media reports that the attackers behind the hack of Ashley Madison information of users have put online, but it is the same data that Sunday had already been made ​​public. Attackers then made ​​known to the data of over 37 million users had captured, as well as all kinds of business data of a site for cheaters.

The attackers threatened to remove all data online as Ashley Madison has not been taken off the air. The website is still online. Still, the threat has not yet been implemented and there are no new data made public. In announcing the hack data from two users were mentioned. It is the real name, username, registration date, complete address, email address, sexual fantasies, desires and password hash of an American man.

In the case of the second user it comes to someone from the "full delete" function had used. This option allows users of the website for $ 19 it removed their profile. However, the purchase details have been preserved, said the attackers. In this case it is the user's name, address and sexual fantasies. His username, password hash and email address are not mentioned.Ashley Madison is a website for people who want to cheat. Because of the incident, the website decided users free of charge to raise their profile.

Speed ​​Network For Internet Anonymously Unveiled

Scientists have unveiled a high-speed network that users can go online anonymously and that mass surveillance will be available. The network is called HORNET ( pdf ), which stands for High Speed ​​Onion Routing at the Network Layer. Because the running at the network layer, there are, according to the scientists, all kinds of applications are possible. To protect the privacy of users is made ​​use of symmetric cryptography. It does this in a way that HORNET nodes, the computers where the network consists of, can process at a rate of 93GB / s traffic.

At present, there are already several solutions for Internet users to protect their anonymity on the Web, such as the Tor network, which has over 2 million users a day. The speed of the Tor network can not be perfect. According to scientists, is well suited for Tor anonymous communication, but its scalability and network performance problems. The more people Tor to use, the more nodes are to be added in order to maintain the speed of the network.

The scientists therefore looked for a solution that did scalable. In doing so HORNET agreements with Tor (The Onion Router).They both use onion routing, where traffic runs on multiple nodes to protect the identity of users. In the case of HORNET have to store the nodes in the middle of the network, less information about the connection, so that they can exchange traffic faster in theory. For the time being, however, the only paper in which the scientists describe the new anonymity network.

Cyber ​​Spies Added Linux Support To Allow Malware

A group of cyber spies who is held responsible for attacks on the Belgian government , the White House and a variety of other businesses , government agencies and institutions in Europe and the United States has developed new malware that also features Linux support.

The group is "Duke" and has been active for several years. Recently, a new instance of malware from the group discovered called "Seaduke". It is a Trojan designed to steal information and will be used against a small number of valuable objectives.According to both Symantec and Palo Alto Networks involves highly sophisticated malware.

Linux

Finland's F-Secure analyzed the malware and also saw that the Trojan is written in Python and supports both Windows and Linux. According to the virus fighter Seaduke is the first "cross-platform" malware of the Duke group. The first thing is to use the popular scripting language Python. Earlier malware cyber spies were written in the programming languages ​​C and C ++. In addition, the Python code for both Windows and Linux proves to be developed. "We therefore suspect that the Duke group same Python code Seaduke used to attack Linux users," says researcher Artturi Lehtiö.

Lehtiö leaves in front Security.NL know that there are no attacks against Linux users in the "wild" are found. "But it is safe to assume that they have added Linux support to the use," he notes. The question remains how Linux users would be attacked.The Duke group, for example, used a funny movie monkeys to attack Windows users, which in reality was an exe file. There are PDF documents containing exploits for vulnerabilities in Adobe Reader used to infect computers with malware.

Adding Linux support to malware is not new. Earlier this year it was discovered another group of cyber spies who had done this. The group decided to use social engineering to infect Linux users. Attacked users received a rogue HTML5 plugin offered which turned out to be in reality spyware.