Facebook cracks down on fake "Likes" - Lady Gaga, Eminem and Rihanna lose out

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Passionately Liked Facebook pages have begun to see their numbers sag.

One example is the third most-Liked Facebook page, Texas HoldEm Poker, which had a weekly count that was down 275,352 as of Saturday, according to an independent page metric site, PageData.

If you drill down into pages' growth charts, you'll see that the drops began on Monday, 24 September.

Other pages that suddenly lost some warm and fuzzy include celebrity pages of Lady Gaga (down 104,125 for the past week), Eminem (-5,572) and Rihanna (-50,610).

Facebook confirmed to CNN that the slipping Likes numbers are part of a site upgrade (perhaps in response to the site's admission that it has over 83 million fake profiles?), but it wouldn't give details beyond pointing to a 31 August statement regarding improvements to site integrity systems.

The posting states that Facebook has recently increased automated efforts to remove Likes that may have been gained by means that violate Facebook Terms, including malware, compromised accounts, duped users or purchased bulk Likes.

The move shouldn't make most pages deflate too much, Facebook says:

On average, less than 1% of Likes on any given Page will be removed, providing they and their affiliates have been abiding by our terms. … While we have always had dedicated protections against each of these threats on Facebook, these improved systems have been specifically configured to identify and take action against suspicious Likes.

One source of Like inflation are networks of zombie accounts run by bot masters.

Researchers at the University of British Columbia last year created a network of some 100 Facebook bots and found it was easy to evade Facebook detection, convincing thousands of real Facebook users to friend their lifeless fabrications - particularly when they employed photos of attractive women.

Another source of fake Likes is a phenomenon known as a tagging session.

A Valentine's Day page, bleating about Love and Like, adorned with red and pink hearts, is an example.

That Facebook page conducts frenzied, 10-minute Liking and Sharing sessions, the rules of which state that it will ban participants who don't tag 99% of the sites being promoted.

But just who, exactly, gets hurt by fake Likes? Those who are trying to accurately measure how well their marketing efforts are doing.

Jon Loomer, a social media consultant, is one of those people.

In January, he posted about being targeted by Like scams.

Loomer happily watched his Likes grow, only to find that much of it came from tagging-session participants who didn't have a clue who he was or what his page was for.

As such, he was left in the dark regarding what real relationships he'd managed to form:

An inflated number is not reality. It doesn’t give me an accurate reflection of how I’m doing. So if I’m doing poorly, I want the numbers to reflect that. I don’t want a lie that will deflect the truth.

Regardless of what Facebook does to weed out fake Likes, the black market will evolve. We'll continue to see bots that add friends, spam messages and Like pages.

But people who buy into these offers for bogus page promotion, such as "500 Likes for $5!", will get what they paid for: junk.

They'll get 80% bots and 20% people who've been spammed to death, notes Quora submitter Massimo Chieruzzi.

And as Loomer points out, some perfectly well-meaning people may well participate in tagging sessions:

They are struggling. They don’t want to spend the money on ads. Maybe they simply don’t know how to build a page honestly. Or they think this will lead to wealth.

But fake Likes are just smoke. They won't help struggling businesses grow in any real sense.

So kudos to Facebook for popping the bubble, even if it's only a temporary stop-gap before the black market evolves and finds more ways to rig the system.

If you're on Facebook, and want to learn more about security and privacy issues on the social network, consider joining the Naked Security Facebook page.

Follow @LisaVaas
Follow @NakedSecurity

View the original article here

How millions of DSL modems were hacked in Brazil, to pay for Rio prostitutes

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

So, you think you're doing a pretty good job in terms of computer security on your home PC? You've kept your computer fully patched against the latest vulnerabilities? You've ensured that your PC is running the latest-and-greatest anti-virus updates?

Good for you.

Now, how about your router?

My suspicion is that the typical computer user doesn't give a second thought about whether their router could be harbouring a security threat, imagining that the devices don't need to be treated with suspicion.

But if you think that, you're quite wrong.

Fabio Assolini, a researcher for Kaspersky Labs, gave a fascinating presentation at the Virus Bulletin conference in Dallas last week, describing how more than 4.5 million home DSL routers in Brazil were found to have been silently hacked by cybercriminals last year.

Assolini described in his presentation, entitled "The tale of 1001 ADSL modems: Network devices in the sights of cybercriminals", how at some Brazilian ISPs, more than 50% of users were reported to have been affected by the attack.

Here's how the attack came about.

The first thing users may have noticed is that they would visit legitimate websites such as Google, Facebook and Orkut (a Google social network which is particularly popular in Brazil) and would be prompted to install software.

In the example below, visitors to Google.com.br were invited to install a program called "Google Defence" in order to access the "new Google".

Note - google.com.br is the correct web address for the Brazilian edition of Google, and Google's Brazilian website had not been compromised or hacked to make available a malicious download.

And yet, "Google Defence Para" had nothing whatsoever to do with Google, and was being distributed without the search engine giant's blessing.

How was this possible?

The answer is that the user's ADSL modem had been compromised, and the hackers had changed the router's configuration to point to a malicious DNS (domain name server). This meant that when the user entered the web address of a legitimate website (like google.com.br or facebook.com) they could be taken to a dangerous website instead, posing as the real thing.

Cybercriminals had managed to access vulnerable modems remotely via the net.

Now, normally if you access a router via the internet you will be asked for a username and password - and so long as the user has chosen hard to guess login credentials (and not gone with manufacturer's defaults) all should be well.

Unfortunately, in this case, the hackers were able to exploit a vulnerability in the Broadcom chip included in some routers. Assolini explained that "the flaw allows a Cross Site Request Forgery (CSRF) to be performed in the administration panel of the ADSL modem, capturing the password set on the device and allowing the attacker to make changes, usually in the DNS servers."

In short, the exploit allowed malicious hackers to break into millions of routers remotely, without having to know the passwords being used to protect them.

And once there, the hackers were able to change the ADSL modem's DNS settings - pointing them to one of 40 malicious DNS servers around the world.

The end result is that many Brazilian users downloaded code, mistakenly believing they were from websites they trusted, including:

br.msn.com/ChromeSetup.exefacebook.com.br/ChromeSetup.exefacebook.com/ChromeSetup.exefacebook.com.br/Activex_Components.exeand many more..

In some cases, the attackers didn't even have to use such social engineering to trick users into installing the software - exploiting Java vulnerabilities to plant malicious code onto victims's computers as what should have been trustworthy websites were visited.

Ironically, if users contacted their anti-virus vendor's tech support line and asked them about the safety of files like facebook.com/ChromeSetup.exe, chances are that the support technician would not be able to locate the file themselves because their own computers were not running through malicious DNS servers.

And, of course, affected users would often be adamant that they had done nothing wrong - certain that their computers were fully updated with patches and anti-virus. But, of course, that didn't stop the remote attack on their router.

Furthermore, the problem was not just limited to home users. According to Assolini, routers designed for the SOHO market are more commonly encountered than you might imagine on corporate networks, not just in Brazil but worldwide.

Eventually it was discovered that the common denominator between affected computers was that they were all using routers made by one of six different hardware manufacturers.

Fixing the problem, however, was not so easy. The automated remote hacks of millions of ADSL modems had not just changed the devices' DNS settings - they had also changed the password to access the device to phrases like "dn5ch4ng3" and "cg4ng3dn5", meaning that users could no longer get in via their admin panels. If only they had known the exploit too..

The motivation for the attack, which impacted millions of Brazilian users, was - of course - money. Malware installed onto victims' computers could steal files and keypresses, trick users into entering sensitive information on convincing phishing pages, spy upon passwords and banking information, and provide a flood of data for the hackers to exploit.

Interestingly, in his presentation, Assolini presented an IRC chat between some of the hackers involved in the DNS caper. One of them described how another hacker earned more than 100,000 Reais (approximately $50,000) and would spend his ill-gotten gains on trips to Rio de Janeiro in the company of prostitutes.

So, why is it that routers are seemingly so vulnerable? It turns out there are a few possible explanations.

Poor patching. Despite exploits against a wide range of network devices, modems and routers being publicly available on the internet - some manufacturers have chosen to largely ignore the problem.

That means that even if you want to patch your DSL router against a known security vulnerability, a fix may not be available for you.

Default passwords. In some cases, a vulnerability may not even be needed. For instance, if a device uses a known default password, a malicious hacker does not have to go to any effort to bypass the device's authentication.

Lack of user awareness. Users of network devices may not be aware that it is necessary to keep them up-to-date with security patches, or that patches are available.

Non-standard update model. The method by which devices are updated can vary from manufacturer to manufacturer, making it more complex for the user.

Fabio Assolini says that there are number of groups who could carry a proportion of the blame, aside from the hackers themselves.

According to Assolini, security researchers need to be more proactive in reporting flaws related to routers, ADSL modems and other network devices to prevent them from being exploited by malicious hackers. And, of course, the manufacturers have to be responsive.

ISPs are guilty too, says the Kaspersky analyst. He says that it is common for Brazilian ISPs to lend their customers old and vulnerable network devices, and that this is probably happening in other parts of the world too.

And, says the security researcher, governments may not be doing enough. Assolini claims that ANATEL, Brazil's national agency for telecommunications, approves internet hardware before it can be sold, but it does not verify the security of devices - only standard functionality.

Many thanks to Fabio for a great and thought-provoking presentation.

Follow @gcluley

Router, wireless router, and Rio de Janeiro images from Shutterstock.

Tags: ADSL modem, Brazil, CSRF, DNS, domain name services, DSL modem, DSL router, Fabio Assolini, hacking, Rio, Rio de Janeiro, router, vulnerability

View the original article here

Adobe revokes certificate after hackers compromise server, sign malware

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Adobe security chief Brad Arkin has warned that hackers have managed to create malicious files with Adobe's digital code-signing signature.

According to a blog post published on Thursday, the issue appears to have been the result of hackers compromising a vulnerable build server.

Malware seen using the digital signature includes pwdump7 v 7.1 (a utility that scoops up password hashes, and is sometimes used as a single file that statically links the OpenSSL library libeay32.dll.)

According to Adobe, the second malicious utility is myGeeksmail.dll, a malicious ISAPI filter.

Adobe plans next week to revoke the certificate for all code signed after July 10, 2012, according to an advisory from the company:

The certificate revocation will affect the following certificate:

sha1RSA certificateIssued to Adobe Systems IncorporatedIssued by VeriSign Class 3 Code Signing 2010 CASerial Number: 15 e5 ac 0a 48 70 63 71 8e 39 da 52 30 1a 04 88sha1 Thumbprint: fd f0 1d d3 f3 7c 66 ac 4c 77 9d 92 62 3c 77 81 4a 07 fe 4cValid from December 14, 2010 5:00 PM PST (GMT -8:00) to December 14, 2012 4:59:59 PM PST (GMT -8:00)

However, even when a CA (Certificate Authority) revokes a certificate for an abused private key, any digital signature made before the revocation date will remain valid.

This very topic was covered in a paper presented by my SophosLabs colleague Mike Wood at the Virus Bulletin conference in Vancouver two years ago, "Want My Autograph? The use and abuse of digital signatures by malware".

For that reason, Adobe will be publishing updates for those existing Adobe software products which are signed using the compromised certificate.

SophosLabs has released detection for the malicious files that Adobe references in its advisory, identifying them as Troj/HkCert-A.

SophosLabs researchers are also actively exploring whether there are other threats that may have misused the same certificate.

Further information can be found in Adobe's security advisory (APSA12-01).

Since Mike Wood discussed the abuse of digital signatures in Vancouver two years ago, there have been several stories about certificate abuse in attacks.

It is probably just an odd coincidence that news of this latest instance of certificate abuse has come to light while the world's leading anti-virus experts are once again meeting at the Virus Bulletin conference, this time in Dallas.

Follow @SophosLabs

View the original article here

Companies agree to stop spying, taking secret photos on rented home computers

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The US Federal Trade Commission has reached a settlement with seven computer rental companies and a software firm over what the agency said was flagrant computer spying on customers of the rental stores.

In a statement Wednesday, the FTC said that DesignerWare LLC and seven rent-to-own computer stores agreed to cease using malware-like monitoring software to track rental PCs and from using information gathered by the spying software for debt collection purposes.

According to the FTC, the software captured screenshots of confidential and personal information, logged users' keystrokes, and in some cases took "webcam pictures of people in their homes, all without notice to, or consent from, the consumers."

The settlement stems from what an FTC complaint (PDF link) says was a years-long campaign of electronic spying by PC rent-to-own firms against customers using PC Rental Agent, a remote monitoring application made and marketed by DesignerWare that can disable or remotely wipe a rented computer, but also monitored a user’s online activity and physical location using a feature called "Detective Mode."

PC Rental Agent is installed on 420,000 systems worldwide through 1,617 rent to own stores in the United States, Canada and Australia.

According to an FTC complaint, the software was installed and operated without the knowledge or consent of renters. Ostensibly used to track lost or missing rental systems or disable computers in the possession of renters who had stopped or fallen behind on their payments, PC Rental Agent was used for far more nefarious types of surveillance in the hands of DesignerWare’s customers.

By instructing the firm to activate the Detective Mode feature, for example, the rent-to-own shops charged in the FTC complaint collected private and confidential information about the computer user.

This included usernames and passwords for access to email accounts and social media websites, as well as screenshots of websites containing confidential information like medical records, Social Security Numbers and bank account numbers, the FTC said.

A feature added to the software in September, 2011, also enabled remote tracking of computers running the software by tracking the WiFi hotspots the system connects to against a public database of hotspots.

This was hardly a surprise to DesignerWare’s corporate customers.

An excerpt from an email exchange cited by the FTC in its complaint has DesignerWare co-founder Timothy Kelly pitching PC Rental Agent to a prospective customer by saying that it works "like malware" that could "steal credit cards or someone’s information."

The FTC said that the DesignerWare and its customers took that analogy a bit too far - violating federal laws by monitoring users without their consent, and using fraudulent means (a phony Windows registration page) to collect personal information about them.

Personal and financial information on victims was, in some cases, used by the rent-to-own companies to assist in bill collection, the FTC said. However, it also appears that the software was used for more prurient purposes, as well.

"Consumers are harmed by DesignerWare’s unwarranted invasion into their homes and lives and its capture of the private details of individual and family life, including, for example, images of visitors, children, family interactions, partially undressed individuals, and couples engaged in intimate activities," the FTC said.

"Sharing these images with third parties can cause consumers financial and physical injury and impair their peaceful enjoyment of their homes," the FTC complaint reads.

As part of its settlement, the FTC banned DesignerWare and the seven rent-to-own stores named in the complaint from using monitoring software like Detective Mode and from using deception to gather information on customers.

It also prohibits the use of geo-location tracking without consumer consent and notice, and bar the use of fake software registration screens to collect personal information from consumers.

DesignerWare is barred in the settlement from providing others with the means to commit illegal acts and will be monitored by the FTC for compliance for the next 20 years, the FTC said.

Follow @paulfroberts
Follow @NakedSecurity

Webcam, detective, username and password images from Shutterstock.

View the original article here

Monday review: the hot 26 stories of the week

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Filed Under: Adobe Flash, Android, Apple, Data loss, Denial of Service, Featured, iOS, Java, Law & order, Malware, Privacy, Social networks, Vulnerability

Tags: Adobe, Android, Anti-virus, Anti-virus for Android, APSA 12-01, Bank of America, Banking, DDoS, denial of service, Do Not Track, Facebook, flash, ftc, hacking, IEEE, Java, Joe Lieberman, Kim Dotcom, Malware, Microsoft Windows Update, NFC, PHP, phpMyAdmin, ransomware, Security Explorations, Sophos Mobile Security, Sophos Support, sourceforge, Telvent, Twitter, Virus Bulletin

View the original article here

Leading US banks targeted in DDoS attacks

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Attacks against the websites of leading banks in the United States have the banking and financial services industry on edge.

The Financial Services ISAC (Information Sharing and Analysis Center) set its Threat Level to “High” on Wednesday, September 19, indicating a high risk of cyber attacks.

That proved prophetic, as websites for banks including Bank of America, JP Morgan Chase and Wells Fargo suffered outages in recent days that some are attributing to politically motivated hacktivist groups.

A string of statements posted online in the last week has claimed responsibility for the attacks in the name of a Muslim hacking group calling itself Izz ad-Din al Qassam Cyber Fighters.

The group has claimed responsibility for attacks on the New York Stock Exchange, Bank of America and Chase last week. This week brought attacks against Wells Fargo, US Bank and PNC.

Wells Fargo used its Twitter account to apologize for service interruptions on Wednesday and said it was working to "quickly resolve this issue." Most of the targeted banks were back online and operational Thursday.

The events prompted U.S. Senator Joe Lieberman (I-CT) to use an interview on C-SPAN to point the finger of blame at the Iranian government and its elite Quds Force.

Lieberman said he believed the attacks were in retaliation for attacks on that country’s nuclear program, though he didn’t offer any evidence to support his claim. Gholam Reza Jalali, the head of Iran’s Civil Defense Organization, denied that the country was behind the attacks in a statement to Iran’s Fars News Agency.

Public statements on Pastebin taking credit for the attacks don’t mention Iran’s nuclear program as a motivation.

However, they do mention the roiling controversy about the anti-Islamic film "Innocence of Muslims" that has provoked riots and civil unrest throughout the Muslim world.

"These series of attacks will continue until the Erasing of that nasty movie from the Internet," one statement reads.

Of course, as is always the case, it was impossible to verify the authenticity of any of the statements posted online or their connection to whomever is responsible for the attacks against the banking websites.

Politically motivated hacks – or hacktivism – have been on the rise in recent years, with the activities of Western-based groups like Anonymous and Lulzsec drawing attention to the doings of ideologically motivated hacking crews.

But the phenomenon isn’t limited to Europe and the United States.

Politically aligned hacking groups are also common in Asia and the Middle East. Notably: a group called Electr0n defaced Libya’s top level domain with messages opposed to then-dictator Muammar Gaddafi.

Follow @paulfroberts
Follow @NakedSecurity

Bank image from Shutterstock.

Tags: Bank of America, Banking, BoA, Chase, DDoS, denial of service, hacking, hacktivism, Iran, Izz ad-Din al Qassam Cyber Fighters, US Bank, Wells Fargo

View the original article here

Shh/Updater-B false positive by Sophos anti-virus products

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Latest information:

Knowledge base article: http://www.sophos.com/en-us/support/knowledgebase/118311.aspx

We will continue to update the knowledge base article above with the latest advice for self-service. Please consider following our support team @SophosSupport on Twitter for updates.

Updated article below:

Some Sophos customers have reported detections today of Shh/Updater-B.

Many of these reports involve detections of Sophos's own code, but there are a number of third-party applications which are also being identified.

Sophos would like to reassure users that these are false positives and are not a malware outbreak, and apologises for any inconvenience.

If you have Live Protection enabled, you should stop seeing these detections as the files are now marked "clean" in the cloud. (Details of how to enable Live Protection can be found in this knowledgebase article).

If you do not have Live Protection enabled you will stop seeing the new detections once javab-jd.ide has been downloaded by your endpoint computers (released at Wed, 19 Sep 2012 21:32 +0000 UTC).

There is no cleanup for this detection, and you will see it quarantined unless you have your on-access policy set to move or delete detections if cleanup is not possible.

Please double check your SAV policy under cleanup; You want to ensure your secondary option (when cleanup is not available or does not work) to be set to ‘deny access’ and not delete or move. Once the detections have stopped, you can acknowledge the alerts in the Console, this way you can see who is still reporting it, and confirm it is trending down.

You should also check that any third-party applications that may have been erroneously detected as Shh/Updater-B are restored.

Further information:

Knowledge base article: http://www.sophos.com/en-us/support/knowledgebase/118311.aspx

The knowledge base article will be updated as appropriate. Please consider following our support team @SophosSupport on Twitter for updates, and if you have a support question use our online product support forum.

http://twitter.com/SophosSupport

http://twitter.com/NakedSecurity

View the original article here

Emergency security patch issued by Microsoft to squash Internet Explorer zero day exploit

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Microsoft has released an out-of-cycle security update to protect Internet Explorer users against a vulnerability that was being exploited by malicious hackers.

Earlier this week Microsoft announced it would be issuing Security Update MS12-063, following the discovery last weekend by researcher Eric Romang that the previously unknown vulnerability was being used by a hacking gang to infect computers with the Poison Ivy Trojan.

Normally Microsoft releases security updates on a monthly schedule (known as "Patch Tuesday"), but as the heat rose with exploits using the attack and the likes of the German government urging users to stop using Internet Explorer, the software giant rightly moved to release an out-of-band emergency patch.

As well as defending against the zero-day vulnerability in versions of Internet Explorer, Microsoft's security patch reportedly resolves four other remote code execution vulnerabilities that Microsoft says are not currently being exploited.

In my opinion, computer users should be grateful for Microsoft's response. They managed to create, test and roll out a patch for the Internet Explorer security vulnerabilty Romang discovered being exploited by malicious hackers within a week.

That's not just good news for those who love Internet Explorer. All of us on the net reap the benefits when vulnerabilities are patched, as it gives malicious attacks less opportunities to spread.

Now it's the turn of businesses to roll out the patch across their computers, and for home users to install the security update (hopefully most of them have automatic updates enabled).

The SophosLabs analysis of the latest Microsoft security patch can be read here.

http://twitter.com/gcluley

Bandaid on knee image from Shutterstock.

View the original article here

Microsoft releases fix for Internet Explorer security hole, full patch coming Friday

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Microsoft has issued a simple Fix It tool to fix the zero day security vulnerability in Internet Explorer that has been causing headlines this week.

And, according to a blog post by the firm, a cumulative security update will be distributed via Windows Update addressing the issue on Friday.

That's bound to come as a relief for Internet Explorer's many users and - no doubt - for Microsoft as well.

The security issue issue was so severe, that the German government and others urged users to switch browsers until a proper patch was available.

Learn more about Microsoft's Fix It tool

The out-of-cycle Microsoft security patch (MS12-063) is scheduled to be released on Friday 21 September, at approximately 10am PDT.

http://twitter.com/gcluley

View the original article here

Hacker empties high roller's online Poker account of $115K

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A high stakes online poker player says that an unknown hacker used a malicious image file to compromise his account and empty of it of more than $100,000 in winnings – the latest in what players say is a string of scams.

The player, who uses the handle _MicahJ_, claims that he was lured into a trap by a fellow member of a twoplustwo forums to an online poker game to size up his online holdings.

That user then sent an email containing a malicious image file that installed a keylogging Trojan on his system. The attacker then emptied the account of over $115,000 in poker winnings over three days.

"I knew I shouldn't have opened it but didn't think until after the matter. I contacted others on suspected scamming but couldn’t get anything done until it was too late," he wrote.

According to the user, who did not immediately respond to requests for comment, the hacker – using the handle highgrind22 - gained access to an account at the website Lock Poker for three days. During that time he made small transfers out of the account to an account linked to a yahoo.com email address. The attacker also played in high stakes games, losing around $80,000 to another player.

The post, on Saturday, elicited hundreds of responses from twoplustwo users, most online poker players themselves. The ensuing conversation has become something of an online 'whodunnit,' with players attempting to uncover the identity of the attacker, and others stepping forward to clear their name from the scandal.

The list of suspects includes a twoplustwo forum member who uses the handle WHITNEYDOH, and who made tens of thousands of dollars in online winnings playing against what _MicahJ_ claims was a hacked account. After briefly having his account suspended by Lock Poker, however, that user was reinstated and claims innocence.

It is not known for sure if _MicahJ_ was the victim of a malicious software attack and, if he was, what kind of malware was used.

In posts to twoplustwo he claims to be a Mac user, which means that any malware used would have to work on that platform. Also unclear is whether Lock Poker provides any insurance for online holdings, or any monitoring to prevent sudden and unexplained account-to-account transfers.

LockPoker declined to comment. "We cannot disclose any findings of any investigation for privacy and security concerns," the company said in an email to Naked Security. "Rest assured, we put a significant amount of time, resources and technology in minimizing the chances of fraud occurring."

Online poker forums are a popular target for hackers, given the large sums of money that change against online gaming. In fact, twoplustwo was a victim of a hack in April that reportedly compromised the accounts of forum members.

In March, 2011, a 29 year-old man received two years in prison for hacking into a computer server, stealing and then laundering 400 billion virtual poker chips from the online gaming firm Zynga worth an estimated $12 million.

Past attacks, however, have focused on online poker platforms as much as players.

In 1999, researchers (including Adobe’s security boss Brad Arkin) famously identified an off-by-one error in a shuffling algorithm used by the Web site PlanetPoker.

That allowed the researchers to predict the outcome of supposedly "random" virtual deck shuffles used on the site.

Follow @paulfroberts
Follow @NakedSecurity

Poker player image from Shutterstock.

Tags: 2+2, account hijack, account takeover, Gaming, hacking, Lock Poker, mac, Malware, No Limit Hold 'Em, Poker, poker chip

View the original article here

Twitter DMs from your friends can lead to Facebook video malware attack

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Have you received a Twitter message from an online friend, suggesting you have been captured in a Facebook video?

A number of Naked Security readers have been in touch in recent days regarding a variety of direct messages that have been spammed out from compromised Twitter accounts.

The aim of the messages? To trick the unwary into clicking on a link.. and ultimately infect computers.

Here is one example:

your in this LoL

And here's another. Note that there are many different combinations of wording that can be used.

you even see him taping u thats awful

Users who click on the link are greeted with what appears to be a video player and a warning message that "An update to Youtube player is needed". The webpage continues to claim that it will install an update to Flash Player 10.1 onto your computer.

In this example, the program you are being invited to download is called FlashPlayerV10.1.57.108.exe, and is detected by Sophos anti-virus products as Troj/Mdrop-EML, a backdoor Trojan that can also copy itself to accessible drives and network shares.

Quite how users' Twitter accounts became compromised to send the malicious DMs in the first place isn't currently clear, but the attack underlines the importance of not automatically clicking on a link just because it appeared to be sent to you by a trusted friend.

If you do find that it was your Twitter account sending out the messages, the sensible course of action is to assume the worst, change your password (make sure it is something unique, hard-to-guess and hard-to-crack) and revoke permissions of any suspicious applications that have access to your account.

http://twitter.com/gcluley

Birds image from Shutterstock.

View the original article here

Over 9 million PCs infected - ZeroAccess botnet uncovered

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

ZeroAccess is a hugely widespread malware threat that has plagued individuals and enterprises for years. It has evolved over time to cater for new architectures and new versions of Windows.

Here at SophosLabs we have looked at previous incarnations of the ZeroAccess rootkit in depth, describing how it enslaves victim PCs, adding them to a peer-to-peer botnet which can receive commands to download further malware.

Most recently, Sophos's researchers explored how ZeroAccess took a major shift in strategy, operating entirely in user-mode memory.

Due to the continued high profile of this malware family we felt it was necessary to examine the threat in greater detail, not only the latest version of ZeroAccess, but also the ZeroAccess botnet as a whole.

SophosLabs researchers can reveal that the current version of ZeroAccess has been installed on computers over nine million times with the current number of active infected PCs numbering around one million.

ZeroAccess uses a peer-to-peer network to download plugin files which carry out various tasks designed to generate revenue for the botnet owners. Our researchers monitored this network for a period of two months to discover where in the world the peers were located and what kind of files the botnet was being instructed to download.

We found the IP addresses of infected machines from a total of 198 countries ranging from the tiny island nation of Kiribati to the Himalayan Kingdom of Bhutan, as can be seen when the infected machines are plotted on a world map:

The largest numbers of infected computers were found in the USA, Canada and Western Europe:

Our research has discovered that the ZeroAccess botnet is currently being used for two main purposes: Click fraud and Bitcoin mining.

If running at maximum capacity the ZeroAccess botnet is capable of making a staggering amount of money: in excess of $100,000 a day.

We have also reverse-engineered the mechanisms by which the ZeroAccess owners keep tabs on the botnet, and discovered an array of techniques used that are designed to bury the call-home network communications in legitimate-seeming traffic.

You can find out much more about ZeroAccess in our new technical paper - "The ZeroAccess Botnet - Mining and fraud for massive financial gain".

Follow @SophosLabs

Snake in the shape of a zero image from Shutterstock.

View the original article here

Monday review: the hot 18 stories of the week

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Tags: Android, BlackHole, BMW, chrome, CVE-2012-4969, Do Not Track, Exploit, face, Facebook, facial recognition, false positive, Fix it, Home Depot, Internet Explorer, Justin Lee, Lock Poker, Malware, Microsoft, Poison Ivy, Poker, RSA, Sophos, Subway, vulnerability, Zero Day, ZeroAccess

View the original article here

Kim Dotcom now a "real life James Bond villain" in latest Megaupload dot bombshell

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Things just got even more exciting/weird/incredible (delete as inapplicable) in the up-down-left-right saga of Kim Dotcom and Megaupload.

Kiwi top man - New Zealand Prime Minister John Key - has just weighed into the battle.

Kim Dotcom, as Naked Security readers will be unlikely to forget, is the larger-than-life file sharing entrepreneur who was arrested last year at his rented home in New Zealand.

(Dotcom wanted to buy the property - New Zealand's most expensive - but he failed the Kiwi authorities' "good character" test due to criminal convictions for insider trading and embezzlement.)

Dotcom is facing extradition to the US, where he's been charged with a raft of serious offences related to his online service Megaupload, including racketeering (organised criminality) and money laundering.

Dotcom styles himself a "Freedom Fighter" on Twitter, presumably in reference to his own fight to remain free of US jurisdiction.

So far, he hasn't been doing too badly, having already:

* Got out on bail, despite initially being remanded in custody.

* Had the search of his house declared legally dodgy.

* Won the right to see previously-suppressed FBI evidence against him.

* Obtained approval from the courts to access millions of dollars of previously-frozen funds.

He'll no doubt be delighted at the latest development in his legal battle. The New Zealand Government's official website, beehive.govt.nz, has published the Prime Minister's call for an official inquiry into the actions of the country's own intelligence service in garnering evidence against Megaupload.

Prime Minister John Key today announced he has requested an inquiry by the Inspector-General of Intelligence and Security into the circumstances of unlawful interception of communications of certain individuals by the Government Communications Security Bureau.

In American English, that means "illegal wiretap".

It's the stuff of movies - as Dotcom, apparently unable to resist a cliche when it presents itself, has already pointed out:

I'm now a real life James Bond villain in a real life political copyright thriller scripted by Hollywood & the White House.

I guess he'd better hope his prescience is as limited as his modesty!

(Things often end fairly badly for the crooks in Bond films, after all.)

Follow @duckblog
-

Tags: bail, dotcom, extradition, file-sharing, filesharing, GCSB, James Bond, john key, kim, megaupload, new zealand, surveillance, warrant, wiretap

View the original article here

Apple Mountain Lion 10.8.2 - lots of bug fixes, no known vices

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Together with the much-vaunted launch of the iPhone 5 last week came Apple's public release of its latest mobile operating system upgrade, iOS 6.

Not quite as widely-hyped as iOS6 was another system update that Apple released at the same time: OS X 10.8.2, the second major update to the Mountain Lion product.

With a couple of working days plus a weekend under its belt, OS X Mountain Lion 10.8.2 - and its sibling upgrades, Lion's 10.7.5 and Snow Leopard's Security Update 2012-004 - don't seem to have caused early adopters any major problems.

In short, it looks like a case of "no known vices."

And that raises the question, "Should I stay or should I go?"

I'd suggest, "Go!"

These latest OS X upgrades include 27 separately-documented fixes (not all of them apply to all OS X versions); overall, 95 different CVEs are dispatched, with 12 of the vulnerabilities annotated with the dreaded words "may lead to arbitrary code execution".

Here they are, coalesced into a single table:

Component OS Vulnerability CVEs fixed

* The initials S, L and M denote that the vulnerability affects Snow Leopard, Lion and Mountain Lion respectively.

* DoS stands for Denial of Service.

* RCE stands for Remote Code Execution.

As often happens with simultaneous upgrades to three different core versions of OS X, there isn't a one-size-fits-all download you can apply.

Mountain Lion users move to 10.8.2, which includes an update from Safari 6.0 to 6.0.1.

The Safari update is pretty important, as it fixes data leakage vulnerabilities in the browser front-end, as well as potential remote code execution holes in WebKit, OS X's core HTML rendering technology.

Lion users also get a new point release, going to 10.7.5, but don't get Safari 6.0.1 bundled in with it. That's a separate update, predictably called Safari 6.0.1.

On Snow Leopard, the security fixes don't change the OS version. You need Security Update 2012-004 and, like Lion users, the separate package for Safari 6.0.1.

Apple also published an iPhoto update at the same time: if you're on Mountain Lion, as I am, you'll find you have to go to 10.8.2 before you can get the "performance and stability improvements" promised by upgrading iPhoto.

By the way, the new version of OS X Mountain Lion was a 366MByte download; iPhoto on its own clocked in at 373MBytes.

I suspect Apple is trying to tell me something there - I just haven't worked out what it is yet.

Follow @duckblog
-

Tags: Apple, cve, DOS, Exploit, Lion, Mountain Lion, OS X, Patch, rce, Snow Leopard, update, vulnerability

View the original article here

Under pressure, Facebook disables facial recognition in Europe

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Facebook is dropping its controversial facial recognition feature, for European users at least, following a privacy backlash from users and regulators.

But it may not be long before it returns..

The social networking giant has agreed to suspend facial recognition in Europe, following demands by the European Union on the social network to improve its customer privacy protection.

Facebook removed access to its "Tag Suggest" feature at the request of Ireland's Data Protection Commissioner (DPC).

That controversial feature matches the faces in photos posted to Facebook with users, making it easier for Facebook users to identify individuals pictured in photographs they upload to the site.

The DPC was charged with reviewing Facebook’s privacy practices to determine whether they were in-line with EU data privacy laws. An audit completed by the agency in December, 2011, recommended 45 changes to the social network’s features to improve user privacy protections.

The audit followed a public uproar after an Austrian student, Max Schrems, requested a copy of the data that Facebook stored about him.

Schrems received a 1,200 page document that suggested the company was collecting awide range of information about users without their consent, and holding onto information – photos and comments – that users had been led to believe were deleted.

Among the data retained by Facebook were photo tags – many attributed without the subject’s consent using automated facial recognition technology embedded in Facebook's service.

That feature, dubbed "Tag Suggest" came under scrutiny in the DPC audit, with the Irish agency arguing that Facebook needed to give users the option of opting out of the Tag Suggest feature.

During negotiations, the European Commission further issued Article 29, a ruling on the use of facial recognition and other biometric technology in mobile devices.

During negotiations with the DPC, Facebook disabled the feature for EU users.

In a report issued Friday, the DPC said that Facebook had relented on Tag Suggest: adding prominent notices to users about the feature and giving them the option of easily disabling use of it with their facial profile. Further, the DPC asked Facebook to delete collected facial profiles on EU users by October 15.

The 74 page report, signed by DPC Deputy Commissioner Gary Davis, found that Facebook had largely complied with the DPC’s recommendations on a range of issues: making its privacy policies more transparent, limiting the extent to which user-generated data can be used in targeted advertising and making it easier for users to permanently delete data such as tags, wall posts, friend requests and pokes from the network.

A statement given by the social network to TechCrunch makes clear that it's unlikely to be long before facial recognition returns for European users, with agreement from European regulators:

"It's worth us reiterating that once we have a agreed an approach on the best way to notify and educate users with the DPC, we hope to bring back this useful tool."

Meanwhile, German regulators have demanded that Facebook complies with laws in the country, and can only create and store biometric profiles (such as those used by its facial recognition feature) with the consent of users:

"The company has to make sure that biometric profiles of its already registered users will only be created and stored with their active consent. Additionally, users have to be informed about risks of the practice in advance."

In June 2011, Naked Security revealed how Facebook had changed the privacy settings for millions of its users, without requesting prior permission - enabling facial recognition.

Facebook has run afoul of privacy advocates in both the United States and the European Union before, of course.

In November, 2011, the social network reached a settlement with the US Federal Trade Commission over charges that it deceived users about how data they stored on Facebook’s servers would be shared and made public.

That settlement also required Facebook to make its data sharing practices more transparent to users.

However, the EU generally has stronger consumer protections than the US and regulators there were wary of a number of practices, including how data might be shared between applications running on Facebook’s platform.

In its agreement with the EU, Facebook – in almost every case – agreed to comply with EU best practices, at least for data held about EU customers.

Follow @paulfroberts
Follow @NakedSecurity

Mannequin image from Shutterstock.

View the original article here

US schools track teens by putting chips into students' ID cards

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A Texas school district in the US is putting tracking chips into new, mandatory student IDs to keep tabs on students' whereabouts at all times.

The one-year pilot test is being rolled out in October for some 4,200 students in the John Jay High School and Anson Jones Middle School, which are two of the 112 schools in the district.

Students will be required to wear the cards on a lanyard around their necks and will be charged a fee for losing them.

Their location will be beamed out to electronic readers throughout the campuses, Northside Independent School District spokesman Pascual Gonzalez told FoxNews.com.

Some parents are protesting, comparing the tags to RFID chips used to track cattle.

Steven Hernandez, a father of a student who attends the Texas school and the only local parent to attend a protest late last month, told KSN News that the new badges amount to "a spy chip".

His daughter, Andrea, a sophomore, told KSN that she's decided to wear her old photo ID even though students were told the new micro-chip ID is mandatory:

"It makes me uncomfortable. It’s an invasion of my privacy."

She's also concerned about who else might track students besides educators.

Although the school district assures parents that the ID cards don't work outside of school, Andrea Hernandez says she's worried, given that the RFID chips can't be turned off and continue sending a signal even when students leave the building:

"With a smart phone you can use the option to use your locator but this I can't turn … off"

According to FoxNews, a letter addressed to parents hypes the cards on the basis of helping educational staff to keep track of the 3,000 students now at Jay High School and Jay Science & Engineering Academy, which is particular helpful when catastrophe strikes.

The schools are also hoping the cards will help them to save money, given their potential use in the cafeteria and library, and that using the cards will help them to keep non-students off the grounds.

What could possibly go wrong?

Gosh, I don't know. How about someone stalking your kids, knowing exactly where they are throughout the day? Good thing the chips are going into ID cards, not into the kids themselves.

Forgive me if that's an overreaction, but my mind has conflated this chipping news with the Girls Around Me stalking application.

If you didn't catch John Brownlee's Cult of Mac writeup about Girls Around Me, here's his description of the application (also known as a "game", though likely that fun-filled word is what stalkers would use to describe it, not its targets/victims):

"...a radar overlaid on top of a Google Map, out of which throbs numerous holographic women posing like pole dancers in a perpetual state of undress."

The location aspect is fed by check-ins from Foursquare and Facebook, and it's fueled by publicly available information posted on those sites.

In other words, it's a perfect case study of how publicly available data, supplied willingly (or cluelessly) by these social networks' users, can be turned into a stalking app.

As Girls Around Me says in its promos:

In the mood for love, or just after a one-night stand? Girls Around Me puts you in control! Reveal the hottest nightspots, who’s in them, and how to reach them...

Do we really want people we don't know "in control?"

The Texas chipping scenario involves school teachers and administrators who want access to children's exact whereabouts - they're not creepy stalker guys looking for a one-night stand.

Thing is, what if someone with a nefarious agenda works in our school systems?

Just on Thursday this week, the Boston Globe reported that a pediatrician and former medical director at a private boys academy had been charged with having 500+ photos and 60+ DVDs of child porn in his Andover, Massachusetts home.

So, will these RFID tags be effective?

As Andrea Hernandez pointed out, her classmates certainly won't stop skipping classes because of the RFID tags.

Instead, they'll just stuff them into a locker or hand them off to a friend, she said.

As FoxNews reported, a coalition of privacy and civil liberties organizations and experts have called for a moratorium on the technology, including the American Civil Liberties Union and Liz McIntyre, author of "Spy Chips: How Major Corporations and Government Plan to Track your Every Purchase and Watch Your Every Move."

McIntyre told FoxNews that one of her main concerns about the technology is that the electronic readers could get into the wrong hands.

As it is, these kids are already ultra-surveilled.

The district now has digital surveillance cameras in all high schools and middle schools and on all buses, plans to install digital cameras in elementary schools, and keeps police officers on duty.

Is that really not enough?

Chipping the kids might well have benefits for a cash-strapped school district, but it would be nice to teach children the values of privacy, and those lessons won't be taken seriously unless school boards practice what they preach.

And here's a note to Mr. Hernandez: congratulations. You've raised a smart young woman.

Here's hoping she's also savvy about publicly displayed information on Facebook and other sites.

Follow @LisaVaas Follow @nakedsecurity

Big Brotherschool teen and RFID tag images thanks to Shutterstock.

Tags: ACLU, Andrea Hernandez, Anson Jones Middle School, Foursquare, ID cards, John Jay High School, Liz McIntyre, RFID, RFID chip, school, Steven Hernandez, tagging, Texas

View the original article here

Book review: Practical Malware Analysis

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Earlier this year, no starch press, sent SophosLabs an unrequested copy of the book Practical Malware Analysis: The hands-On Guide to Dissecting Malicious Software with a letter saying "If you do enjoy the book, I hope that you will consider posting a review ...". Well I enjoyed the book and so here is the review :)

Both authors, Michael Sikorsji and Andrew Honig, have impressive resumes (NSA, MIT and DoD) and list of reviewers looks impressive including: Sal Solfo (Columbia University) and Ilfak Guilfanov (IDA).

The book is well written and, like an academic textbook, each chapter ends with a series of questions and lab exercises. What is more, unlike text books, the teacher's answer copy is in the Appendix - it accounts for nearly *half* the book.

The book consists of 6 parts plus the Appendices:

Part 1: Basic AnalysisPart 2: Advanced Static AnalysisPart 3: Advanced Dynamic AnalysisPart 4: Malware FunctionalityPart 5: Anti-reverse-engineeringPart 6: Special TopicsAppendix A: Important Windows FunctionalityAppendix B: Tools for malware analysisAppendix C: Solutions to Labs

The book is a great primer on malware analysis, but there are more topics it could have covered (non-Windows and ARM analysis). Also, some of the topics that are covered could benefit from a bit more detail. As an example of this, Chapter 2: Malware Analysis in a Virtual Machine focuses on VMWare. It's certainly well written and edited, but it didn't touch VirtualBox or discuss how to use virtual machines to automate analysis. Which is a shame.

With the rise of eReaders and tablets, this could be one of the last books of this type. Monolithic book likes these means that you need to buy the next edition of the book to get any updates. Electronic books allow for small and incremental updates to the content at little or no cost to the user and to the publishers.

Once you have read Practical Malware Analysis, you will be able to top up your knowledge quite easily using the powers of the internet.

Would I buy this book if I saw it sitting in a shop window? Probably not. But go back 15 years when I was just starting out in the field, this would have been a goldmine of information.

So, if you're starting out in malware analysis (like our SophosLabs' intern Julian), or if you are are coming to analysis from another discipline, I'd recommend having a nose.

Follow @nakedsecurity
Follow @SophosLabs

View the original article here

Malware attack blasted out in "Important Changes to Microsoft Services agreement" email

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

If you received an email, apparently from Microsoft, claiming to be about "Important Changes to Microsoft Services Agreement" would you trust it?

From the naked eye, after all, it looks professionally presented, has Microsoft's funky new logo.. what could be wrong with this? (Feel free to click below for a larger version if you want to take a closer look.)

Part of the email reads as follows:

Message body:

We've updated the Microsoft Services Agreement , which governs many of our online services - including your Microsoft account and many of our online products and services for consumers, such as Hotmail, SkyDrive, Bing, MSN, Office.com, Windows Live Messenger, Windows Photo Gallery, Windows Movie Maker, Windows Mail Desktop and Windows Writer. Please read over the new Microsoft Services Agreement in the attached file to familiarise yourself with the changes we've made.

The updated agreement will take effect on 19 October, 2012. If you continue to use our services after 19th October, you agree to the terms of the new agreement or, of course you can cancel your service at any time.

We have modified the agreement to make it easier to read and understand, including using a question and answer format that we believe makes the terms much clearer. We also clarified how Microsoft uses your content to better protect consumers and improve our products, including aligning our usage to the way we're designing our cloud services to be highly integrated across many Microsoft products. We realise you may have personal conversations and store personal files using our products, and we want you to know that we prioritise your privacy.

The text of the email *is* apparently genuine, as there was an actual Microsoft message - dated August 27 - that can be viewed here.

The clue which should ring your alarm bells about this latest email, however, comes in the attached file: Microsoft-Services-Agreement.pdf.exe.

To those lacking in caution (or indeed, those Windows users who haven't told their operating system to show filenames in full) the attached file might appear to be an Adobe PDF document rather than an executable file.

But sure enough, it is an EXE file. And it will embed itself as a backdoor Trojan horse in your Registry to automatically run on startup.

Nasty.

Of course, the emails were not sent by Microsoft at all. Cybercriminals have forged the email header to trick unsuspecting users into believing the communication is legitimate, and click on the attached file.

So, don't be fooled by fancy fonts, trustworthy names and bland corporate-style emails like the above. Not all malware threats are spammed out posing as scandalous videos of Olympic gymnasts or a pigtail-wearing young woman who claims she went to school with you.

Sophos products detect the malware used in this attack as Troj/Backdr-HG.

Follow @gcluley

View the original article here

Google, Facebook, Microsoft join non-profit to promote internet's awesomeness [VIDEO]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The Internet is mostly a good place filled with good people trying do good things. Except for those few bad people doing bad things - people you should really watch out for when you’re online. Be careful out there! OK?

If that sounds like the fuzzy-headed advice you’d give your budding adolescent, rest assured: there’s now a website that weaves together all the messy threads of contradictory guidance in one, easy to access location.

It’s called A Platform for Good, and it has the backing of some of the internet’s leading firms, including Facebook, Google and Microsoft.

Of course, Facebook, Google and Microsoft getting together behind something is always news. So, when the three tech giants announced on Wednesday that they signed up to support A Platform For Good, we decided to look into it.

The partnership, which also includes Yahoo! and major carriers like AT&T, Verizon and Sprint, seeks to “highlight the positive power of the internet” and provide an online portal that helps “parents and teens connect, share and do good,” according to a press release by the Family Online Safety Institute (FOSI), a UK-based non-profit that “works to make the online world safer for kids and their families.”

FOSI and its partner organizations hope to counter the negative stereotypes of the internet as a dark and dangerous place. In a statement, FOSI said:

The stories reported in the news and infusing public conversation are focused heavily on the negative notions that don't support the research that says the majority of people's online experiences are positive. Given this climate, it is our hope that PfG (Platform For Good) will create a place to have a more balanced discussion about the role digital technology can play in our lives.

When it comes to protecting you and your kids online, A Platform for Good does a good job pulling together links to the privacy statements for the major social networks, along with information (where available) on how users can protect their privacy online.

But some of the information is still lacking. Click on Computer Security and you find a link off to Microsoft’s page on preventing spyware infections. And nothing else.

The Mobile Safety section has links to AT&T content about the dangers of texting while driving, and a (solid) Yahoo page on mobile safety tips that talks (albeit obliquely) about problems like sexting, online bullying and mobile malware.

It’s all right-minded and we’ll add it to the long list of private initiatives to foster online safety. While we’re at it, we’ll put Google, Facebook and Microsoft to the list of companies whose hearts are in the right place.

But do these initiatives work once the ink is dry on the press release?

Providing scads of links to overlapping but uncorrelated discussions of the same problems is, it seems to me, a great way to engender confusion – not understanding.

You could forgive a parent, teacher or teenager from looking at a page full of links to identical sounding programs and hitting the browser “Back” button post-haste.

The truth is that mobile malware and drive-by downloads are difficult to predict or prevent, even under the best of circumstances.
Schools that want to teach online safety should start with a frank discussion of how modern malware works, the kinds of behaviors that increase the risk of you being targeted or infected, and what to do in the unfortunate event that you become a victim.

It isn't easy, as this video shows:

There’s also something important missing with A Platform for Good – namely: a substantive discussion of the very real problems that the internet and rapid technology adoption are introducing into childhood and adolescence.

In 2011, for example, The Pew Research Center has conducted studies that found ample evidence that social media use is associated with what Pew characterized as “cruel and unkind” behavior.

True, most teens think that their peers, generally, are nice to each other online rather than mean. But Pew found that one in three girls age 12-13 said that their peers were “mostly unkind” to each other on social media.

And, when the questions became more specific, teens in focus groups had no trouble conjuring personal stories about examples of online bullying, harassment and intimidation from their own peer group. They also depicted an environment in which online action and IRL (in real life) behaviors blur.

Here’s one exchange from a peer group in Pew’s report on “Teens, kindness and cruelty on social network sites”:

MIDDLE SCHOOL GIRL: I read what they were talking about online, then I go offline and confront the person who was saying something to her.

MIDDLE SCHOOL GIRL: …Like that’s how most people start fighting because that’s how most of the fights in my school happen – because of some Facebook stuff, because of something you post, or like because somebody didn’t like your pictures.”

We’ll chalk A Platform for Good up to “good intentions,” but perhaps it’s unrealistic to expect companies like Facebook, whose financial survival hinges on getting its users to share more online, to come down hard in favor of public health in the debate about online safety and online privacy.

This is a problem that’s bigger than Facebook, Microsoft and Google, and a problem that governments and the voters that elect them have to decide to solve.

In the meantime, you can always download the free Threatsaurus: The A-Z of computer and data security threats for practical tips to stay safe from email scams, identity theft, malware and other threats.

Follow @paulfroberts Follow @nakedsecurity

girl raising hand image courtesy of ShutterStock.

Tags: A platform for good, Android, Apple, bullying, education, Facebook, Google, Malware, Microsoft, mobile devices, online safety, Privacy, schools, teachers

View the original article here