Nastiest Malware 2023
News, Announcements, Tech Discussions
[H2]Redmond no longer tells world about bugs until it checks own exposure[/H2]By [url=http://www.theregister.co.uk/Author/2823]Darren Pauli[/url], 15 May 2014 [b]AusCERT[/b] A team of Microsoft researchers had kicked an own goal by alerting a third party to a zero day vulnerability that they were unaware also affected Redmond. The gaffe in the early days of the Microsoft Vulnerability Research (MSVR) team didn't result in Redmond getting owned, but prompted the creation of a rule in the department that all vulnerabilities sent out to third parties be checked for effectiveness against Microsoft's own kit. Microsoft security bod Jeremy Brown described the scenario which was manipulated to protect the researchers involved. "There's this problem that occurs in payment networks where you can report two transactions and get paid multiple times. They reported it to a couple of payment networks but what they didn't report it to was Microsofts own p
Following its usual months-long testing process, Apple released [url=http://support.apple.com/kb/HT6228]OS X version 10.9.3[/url] to the general public today. The third major update to the operating system provides the usual blend of security patches, bug fixes, new (and restored) features, and future-proofing enhancements. As was discovered shortly after the first 10.9.3 beta was released, the new update [url=http://arstechnica.com/apple/2014/03/first-os-x-10-9-3-beta-comes-with-improved-4k-display-support/]improves 4K display support[/url] specifically on the 2013 Mac Pro and the 15-inch 2013 Retina MacBook Pro. When those computers are connected to a 4K display, they should be able to display images in OS X's HiDPI "Retina" scaling mode by default, and they should support the faster 60Hz refresh rate on compatible monitors. "Retina" mode will make on-screen images larger and sharper, while the refresh rate increase will make UI animations, videos, and game
by [url=http://nakedsecurity.sophos.com/author/nslisavaas/]Lisa Vaas[/url] on May 15, 2014 Feeling head-naked? Unconnected? Bereft of at-your-eyeball search functionality and the ability to record surroundings and innocent bystanders? Fret no more! Google's now prepared to gadgetize the domes of those US persons who haven't yet signed up to "Explore" the world with [url=http://nakedsecurity.sophos.com/?s=glass]Glass[/url] and thereby potentially really, really annoy the privacy-conscious. The purveyor of the [url=http://nakedsecurity.sophos.com/2013/03/12/google-glass-the-ultimate-creepy-stalker-toy/]creepy streaming-video spectacles[/url] [url=https://plus.google.com/u/0/+GoogleGlass/posts/QLD88fE7qmE]announced[/url] on Tuesday that anybody whose pockets are being burned with a surplus $1,500 can now get the head huggers. [url=http://nakedsecurity.sophos.com/2014/05/15/google-opens-up-glass-to-the-us-masses-for-1500-a-pair/]Full Article[/url] They aren't cheap.
ROCHESTER, Minn. (KTTC) -- Researchers at Mayo Clinic have proven that the measles virus can be used to successfully treat cancer. So far they've only seen success in one patient, but Mayo says the results could have big implications for the future. Eleven months ago, multiple myeloma patient Stacy Erhotlz had exhausted all the traditional treatment options. [url=http://www.kttc.com/story/25520514/2014/05/14/mayo-clinic-successfully-uses-measles-virus-to-treat-cancer]http://www.kttc.com/story/25520514/2014/05/14/mayo-clinic-successfully-uses-measles-virus-to-treat-cancer[/url] I've seen plenty of articles on promising new cures, but this one strikes me as more promising than most!
[url=http://www.theatlantic.com/health/archive/2014/05/a-breathalyzer-that-can-diagnose-cancer/362102/]http://www.theatlantic.com/health/archive/2014/05/a-breathalyzer-that-can-diagnose-cancer/362102/[/url] They claim they'll be able to diagnose everything from cancer to inflammatory bowel disease. Seems like it would be a lot cheaper and faster than some other tests.
[b]Ransomware a growing threat on mobile phones, security firms say[/b] by Robert Lemos With telecommunications firms taking a stronger stance against toll fraud, attackers will likely turn to ransomware to monetize compromised devices, security firms assert. In 2013, ransomware grew to become a significant threat for computer users, as cyber-criminals refined their tactics aimed at turning compromised computers into cash. Like many other trends, ransomware appears to be going mobile, according to security firms. The group behind the Reveton ransomware program, for example, has ported the malware to Android, distributing it through pornography sites where it is disguised as a video player, according to application-security firm BitDefender. Dozens of ransomware programs have already targeted Android phones in Asia, and evidence of similar attacks in the United States shows that the trend will continue, security firm Appthority stated on May 13. "We started s
[b]Coordinated leet attackers smell like China's infamous APT1[/b] By [url=http://www.theregister.co.uk/Author/2823] Darren Pauli[/url], 15 May 2014 [b]AusCERT[/b] April's Internet Explorer flaw is being exploited, with at least two listed Australian entities targeted by a sophisticated foreign hacking outfit. The organisations were targeted in a campaign that foisted the Internet Explorer exploits ([url=https://technet.microsoft.com/en-US/library/security/2963983]MS14-021[/url]) at high end corporations three days after the dangerous flaws were exposed. Security firm FireEye reported the attacks to [i]El Reg[/i] and said the perps were part of a well-resourced and organised group in which the use of zero day exploits was delegated by what it ([url=http://www.fireeye.com/resources/pdfs/fireeye-malware-supply-chain.pdf]called a quartermaster (pdf)[/url]) to teams of various skill sets and objectives. "This group was known to introduce zero days, and was the higher-end in
Cybercriminals use 'ransomware' to kidnap consumers' hard drives in anonymous shakedowns Donna Leinwand Leger, USA TODAY On a bitter cold Friday in January, an ominous warning popped up on a computer screen at the Chamber of Commerce in Bennington, Vt. The warning — next to a ticking countdown clock — threatened to destroy all data on the computer if the chamber refused to pay a $400 ransom within 40 hours. Local computer whiz Max Squires quickly identified the culprit: CryptoLocker, computer malware that freezes access to every file, including photos, documents and programs with a secret pass key known only to the hacker. Solution: None. [url=http://www.usatoday.com/story/news/nation/2014/05/14/ransom-ware-computer-dark-web-criminal/8843633/]http://www.usatoday.com/story/news/nation/2014/05/14/ransom-ware-computer-dark-web-criminal/8843633/[/url]
By Leo Kelion Technology desk editor Autodesk - the leading 3D modelling software-maker - is going into hardware with its own 3D printer. Chief executive Carl Bass revealed the news ahead of an appearance at the MakerCon conference in California. In addition to selling the machine, Autodesk will also allow other manufacturers to make their own versions of the printer or power their own models off its software at no cost. Mr Bass likened the move to the way Google had driven adoption of Android. One analyst said the effort should encourage adoption of the technology. "The printer is a bona fide attempt to prove the interoperability and open source nature of Autodesk's platform," said Pete Basiliere, research director at the Gartner tech agency. "And by sharing its design we could see a second wave of small start-ups creating stereolithography machines just as the makers did when the early material extrusion patents expired." Stereolithography 3D printers create obj
[b]Zeus’ Reach Expands With New Webinjects[/b] by Michael Mimoso The Zeus financial malware may be old, but it’s hardly slowing down. The peer-to-peer version of the prolific Trojan was especially busy in the first quarter with infections reported by banks in 10 countries that previously had eluded Zeus’ reach. CSIS Security of Denmark said the gang behind Zeus, also known as Gameover, had used new Webinjects against 1,515 unique targets during the first three months of the year; that’s a noteworthy spike from fewer than 1,100 in January 2014. Peter Kruse, partner and security specialist at CSIS, said most of the new targets were banks and financial institutions in Africa, the Middle East, Asia and Europe. “Most of which were never hit before by malware like this,” Kruse said. “Thus are likely to take significant losses”. Kruse said the gangs maintaining and selling Zeus are improving the Webinjects used by the malware to update infected computers on the fly. Zeus
[b]Windows Vista, Not XP, Offers Up Highest Infection Rates[/b] by infosecurity Windows XP may be the operating system getting the most flack for opening up users to hackers and exploits, but it turns out that Windows Vista and Windows 7 experienced the highest infection rates in the fourth quarter of 2013. Microsoft discontinued support – including security patches – for XP in April (with an exception), opening up the door for a rash of zero-days attacking the system – so it’s likely that these numbers will radically shift for the second-quarter report. But Microsoft’s latest Security Intelligence Report detailed the vulnerability levels in various versions of Windows prior to the end-of-life cutoff for XP, and disclosed that Windows Vista, which was released in 2007, has an infection rate of 3.24%, compared to 2.42% for Windows XP, released in 2001. And at 2.59%, Windows 7 falls in the middle. Unsurprisingly, the most current OS, Windows 8.1, clocks in as the safest of them al
By [url=http://securitywatch.pcmag.com/author-bio/neil-j.-rubenking]Neil J. Rubenking[/url] May 14, 2014 8:07 AM EST [img]https://d1qy7qyune0vt1.cloudfront.net/webroot-en/attachment/10480i70DEC1C2D140ADF6.gif[/img] The first quarter of this year was filled to bursting with news stories about data breaches. The numbers were alarming—40 million or more [url=http://securitywatch.pcmag.com/internet-crime/319084-what-to-expect-after-the-target-card-data-breach]Target[/url] customers affected, for example. But the duration of some breaches also came as a shocker. [url=http://securitywatch.pcmag.com/business-financial/319767-how-ram-scraper-malware-stole-data-from-target-neiman-marcus]Neiman Marcus[/url]'s systems were wide open for three months, and the [url=http://www.pcmag.com/article2/0,2817,2429951,00.asp]Michael's breach[/url], which started in May of 2013, wasn't discovered until this January. So, are their security guys total lamers?
[list] [*]Rocky Mountain Information Security Conference, May 14-15, Colorado Convention Center, Denver [*]Event website: [url=http://rmisc.squarespace.com/]http://rmisc.squarespace.com/[/url][/list][list] [*]We are a Platinum sponsor! [*]Visit us at Booth #111 [*]Vendor track session, Thursday May 15, 9:25-10:25 pm, presented by Grayson Milbourne, Director of Security Intelligence[/list] Title: Paranoid Android – Addressing the Risks of Mobile Description: This presentation will look at the rapidly growing and evolving space of malicious Android applications. Various threat vectors will be analyzed and examples will show where the vast majority of malicious app encounters occur. In addition to an overview of the Android threat landscape, this presentation will talk about new technology aimed at protecting Android devices such as mobile application reputation. Additionally, four corners of mobile device security will be discussed as well as policy suggestions for bus
[H2]'Perfect example of how Snowden has improved our privacy' says professor[/H2]By [url=http://www.theregister.co.uk/Author/2578]John Leyden[/url], 8 May 2014 Standards stewards on the Internet Engineering Task Force (IETF) are planning to drop RSA key exchanges from TLS 1.3, the next revision of SSL. The technical body is instead eying up algorithms that use short-lived encryption keys, aka ephemeral keys, that can sidestep surveillance dragnets by the likes of the NSA. Specifically, the IETF has backed Diffie-Hellman key exchange (DHE) and ?Elliptic Curve Diffie-Hellman? key exchange (ECDHE) over RSA because the former two support Perfect Forward Secrecy (PFS). When a server and a client use SSL/TLS, they must agree upon a unique encryption key valid for just that connection session – and use it to protect their communications from eavesdroppers and tamperers. How that session key is transported between the client and server is crucial
[H2]So deleted. Very missing. Much backed up[/H2]By [url=http://www.theregister.co.uk/Author/2488]Simon Sharwood[/url], 14 May 2014 Stop us if you've heard this one before, but the day after it went down for mysterious reasons, crypto-currency wrangling site Dogevault.com has confirmed someone stole its kibble. “On the 11th of May, the Doge Vault online wallet service was compromised by attackers, resulting in a service disruption and tampering with wallet funds,” the now-sparse site says at the time of writing. “As soon as the administrator of Doge Vault was alerted, the service was halted,” the author continues. “The attackers had already accessed and destroyed all data on the hosted virtual machines.” The outfit is “in the process of identifying the extent of the attack and potential impact on user's funds.” [url=http://www.theregister.co.uk/2014/05/14/dogevault_praying_backups_work_after_confirming_attack/]Full Article[/url] &n
I have a user who is streaming youtube without issue even though they are in a blocked group. Does Web Security Service not work with Chrome?
[i][b]National Science Foundation eyes new architecture that can handle IoT, mobile, video and medical apps[/b][/i] By Sharon Gaudin, Computerworld May 13, 2014 01:36 PM ET The National Science Foundation (NSF) is investing $15 million to create a more robust, agile and secure Internet. The NSF announced on Monday it is splitting the money between three projects that are all aimed at developing better Internet architectures that are able to handle new technologies like [url=http://www.computerworld.com/s/article/9248161/Internet_of_Things_will_stump_IT_until_cloud_big_data_come_aboard_EMC_says]the Internet of Things[/url], [url=http://www.computerworld.com/s/article/9246418/Half_of_Americans_want_to_live_in_a_smart_city_with_driverless_cars]smart cars[/url] and nano devices that are straining an old architecture. The funding is expected to move efforts from the design stage to pilot programs in large-scale, realistic environments. "NSF-funded research has been instrumental in ad
