Week in review: IE zero-day patched, Flame C&Cs reveal more malware, and the new issue of (IN)SECURE Magazine
Here’s an overview of some of last week’s most interesting news and articles:
Google adds Do Not Track support to Chrome
The next official release of Google’s Chrome browser will more than likely support the Do Not Track (DNT) initiative by sending the DNT HTTP header to websites if the user chooses it, as the support was added to the browser’s latest developer build.
Online daters targeted by blackmailing scammers
The scheme starts with a woman initiating contact with men on dating sites or social networks. After chatting with her a bit and seeing how she looks like via webcam, the men get a proposition that few refuse: she will strip for them and they will reciprocate.
Foreign journalists in China targeted with malware-laden emails
Foreign news correspondents stationed in China have recently become targets of two separate but similar malware attacks aimed at stealing information from their computers. The attacks took the form of spoofed emails with malicious executables included in an attachment, seemingly coming from a Washington-based think tank and a foreign journalist based in Beijing.
Analysis of Flame C&C servers reveals more unknown malware
Kaspersky Lab and Symantec, in conjunction with ITU-IMPACT and CERT-Bund/BSI, have revealed worrisome new discoveries about other malware that seems to have been created and used alongside Flame.
Bogus “Refund Pending” emails targeting PayPal customers
Fake PayPal notifications about a bogus refund are hitting inboxes around the world, trying to trick users into following the offered link and supposedly log into their accounts in order to receive it.
Virgin Mobile USA user accounts vulnerable to brute-force attack
Millions of subscribers of Virgin Mobile USA are in danger of having their accounts hijacked and misused because the carrier’s authentication method is easy to break with a simple script, a developer revealed.
Two men plead guilty to hacking hundreds of Subway POS computers
Two Romanian nationals pleaded guilty today to participating in an international, multimillion-dollar scheme to remotely hack into and steal payment card data from hundreds of U.S. merchants’ computers.
One third of European organizations refuse to implement BYOD
Imation released research which shows that German workers are most likely to follow rules around secure remote working, with 50% of German respondents saying that they always follow company rules compared to just over one third (36%) of UK respondents
(IN)SECURE Magazine issue 35 released
(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Issue 35 has been released today.
Cyber criminals actively targeting financial institutions, warns FBI
The attackers’ ultimate goal is to circumvent authentication methods used by the financial institutions to deter fraudulent activity, so that they can handle all aspects of a wire transaction, including the approval.
Darwin’s theory applies to malware
G Data’s new malware report shows a new and unexpected development in malware: the extreme growth of new malicious programs seems to be slowing down.
Interoperable standard for financial data exchange
The IFX Forum has published version 1.9 of IFX, its open, interoperable standard for financial data exchange.
Lucrative ZeroAccess botnet enslaves one million active computers
The largest numbers of infected machines were predictably spotted in the US, Canada and Western Europe, although there is seemingly no country in the world that doesn’t have at least one infected computer.
Pinterest users targeted with fake ad-pushing app
GFI researchers have recently spotted an app aimed at PC users called “Pin Photo Zoom” that supposedly helps Pinterest users zoom in on images.
Ex-CME programmer admits to stealing source code
A former senior software engineer for Chicago-based CME Group pleaded guilty to theft of trade secrets for stealing computer source code and other proprietary information while at the same time pursuing plans to improve an electronic trading exchange in China.
Yet another global cyber espionage campaign tied to China
Dubbed Mirage after the highly persistent Remote Access Tool installed on the targeted machines, the campaign predictably starts with spear-phishing emails aimed at mid-level to senior-level executives. Once the recipients download and run the attachment, they are saddled with the Mirage RAT.
Microsoft patches IE zero-day and Flash flaws in IE 10
Microsoft has delivered on its promise and has issued a security update for Internet Explorer to address the zero-day memory-corruption vulnerability in versions 9 and earlier that is currently being exploited in attacks.