Week in review: Malware you can “live with”, but should’t, and backdoor targeting popular web servers
Here’s an overview of some of last week’s most interesting news, videos, interviews, reviews and articles:
Malware you can “live with”, but shouldn’t
The main symptom of a computer being infected with the ZeroAccess (or Sirefef) malware is that online searches via Google Search often lead to unhelpful pages filled with ads and equally useless links. This generates revenue for the malware’s controllers, but it’s extremely irritating for the affected users.
Analyzing 450 million lines of software code
Over the past seven years, the Coverity Scan service has analyzed nearly 850 million lines of code from more than 300 open source projects including Linux, PHP and Apache.
A radical shift in security needs
During the last 40 years we’ve seen a small number of significant, user-driven shifts in the computing landscape, which change the way businesses and IT departments operate. The move from mainframes and linked terminals towards desktop PCs is a prime example. Currently, we’re in the middle of another fundamental shift.
Attackers breach and encrypt TV station’s email server
The email server of FOX21 News has been hacked and the information it contained held ransom.
Why wiping decommissioned IT assets should be a must
A few years ago, British researchers found top secret U.S. missile defense system data while examining 300 hard drives bought at computer auctions, computer fairs and eBay. I’m sure that if someone did a similar research today, they would still discover sensitive data leaking into the wild.
Pentagon report accuses China military of cyber espionage
The Pentagon has come out and said it: “China is using its computer network exploitation (CNE) capability to support intelligence collection against the U.S. diplomatic, economic, and defense industrial base sectors that support U.S. national defense programs.”
The importance of secure coding
Jim Manico is the VP of Security Architecture for WhiteHat Security. In this video recorded at Hack In The Box 2013 Amsterdam, Manico illustrates the importance of secure coding and talks about various issues. It is a video particularly aimed at beginners.
Phishers target eBay customers via live chat support
U.K.-based ISP Netcraft is warning users about phishers impersonating eBay’s live chat support feature in the hopes of getting their hands on eBay users’ login, personal and financial information. The ISP blocked the bogus site offering the fraudulent service, but says that others might easily pop up.
Backdoor targeting Apache servers spreads to nginx, Lighttpd
The revelation of the existence of Linux/Cdorked.A, a highly advanced and stealthy Apache backdoor used to drive traffic from legitimate compromised sites to malicious websites carrying Blackhole exploit packs, was only the beginning – Eset’s continuing investigation has now revealed that the backdoor also infects sites running the nginx and Lighttpd webservers.
U.S. senators introduce new bill to fight cyber theft
A new bill that would allow the U.S. president to block import of products containing stolen U.S. technology has been introduced in the Senate on Tuesday.
Blackhatonomics: An Inside Look at the Economics of Cybercrime
If you need to get in the minds of cyber criminals to understand their motives and the economics of cyber crime, this book is enough to get you started.
Beware of fake AV and ransomware combo
The software – dubbed “Secure Bit” – first tries to convince the victims that the “security level” of their computer is low and instructs them to call for support so that the “threats” it has “found” can be removed.
The CSO perspective on risk management
Candy Alexander is the CSO at Long Term Care Partners and volunteers as a member of the International Board of Directors for ISSA. In the past, she was invited to the White House to speak on the importance of security awareness to the President’s Cyber-Czar staff and has held several position as CISO for which she managed Corporate Security Programs. In this interview she gives a CSO perspective on the importance of risk management, threat mitigation and security awareness.
Porn-downloading ransomware targets German users
The interesting thing is that the photos are actually on the computer, but they are there because the malware put them there.
Phishers taking over accounts of telecommunication customers
Individuals receive automated telephone calls that claim to be from the victim’s telecommunication carrier. Victims are directed to a phishing site to receive a credit, discount, or prize ranging from $300 to $500.
Microsoft releases Fix it for critical IE8 0-day
Microsoft has released a one-click Fix it for mitigating the effect of the IE 8 zero-day vulnerability that is being used in watering hole attacks in the wild.
Hacker leaks part of Candace Bushnell’s unpublished book
A hacker that goes by the name of “Guccifer” – the same one who has allegedly compromised email accounts belonging to the Bush family and some of their close friends earlier this year – has hacked the email and Twitter account of Sex and the City author Candace Bushnell.
Name.com breach just one of many executed by HTP hackers?
Internet registrar Name.com has suffered a breach and has been informing users about it via email, requesting them to change their passwords.
Spamhaus DDoS suspect extradited to his home country
The 35-year-old Dutch citizen was arrested in Spain in April, and he is believed to be behind the biggest DDoS attack in the history of the Internet aimed at international spam-tracking outfit Spamhaus.
Bringing networking and security together through network automation
The complexity of today’s networks is a challenge, but it is also leading to a new dynamic in IT organisations: a blurring of the boundaries.
Hijacking Facebook accounts via expired Hotmail accounts
Three researchers from Rutgers University in Newark, New Jersey, have discovered a simple way to hijack Facebook accounts by just by misusing existing features and responses of Facebook, Microsoft’s Hotmail web-based email service and its Windows Live Messenger.