Отправляет email-рассылки с помощью сервиса Sendsay

Антивирусы и безопасность (SaaS, Cloud ...)

Подписаться Бесплатная «Серебряная» новостная рассылка . Подписчиков 8.346 RSS
←   Май 2014   →
 1
 2
 3
 4
 5
 6
06.05.2014
06:15:26
18:33:22
 7
 8
08.05.2014
06:15:20
17:15:36
 9
09.05.2014
06:15:30
17:15:32
10
11
12
13
13.05.2014
06:15:33
17:15:35
14
14.05.2014
06:15:28
17:15:39
15
15.05.2014
06:15:18
17:15:41
16
16.05.2014
06:15:30
17:15:41
17
18
19
20
20.05.2014
06:15:31
17:15:37
21
21.05.2014
06:15:32
17:15:39
22
22.05.2014
06:15:29
17:15:49
23
23.05.2014
06:15:23
17:15:53
24
25
26
27
28
28.05.2014
06:15:29
17:15:38
29
30
31


За последние 60 дней ни разу не выходила


Сайт рассылки: http://av-host.net
Открыта: 09-03-2012

Автор
kmm

Статистика

8.346 подписчиков
0 за неделю
←   Все выпуски   →

Весна -- время роста: <<Лаборатория Касперского>> отмечает, что DDoS-атаки в Рунете стали еще мощнее


Антивирусный "хостинг"

Клуб пользователей антивирусных услуг (Saas, Cloud)

добавить на Яндекс
Антивирусы и безопасность (SaaS, Cloud ...)
av-host.net

Весна — время роста: «Лаборатория Касперского» отмечает, что DDoS-атаки в Рунете стали еще мощнее
2014-05-27 16:58

KMM поделился ссылкой

Весна — время роста: «Лаборатория Касперского» отмечает, что DDoS-атаки в Рунете стали еще мощнее

«Лаборатория Касперского» зафиксировала новый скачок мощности DDoS-атак в Рунете.


ALERT: Spotify Has Been Hacked
2014-05-28 01:44

KMM поделился ссылкой

ALERT: Spotify Has Been Hacked

IMG_27052014_182502Attention music lovers: Spotify has been hacked!

The popular music streaming website has just posted an announcement which states that someone gained unauthorized access to their systems and internal company data. As a result, attackers gained access to just one Spotify user account. The company stresses that this access did not divulge the user’s password, financial or payment information, and that they have since contacted the user and launched an investigation.

It may seem a bit of an over reaction to publish such an announcement that apparently only affects one user, however in the wake of last week’s massive data breach at eBay, the company is likely aiming for complete transparency.

As an extra security measure, Spotify states that they will be requiring a manual log-in for all users in the next few days, in order to re-verify account credentials. Additionally, Spotify will be releasing an automated Android upgrade which will guide users through install. This update is slated for release sometime in the next week.

Emsisoft encourages Spotify users who want to err on the side of caution to change their Spotify password as soon as possible. Though Spotify’s announcement indicates that only one account was hacked, it never hurts to update what may be a weak log-in credential, especially when it is used for a popular website.

Spotify’s official press release regarding this matter can be viewed in full here.

Have a Great (Data-Breach-Free) Day!

 

 



Zberp Banking Trojan: A Hybrid of Carberp and Zeus
2014-05-28 01:46

KMM поделился ссылкой

Zberp Banking Trojan: A Hybrid of Carberp and Zeus

11431455_s

It’s official: Zeus and Carberp have gotten hitched and hybridized. Malware authors have combined source code from the financial Trojans to produce Zberp, a new variant that targets 450 banking institutions around the world.

Zeus + Carberp = Zberp

For those unfamiliar, Zeus is one of the most capable and popular forms of banking malware around. Most notably, Zeus can perform “man in the middle attacks” to automatically intercept online banking credentials when they are shared in an online session between a customer and their bank. Since Zeus’ source code was leaked on a hacker forum in 2011, the malware has become extremely widespread and has morphed into numerous forms. Similarly, Carberp is also a form of financial malware, which at one time was so advanced and feature-rich that it sold for $40,000 per license in underground marketplaces. One year ago, Carberp’s code was also leaked, leading to an increase in its reach as well.

Zberp is a hybrid combination of Zeus and Carberp, created by someone with access to both Zeus’ and Carberp’s source code. Like its parents, Zberp is designed to steal money from people who bank online. Unlike its parents, Zberp’s relative youth gives it the ability to bypass antivirus products that rely on signature-based detection alone.

Zberp’s Zeus Inheritance

Zberp is a highly capable malware. From Zeus, the malware inherits the ability to steal information transmitted between users and a reported 450 financial institutions around the world. Accordingly, Zberp can:

  • gather IP addresses and computer names
  • take screen shots and upload them to a remote server
  • steal data entered by a user into an HTTP form, steal a user’s SSL certificate, and/or steal FTP and POP3 credentials
  • perform malicious web injections
  • carry out man in the middle attacks
  • initiate a remote desktop session through VNC/RDP protocols, allowing attackers direct access to an infected PC

Additionally, Zberp has what is called “invisible persistence.” Invisible persistence means that Zberp actually deletes its start up registry key during Windows start up and returns it when it detects that Windows is shutting down. This is an evasion technique meant to sneak past antivirus software that scans for malware during system boot.

Zberp also uses the method of steganography to allow for surreptitious configuration updates. With steganography, malware authors will typically disguise their malicious files as harmless images. In the case of Zberp, that image is the Apple logo.

Zberp’s Carberp Inheritance

Zberp’s authors have borrowed significantly less from Carberp, yet what they have borrowed is not insignificant. According to initial reports, Zberp utilizes a modified version of Carberp’s “hooking” technique. In practice, this “hooking” technique allows cybercriminals to hijack a browser session to steal information. The fact that the code responsible for Zberp’s hooking technique is different than Carberp’s means that many antivirus products familiar with Carberp alone will fail to detect it.

Protecting Yourself from Zberp

Much of what makes Zberp powerful is that it is designed to evade signature-based malware scanners. This is precisely why Emsisoft Anti-Malware utilizes an advanced layer of malware prevention, called Behavior Blocking. Behavior Blocking identifies root malicious behaviors, instead of specific signatures. To learn more about Behavior Blocking, you can see our Security Knowledge article, Efficient protection against new malware: Emsisoft’s Behavior Blocker.

In addition, it is crucial to realize that Zberp can only wreak havoc once it has infected your PC. In order for this to occur, you would need to encounter the Trojan somewhere on the web and download it to your computer. This can happen in any number of ways, however two of most common scenarios are through targeted emails, that contain malicious links or attachments.

In the case of a link, clicking would direct you to a “drive-by” download website, which would automatically install Zberp while pretending to do something else. In the case of an attachment, the same trick is used: you click on an executable that installs Zberp but pretends to be and do something else. In both of these scenarios, the single greatest method of prevention is caution.

As an extra measure, you can also consider using Emsisoft’s 3 layered approach to malware prevention, which hybridizes Surf Protection + File Guard + Behavior Blocker to create award winning anti-malware technology.

Have a Great (Zberp-Free) Day!

 

More on Zberp

Zberp was discovered by researchers from IBM security. A full technical report on this new malware can be found at their Security Intelligence blog.

 

 



ALERT: The Google Drive Phishing Scam Returns!
2014-05-28 01:50

KMM поделился ссылкой

ALERT: The Google Drive Phishing Scam Returns!

Watch out: A highly convincing Google Drive phishing scam is back.

Reports indicate that it is being carried out by the same group of attackers as before, however this time around it comes with a little twist. In addition to stealing user credentials, the scam can now infect users with malware. Fortunately, however, whoever designed the phishing page made a little mistake that’s a dead giveaway to attentive users.

Drive Scam Play-by-Play Round 2

We first observed this type of attack back in March 2014. As then, the scam is carried out in the exact same way.

  • The scam is initiated by the standard email request to view a shared document on Drive, with a subject line: Documents.
  • Opening the email reveals a link to what is said to be a “very important document.”
  • Clicking on the link leads users to a fake Google log-in page, which is essentially identical to the real one.
  • The fake log-in page is even hosted on Google and contains SSL certification.

As before, users who enter their information and “Sign in” are redirected to an actual Google Doc containing irrelevant information.  At the same time, and in the background, the user’s Google log-in credentials are sent to the scammer’s web server.

How to Spot this Scam

This time around, the attackers made a mistake. In the bottom right hand corner of every legitimate Google Drive log-in page, there is a drop down menu for language selection.

 

drive language

The image above shows what this language menu is supposed to look like. On the Google Drive phishing webpage, all languages in the drop down menu have a ? in front of them; so, instead of English (United States) you would see ?English (United States). If you encounter this little bug, DO NOT PROCEED.

As before, it’s also wise to take the following precautions:

  • Delete any unsolicited invitations to share Google Documents.
  • Do not click on links you receive from people you don’t know.
  • Avoid logging in to Google through emailed links; instead, go to the real Google.com and proceed from there.
  • Stop and think: If you use Gmail and are already logged in to your Google Account, you shouldn’t need to log in again to access Drive.
  • Enable two factor authentication. That way, even if your credentials are compromised, the scammer will not be able to log-in to your account from their computer.

What Happens If You’re Phished

If you attempt to log-in to Google Drive through one of these phishing pages, you will be submitting your Google log-in credentials directly to a scammer. Armed with such information, the scammer could then log-in to your Google account and do anything they want.

This time around, the cybercriminals have also added a malware component to some of their landing pages. In this scenario, users who are phished are subsequently redirected to a drive-by download website that automatically initiates a malicious install.

Ensuring Drive Scam Protection

Though it is concerning that this scam is back and is actively being propagated through one of the most popular file sharing services on the web today, it is fortunate that its creators have slipped up and given users a red flag to look for and avoid. That being said, as knowledge of the ? bug spreads, it is likely that its authors will repair it.

It is for this reason that Emsisoft Anti-Malware has been built with a layer of automatic Surf Protection. We keep a running list of known fraudulent websites from all across the Internet – such as the ones involved in this latest iteration of the Google Drive phishing scam – and we feed it to Emsisoft Anti-Malware multiple times per day. As a result, if you’re running our software and you try to navigate to a malicious website, you will be prevented from doing so.

Finally, if you think you might have fallen for this recent scam or its predecessor, we recommend a password change, immediately.

Have a Great (Phish-Free) Day!
В избранное