Virus Information News

[First]  [Previous] |    9     10     11     12     13     14     15     16     17     18    | [Next]  [Last] of 172 page(s)

DNSChanger Trojans and DSL Modems

f-secure.com

December 11, 2009

Occasionally reports of DNSChanger trojan variants altering the DNS information on both the infected system and on certain ADSL modems.

There are a couple twists on the basic strategy - the trojan may modify the modem's settings to use a rogue DNS server (that serves tainted information) or it can install a DHCP driver on the modem. Either way, it redirects users to a malicious site doing drive-by downloads. The trojan gets access to the modem's settings by brute-forcing the user name and password, which many people leave set as default. A simple, user-doable prevention measure is to change the default to a strong password.

Adobe Acrobat 0-Day Analysis

f-secure.com

by Sean

December 17, 2009

There's a 0-Day PDF exploit taking advantage of a vulnerability found in Adobe Reader and Acrobat 9.2 and earlier.

These screenshots demonstrate that when the PDF file is opened in Adobe Acrobat/Reader it attempts to download an executable file. The server has been abused but is currently active. The executable that is downloaded searches for and encrypts certain files and then uploads them to another server. Adobe plans to make an update available on January 12th, 2009 (almost a month from now).

MP3 spam spreads holiday cheer

blog.commtouch.com

December 25, 2009

Commtouch Labs reported a recent attack involving MP3 messages. The email body and subject line were blank, as seen below, and each message had an MP3 attached

While the emails were all subject-less, the MP3s were creatively named. File names include: beauteously, unsecularise, sporicide, cookshack, teentsier, muftis, zoogeography and squishiness.

Ransomware - Buy Back Your Own Files

f-secure.com

January 8, 2010

Initial infection makes it look as if certain files - mostly Microsoft Office documents, video, music and image files - on the infected system had been "corrupted" and a recommended utility will "fix" them.

If the utility is downloaded and executed, the luckless user finds that it can "only repair one file in unregistered version". To repair - or more accurately, decrypt - anything more, the user has to buy the product. Think about this from the users point of view. "Oh my god I've lost my important files!" "Thank god I found this great product that recovered them perfectly for just $89.95" "I'm going to recommend Data Doctor to all my friends". Effectively, user is forced to pay a ransom for his own files and the user doesn't even realize he's paying a ransom.

Warning on possible Android mobile trojans

f-secure.com

by Mikko

January 11, 2010

Google's Android mobile operating system has an open Marketplace much like the iTunes AppStore. This week approximately 40 "banking" applications sold through the Marketplace were removed due to security concerns.

Since the applications were not developed or authorised by the banks themselves, they could not do real online banking from the Android device. Apparently they only opened the web interface of the online bank for the user. On the other hand, they could have stolen user credentials.

Spammers Exploit Free Web Hosting Services

WHIR Web Hosting Industry News

by David Hamilton

January 11, 2010

Temporarily benefiting from a host's legitimate reputation, spammers are taking advantage of "free-hosting" services for their nefarious purposes.

In its January 2010 Spam Report, McAfee made note of the growing trend of spammers signing up for free subdomains and complimentary hosting. Oftentimes they are allowed to use a unique third-level domain, giving them the appearance of a legitimate site. "Using a free hosting service is a good tactic for spammers because it is easier to automatically block a new infected website than to block a site that has been around for a longer period and has possibly had legitimate traffic associated with it," wrote the McAfee report's authors. "This edge can provide spammers a few precious additional hours before the spam-blocking services of the world blacklist that host. In the course of a few hours a botnet can generate billions of messages." With long-time free hosting site Geocities shutting its doors just months ago, dozens of similar free hosting sites have sprung up to provide free web space to anyone who requests it. Unfortunately, spammers have requested a lot of it.

Better Security through Software

blog.facebook.com

by Jake Brill

January 12, 2010

One of the best defenses against security threats is a good offense, and we want to help you take the offensive by having the latest security software installed on your computer...

Network Solutions Responds to Site Defacements

WHIR Web Hosting Industry News

January 20, 2010

After hackers defaced hundreds of websites hosted by Network Solutions, the company said Tuesday that it is monitoring this threat and working with law enforcement organizations as it works to restore the impacted sites. "We have discovered the cause of a

"Hackers were able to add a file displaying illegitimate content on top of the customer website content. This was an issue on multiple servers and unknown intruders were able to get through by using a file inclusion technique. There was no danger to any personally identifiable or secure information." Bellamkonda noted that after this issue is sorted out, Network Solutions will be undertaking precautionary actions that may include some server configuration modifications.

Chinese Search Engine Baidu Sues Its US Web Host Over Hacking Incident

WHIR Web Hosting Industry News

January 20, 2010

Following a January 12 attack that left Baidu's main search engine inaccessible for several hours, Baidu announced on Wednesday that it had filed a lawsuit against register.com and that it was actively seeking a new hosting provider for its search engine.

"The fault of register.com led to the malicious and unlawful altering of the domain name of Baidu, which made thousands of people unable to visit baidu.com and brought serious losses to Baidu," the company stated. Last week, Baidu searches were reportedly redirected, and its homepage carried the message, "This site has been hacked by Iranian Cyber Army." This suggests that it was the same group that hacked social networking site, Twitter, last month.

Users still make hacking easy with weak passwords

computerworld.com

by Jaikumar Vijayan

January 21, 2010

In a report likely to make IT administrators tear out their hair, most users still rely on easy passwords, some as simple as "123456," to access their accounts.

A report released today by database security vendor Imperva Inc. serves as another reminder of why IT administrators need to enforce strong password policies on enterprise applications and systems. Imperva's report is based on an analysis of 32 million passwords that were exposed in a recent database intrusion at RockYou Inc., a developer of several popular Facebook applications. The passwords, which belonged to users who had registered with RockYou, had been stored by the company in clear text on the compromised database. The hacker responsible for the intrusion later posted the entire list of 32 million passwords on the Internet.

[First]  [Previous] |    9     10     11     12     13     14     15     16     17     18    | [Next]  [Last] of 172 page(s)