How Your Computer Gets Hacked in Under a Minute

Sept. 27 (Bloomberg) – With just a few clicks, hackers can access all of your online information and stay in your system for years. Bloomberg’s Megan Huges talks to the experts to show you how it’s done. (Source: Bloomberg)

Hackers-for-hire uncovered using hit-and-run 'Icefog' APT on Mac OS X and Windows systems - IT News from V3.co.uk

Kaspersky Lab confirmed uncovering the Icefog campaign in its The Icefog APT: A Tale of Cloak and Three Daggers threat report. The researchers said the campaign has been active since at least 2011 and has hit a number of high profile targets.

"Icefog is an Advanced Persistent Threat that has been active since at least 2011, targeting mostly Japan and South Korea. Known targets include government institutions, military contractors, maritime and shipbuilding groups, telecom operators, industrial and high-tech companies and mass media," read the report.

"There are versions for both Microsoft Windows and Mac OS X. In its latest incarnation, Icefog doesn't automatically exfiltrate data, instead it is operated by the attackers to perform actions directly on the victim's live systems."

Continue Reading: Hackers-for-hire uncovered using hit-and-run 'Icefog' APT on Mac OS X and Windows systems - IT News from V3.co.uk

Why fixing the Java flaw will take so long

"By now you've heard about the latest, very serious problem with Oracle's Java runtime. You may also have heard that it could take a very long time to fix. Here's why: The flaw uncovered by security researchers last week devolves not to one issue, but to a series of issues, one knocking into the other like dominoes. Oracle has fixed one of the dominos with a patch, but there are likely to be other ways to tip over the entire row.

Emergency response
The vulnerability patched by Oracle resides in a version of Java 7 designed to extend Web browsers. The defect made it possible for a malicious Java applet on a Web page to execute arbitrary code on the underlying computer.

While this sort of defect would usually be kept secret until a fix was available, it was disclosed last week because malicious crackers had already found the defect and were exploiting it as part of a dirty-tricks toolkit used by scammers and other thieves, giving Oracle zero days to fix the code. As more researchers evaluated this "zero-day exploit," it became clear it was exceptionally serious.

With terrific speed, Oracle's engineers created a fix for the problem over the weekend andreleased it Monday. Yet security researchers weren't impressed. Why was that? I asked Oracle to brief me, but I was refused and simply referred to a blog posting on the subject, which offered little explanation.

Instead I turned to the open source community for help. Java 7 is actually based on an open source project called OpenJDK, and Oracle had also released patches for that. I was able to quickly find explanations of both the defect and the fix."

Read the full article at http://www.infoworld.com: Why fixing the Java flaw will take so long

Investigators Say China Was Behind The 'Very Major' IMF Hack Attack

Here's The Real Reason Facebook Crashed Last Night

Yes, you need anti-virus on your Mac.. and now it’s free | Naked Security

Yes, you need anti-virus on your Mac.. and now it’s free | Naked Security

Sophos has today announced the world's first free business-strength anti-virus program for home Macs. As Apple computers grow more popular than ever, they're an increasingly-enticing target for hackers (Windows users are still the number one target). And these hackers aren't just mischief-makers—by targeting your computer or applications you use, these criminals are out to steal and profit from your valuable personal information. Don't let them. Get Sophos Anti-Virus Home Edition for the Mac free today.

FACEBOOK IS DOWN: Can Life Go On?

CNN Tech: Facebook up after second outage in two days

Trend Micro offers free secure surfing tool - V3.co.uk - formerly vnunet.com

"Security vendor Trend Micro has added to its growing range of free security offerings with a tool designed to improve the safety of web browsing.

The product has been designed to protect against sophisticated threats such as the Hydraq family which was used to such effective ends in the Operation Aurora attacks by Chinese hackers on Google and other firms at the beginning of the year."

Trend Micro offers free secure surfing tool - V3.co.uk - formerly vnunet.com

iTunes accounts plundered, Apple's App store needs better control mechanisms

"iTunes accounts have been compromised by money-loving criminals. It all started on Sunday, when The Next Web noticed that the list of the top 50 best selling application in the "Books" category contained 40 applications from the same application developer - one Thuat Nguyen."

iTunes accounts plundered, Apple's App store needs better control mechanisms

Macintosh = Hacker-Proof?

Charlie Miller has a habit of upending Apple's security claims.

Charlie A. Miller loves his Macbook Pro laptop. And his four other Apple ( AAPL - news - people ) PCs, the iPhone he uses daily and two older iPhones he keeps for tinkering. But his relationship with the company that created those gadgets is somewhat more complicated.

In March, for instance, the 36-year-old security researcher publicized his discovery of 20 security vulnerabilities in Apple's software. Each would allow a cybercriminal to take over the computer of a user who's tricked into opening a certain PDF attachment or who simply visits an infected Web page using Apple's Safari browser.

That haul of bugs is a record even for Miller, who over the last four years has become perhaps the world's most prominent Mac hacker. It may also be definitive proof that Apple devices aren't safe "right out of the box," as the company has claimed for years. "When I first began saying that Macs were less secure than Windows, everyone thought I was an idiot," says Miller. "So I had to prove it again and again and again."

In 2007 Miller became the first to hack the iPhone, using a flaw in its Safari browser to remotely gain control of the not-so-smart phone. Six months later he hacked a Macbook Air in two minutes at a competition in Vancouver. Last summer he revealed a method that allowed him to virally hijack the iPhone using text messages spread via a user's contact list.

Miller says his latest research doesn't aim to show off his elite hacking skills,most of which he learned over five years as a global network exploitation analyst for the National Security Agency. Instead, he wants to show just how easy it is to find chinks in the armor of commonly used software. Miller used a technique known as "dumb fuzzing" to find flaws. He ran the procedure more persistently than most hackers, leaving his fuzzing program to throw junk information at each target for three weeks before mining the data for exploitable flaws.

As for Apple, Miller says the company has learned to accept, if not appreciate, his work. He usually gives Apple weeks of notice before publicly describing its bugs. "They're always very polite," he says. "But I suspect they wish I didn't exist."

Read the full story at Forbes.com by Andy Greenberg

Updated:
Apple Patches Pwn2Own Bug

How To Erase Your Data So No One Can Ever Recover It

Apple's Mac OS X is less secure than Windows (or not)

One of the main problems with many technology writers is that they don’t understand the technology they write about. Apple seldom says anything about Mac security and only points out the facts about Windows security. Did I mention that 99.99 percent of all exploited vulnerabilities occur on Windows PCs?

Read the full story

Microsoft on IE8 Exploit: 'There Is No Patch', And there never will be.

Microsoft's security advisory 3 February 2010 revealed their investigation of a 'reported vulnerability' in IE affecting 'customers running Windows XP or who have disabled Internet Explorer Protected Mode'. They advise they can partially mitigate the threat by isolating IE.

The very fact that resident malware can still 'destroy data on the user's machine' means you as a Windows user have no protection at all. As soon as the black hats uncover another hole in the web periphery, the story will repeat itself.

The very fact Microsoft are attempting to 'isolate' their web interface is a tacit admission the system itself is defenceless. Take a deep breath now while you can. The next attack is right around the corner.

And you have to abandon IE, no matter the version or the version of your 'OS'. There is no patch.

Read the full story at Rixstep

German government warns citizens off IE!

"Don't use IE 6, 7 or 8 and switch browser," says Federal Office

"The German government's Federal Office for Information Security is warning computer users in the country NOT to use Microsoft Internet Explorer due to recent security scares.

The state organisation has issued the warning following Microsoft's admission that IE was a 'vector' in the recent attacks on Google in China.

The German government is thus advising its citizens to use alternative browsers such as Mozilla's Firefox, Google Chrome, Apple Safari or Opera."

Read the full story

SSL/TLS Zero-day flaw found in web encryption

"Security researchers Marsh Ray and Steve Dispensa unveiled the TLS (Transport Layer Security) flaw on Wednesday, following the disclosure of separate, but similar, security findings. TLS and its predecessor, SSL (Secure Sockets Layer), are typically used by online retailers and banks to provide security for web transactions.

The flaw in the TLS authentication process allows an outsider to hijack a legitimate user's browser session and successfully impersonate the user, the researchers said in a technical paper.

The fault lies in an "authentication gap" in TLS, Ray and Dispensa said. During the cryptographic authentication process, in which a series of electronic handshakes take place between the client and server, there is a loss of continuity in the authentication of the server to the client. This gives an attacker an opening to hijack the data stream, they said.

In addition, the flaw allows practical man-in-the-middle attacks against hypertext transfer protocol secure (Https) servers, the researchers said. Https is the secure combination of http and TLS used in most online financial transactions."

Read the full story at ZDnet UK

Russian Hackers pay 43 cents per hijacked Mac

Computerworld - "A network of Russian malware writers and spammers paid hackers 43 cents for each Mac machine they infected with bogus video software, a sign that Macs have become attack targets, a security researcher said yesterday.

One example, which has since gone offline, was Mac-codec.com, said Samosseiko. "Just a few months ago it was offering [43 cents] for each install and offered various promo materials in the form of Mac OS 'video players,'" he said."

Continue Reading

FUD report: Snow Leopard 'not as secure' as Windows...

"Another week, another lax Mac OS X security FUD emanating from the usual quarters, making the risible claim Apple’s platform is inherently less secure than Windows.

Story goes like this: The hacker who successfully broke into a Mac at a hacker’s conference some time ago has tested Snow Leopard against WIndows 7, and accuses the Mac OS as being “less secure” than Microsoft’s Vista upgrade.

Charlie Miller is one of the team from Independent Security Evaluators who successfully "pwned and owned" an Apple MacBook Air, in a hacking contest sponsored by TippingPoint's Zero Day Initiative."

Read the full story at 9 to 5 Mac by Jonny Evans

"He conveniently forgets all of the other security features in Snow Leopard. Why doesn't he touch on:
- stack frame protection
- code injection protection
- automatic replacement of common C functions (e.g. srtcpy) with hardened versions
- heap consistency checks
- the reduction in setuid executables
His opinion on ASLR is valid, but extrapolating that to the overall security of the OS is garbage."

Outlaw Legends: Secrets of Russian Hackers

Read the full story at Russia Today

Adobe patches 12 Flash bugs, 3 caused by Microsoft

Adobe on Thursday patched 12 vulnerabilities in Flash Player, including three it inherited from faulty Microsoft development code and one that hackers have been exploiting for at least a week.

In a security advisory published Thursday afternoon, Adobe briefly spelled out the dozen vulnerabilities, 10 that were pegged as potentially leading to hijacked systems or with hackers executing their own malware on a machine.

The vulnerabilities affect the Windows, Mac and Linux versions of Flash Player. Still to patch: the Solaris edition.

Flash Player 9.0.246.0 and 10.0.32.18 for Windows, Mac and Linux can be downloaded from Adobe's Web site. Alternately, users can use Flash's built-in automatic update mechanism to grab the new versions.

Read the full story by Gregg Keizer, Computerworld US

Block Wi-Fi Intruders with a Secure Paint Job

IT managers should start familiarizing themselves with a new security tool -- the paint brush -- as Japanese researchers have come up with a paint that they say will block high-speed wireless signals, giving businesses a cheap option to protect their wireless networks.

The problem of securing wireless networks has been an issue for a while now. Wi-Fi LANs with no encryption or running the obsolete WEP system, run the risk of having hackers outside the building eavesdrop on wireless LAN traffic, or simply stealing bandwidth. However, there are a number of solutions, besides encryption, for companies wishing to secure their networks.

read more | digg story