Custom Search

Travnet Botnet Steals Huge Amount of Sensitive Data

In a McAfee Labs blog by my colleague Vikas Taneja last month, he discussed high-level functioning in the malware Travnet. Since then we have continued to analyze different samples and now classify Travnet as a botnet rather than a Trojan because of the presence of control code, and the malware’s ability to wait for further …

Skypemageddon by bitcoining

Is it a Skype day? Or maybe a Bitcoin one? Or maybe just both?

I say this because right after I published my previous post about malware ongoing campaign on Skype, a mate from Venezuela sent me a screenshot of her Skype client with a similar campaign in terms of propagation but different in terms …

Compromised Yahoo accounts spread Android malware

The surest way to know that an attack method is working for a malware gang is seeing the method repeated over a period of several months. In Commtouch’s October Trend Report we described an attack targeting Android users. Last week saw a repeat of the attack with a few refinements. The main elements:

Single link …

Anonymous Releases ‘Warhead’ via #OpLastResort

There has been a great explosion of chatter in the last day around Anonymous’ “Operation Last Resort” (a.k.a. #OpLastResort).

The entities behind the various “official” communications around this operation have a sense of humor that we must point out (especially because if you don’t catch it, you will end up wiping your disk).

Background

In typical …

The Dangers of Posting Credit Cards, IDs on Instagram and Twitter

These days, cybercriminals and other bad guys on the Internet may no longer have to use infostealing Trojans to gather data from users. Users intentionally posting pictures of their IDs, credit cards on Twitter and Instagram are already doing the job for them.

I’ve been noticing several young people (and even adults) who post pictures of …

Two year old PDF exploit returns to popularity

For the last two weeks we have been noticing significant increase of PDF exploit attacks being distributed by email with an attached PDF document posing as a fake invoice.

However, closer examination of the PDF file has shown that the exploit uses a two-year-old classified as CVE-2010-0188. Why would anyone use so old an exploit? Well …

We’ve got our eye on Eyestye

Back in October 2011, we began to remove Eyestye variants using the Malicious Software Removal Tool (MSRT) in an effort to prevent the proliferation of this botnet. Today, we published a detailed MMPC Threat Report on this family. The report provides an in-depth analysis of how Win32/EyeStye works and the telemetry we have on its …

LinkedIn and eHarmony passwords databases leaked

Yesterday, password databases from two popular websites were leaked in an underground forum popular with computer hackers. 6.5 million passwords from LinkedIn and a further 1.5 million passwords from internet dating site eHarmony were divulged following attacks on these sites.

LinkedIn has already acknowledged the leak, and have said they are changing the algorithm for …

OS X Mass Exploitation – Why Now?

Market share! It’s an easy answer, but not the only one.

In 2011, Apple was estimated to account for over 5% of worldwide desktop/laptop market share. This barrier was a significant one to break – Linux maintains under 2% market share and Google ChromeOS even less. This 15 year peak coincided with …

Mac Flashback Trojan: If you use Java the time to patch your Mac is now

If you are a Mac user and you have Java installed on your Mac, then right now would be a good time to run Software Update… from the Apple menu to make sure you have installed the latest Java for Mac OS X update. Installing this update will help protect your Mac from a malicious …

Nortel veteran claims Chinese hackers stole its data for nearly 10 years

The Wall Street Journal is reporting that telecoms firm Nortel Networks was repeatedly breached by Chinese hackers for almost a decade.

The newspaper cited Brian Shields, a former Nortel employee who led an internal investigation into the security breaches, and published claims that the hackers stole seven passwords from the company’s top executives – …

Adware on Mobile Devices an Evolving Privacy Threat

var addthis_product = ‘wpp-263′; var addthis_config = {“data_track_clickback”:true,”data_track_addressbar”:false};if (typeof(addthis_share) == “undefined”){ addthis_share = [];}

Potentially Unwanted Programs (PUPs) are often legitimate software that pose a risk to users’ privacy or systems. A reasonably secure–or privacy-minded–user may want to be informed of the presence of certain PUPs and in some cases remove them. One very …

Safer Internet Day 2012 Offers a Lesson for All of Us

Many of you may have already noted this from Google’s home page, but for those not reading the fine print or not using Google: Today is International Safer Internet Day, which will have its 10th anniversary next year (if I counted right). Started in Europe by Insafe with funding from the European Commission, this day has become …

Symantec: Stop using pcAnywhere, right now

Symantec has admitted that blueprints for current versions of its pcAnywhere software were stolen in 2006 and that all users are at risk of attack and should pull the plug.

That includes users of both current and past iterations as well as those bundled with Altiris and the pcAnywhere Thin Host packaged with backup …