Phishing

Does Your LinkedIn Profile Hold The Key To Your Password?

Say what you want about social media. The bare fact is that folks use it – more of them every day. In fact, social media sites like Facebook, Twitter and YouTube are growing – quickly – and have come to define our modern online experience. That said: the sites represent a huge security risk. Sites like Facebook, Twitter and Instagram are increasingly used as platforms to circulate scams and malicious links. A larger and more nebulous threat is posed by all the information that organizations and their workers are spilling online. It’s already common knowledge that hackers and other “bad guys” comb through worker profiles or LinkedIn, Facebook and other sites to help craft targeted attacks. But could your social networking profile provide more useful information – like your password? Independent security researcher Itzik Kotler thinks so. Kotler is the creator of Pythonect, a new, experimental dataflow programming language based […]

Web Attacks Target Foreign Exchange, Payment Processing Sites

A currency trading web site was compromised and used to serve malicious java applications to unwitting visitors, according to researchers at the security firm Websense- part of what might be a larger trend. Websense said in a blog post on Wednesday that the site tradingforex.com, which is used by foreign currency traders, was infected with a malicious Java applet that, when installed, key logging and screen capture software. Tradingforex.com (@Tradingforexxx) is a Cyprus-based online trading web site. It allows individuals to trade on the global foreign exchange market (or Forex). Users can trade everything from foreign currencies to precious metals, commodities and other financial instruments. According to an investigation by Websense researcher Gianluca Giuliani, the site was pushing a back door program to visitors using a malicious Java plugin to exploit known Java vulnerabilities on the victims’ computers. Further investigation by Websense and Giuliani revealed that the malware being pushed […]

Profile Poisoning the Next Frontier for Hackers

Google and Facebook already know everything about you – your interests, friends, tastes and even your movements. That’s already a privacy nightmare, but researchers at the Georgia Institute of Technology’s Information Security Center (GTISC) think it could soon be a security nightmare, also. Automated information systems already determine what version of the news most of us see. But researchers at Georgia Tech warn that the power of such systems to shape what each of us see online could soon become a powerful tool in the hands of sophisticated attackers, who might look for ways to manipulate victims’ online profile to steer them to certain sites, according to the report “Emerging Cyber Threats Reports 2013.” Researchers at Georgia Tech said attacks that manipulate a victim’s search history, part of their online profile, using cross-site request forgery are already technically feasible. In practice, they would allow for a kind of super-search engine […]

U.S. Government also Targeted by Malware Used In Attacks on Israelis, Palenstinians

The recently reported malicious software attacks against Israeli and Palestinian targets have expanded to hit other targets, including individuals working within the U.S. Congress, the UK government and government workers in countries ranging from Turkey to Slovenia and New Zealand, according to a report from security firm Trend Micro. In a blog post on Wednesday, Trend Senior Threat Researcher Nart Villenueve wrote on the company’s Security Intelligence blog that  those attacks are ongoing and involve a much wider list of targets that initially reported. The attacks first came to light after a Times of Israel report revealed on October 28 that computer systems used by that country’s police departments were taken offline following a virus infection. Subsequent analysis by Trend and others (PDF) revealed that the malware used in the attacks was a variant of the common Xtreme Remote Access Trojan (Xtreme RAT) – an information stealing program that can be […]

Microsoft: Freeware, Pirate Software Supply Chain Leads to Infections

The Internet is a dangerous place, in general. And, depending on what you’re looking for online, it might be very dangerous, indeed, according to Microsoft. Writing in the company’s latest Security Intelligence Report, Microsoft said that its Malware Protection Center (MMPC) has observed an increase in malicious code infections that emanate from what it calls the “unsecure supply chain”  – the informal network of legitimate and underground web sites that distribute freeware and pirated software. Freeware that promises to generate registration keys for popular products like Adobe’s Photoshop, Microsoft Windows and games such as Call of Duty were among the most commonly associated with malicious programs, Microsoft said.  Internet users hoping to unlock pirated software download the key generators believing that they will produce a valid registration key, but often end up infecting their system in the process. But malware authors and cyber criminal groups will also wrap their creations in with […]