Critical GHOST vulnerability affects most Linux Systems

A highly critical vulnerability has been unearthed in the GNU C Library (glibc), a widely used component of most Linux distributions, that could allow attackers to execute malicious code on servers and remotely gain control of Linux machines.

The vulnerability, dubbed “GHOST” and assigned CVE-2015-0235, was discovered and disclosed by the security researchers from Redwood Shores, California-based security firm Qualys on Tuesday.

CRITICAL AS HEARTBLEED AND SHELLSHOCK

GHOST is considered to be critical because hackers could exploit it to silently gain complete control of a targeted Linux system without having any prior knowledge of system credentials (i.e. administrative passwords).

The flaw represents an immense Internet threat, in some ways similar to the Heartbleed, Shellshock and Poodle bugs that came to light last year.

Source:
http://thehackernews.com/2015/01/ghost-linux-security-vulnerability27.html

Posted in Internet, Linux, Security | No Comments

Study Uncovers 40,000 Malicious Mobile Banking Apps

Mobile banking is an increasingly popular way to stay on top of one’s finances, with the ability to check balances, transfer money and even deposit checks virtually. Unfortunately, the sector is also a rich tapestry of criminal activity, with 11% of mobile banking apps categorized as “suspicious.”

According to research findings from RiskIQ, there’s a notable prevalence of suspicious mobile apps related to banking. The company found that more than 40,000 (or 11%) of the 350,000 apps which reference banking in the world’s top 90 app stores contain malware or suspicious binaries. Roughly half of those (20,000) actually contained trojan malware.

For the survey, RiskIQ inspected the apps by emulating human behavior to detect suspect applications, application tampering and brand impersonation. Apps were labeled suspicious based on whether they contained malware or suspicious binaries identified by a consortium of 70 anti-virus vendors.

Aside from the malware infestations, of the more than 40,000 mobile apps listed as suspicious, 21,076 contained adware, 3,823 contained spyware, 209 contained exploit code and 178 contained malicious JavaScript.

“Mobile banking is now a way of life for most people,” said Elias Manousos, CEO of RiskIQ, in a statement. “It also presents a lucrative opportunity for criminals to commit fraud. One of the easiest ways to steal a victim’s login and other personal information is using malware and apps with excessive permissions.”

And indeed, of the 40,000 suspicious apps, a large number exhibited excessive permissions. In fact 8,672 could capture device logs, 8,408 could record audio, 7,188 could access contacts lists and 4,892 could read SMS messages. Further, thousands could write to contacts lists, disable key guards, read the device’s settings and access location/GPS information. Perhaps most concerningly, 1,148 could install packages.

Source:
http://www.infosecurity-magazine.com/news/40000-malicious-mobile-banking-apps/

Posted in Internet, Mobile, Privacy, Security | No Comments

Two Million Cars Using Wireless Insurance Dongle Vulnerable to Hacking

2015 will be a year more smarter than 2014 with smarter mobile devices, smarter home appliances, and yes Smarter Automobiles. Nowadays, there are a number of automobiles companies offering vehicles that run on a mostly drive-by-wire system, meaning that a majority of the controls are electronically controlled, from instrument cluster to steering, brakes, and accelerator as well.

No doubt these systems makes your driving experience better, but at the same time they also increase the risk of getting hacked.

According to a recent research, an electronic dongle used to plugged into the on-board diagnostic port of more than two million cars and trucks contains few security weaknesses that makes them vulnerable to wireless attacks, resulting in taking control of the entire vehicle.

Since 2008, US-based Progressive Insurance has used the SnapShot device in more than two million vehicles. The little device monitors and tracks users’ driving behavior by collecting vehicle location and speed records, in order to help determine if they qualify for lower rates.

However, the security researcher Corey Thuen has revealed that the dongle is insecure and performs no validation or signing of firmware updates. It has no secure boot mechanism, no cellular communications authentication, and uses no secure communications protocols, possibly putting the lives of people inside the vehicle in danger.

Source:
http://thehackernews.com/2015/01/progressive-snapshot-device-hacking-car.html

Posted in Hardware, Internet, Security | No Comments

New “Skeleton Key” malware allows bypassing of passwords

Remember when we discussed how passwords were dead? If you needed more proof that this is true, the bad guys have you covered with a new piece of malware that turned up in the wild.

SecureWorks, the security arm of Dell, has discovered the new piece of malware dubbed “Skeleton Key.” The attack consists of installing rogue software within Active Directory, and the malware then allows attackers to login as any user on the domain without the need for further authentication. It’s important to note that the installation requires administrator access or a flaw on the server that grants such access.

Interestingly, Skeleton Key does not actually install itself on the filesystem. Instead, it’s an in-memory patch of Active Directory which makes detection even more difficult. Even worse, this access is not logged and is completely silent and, as a result, extremely undetectable. Identifying the malware using traditional network monitoring also does not work due to the fact that Skeleton Key does not generate any network traffic.

It’s not all doom and gloom though. The good news is that, in its current form, the malware does not survive a system reboot. Also, the fact that it requires administrator rights to install limits the attack surface, making a disgruntled sysadmin one of the largest threat vectors. In addition, according to the researchers, the malware is rendered useless if an organization requires two-factor authentication to connect to servers, VPN, email and the like. If this isn’t a wake-up call to stop relying on passwords as your main means of security, I don’t know what is.

Source:
http://www.neowin.net/news/new-skeleton-key-malware-allows-bypassing-of-passwords

Posted in Internet, Security, Windows | No Comments

Keysweeper: creepy keystroke logger camouflaged as USB charger

KeySweeper is a stealthy Arduino-based device, camouflaged as a functioning USB wall charger, that wirelessly and passively sniffs, decrypts, logs and reports back all keystrokes from any Microsoft wireless keyboards (which use a proprietary 2.4GHz RF protocol) in the area.

Keystrokes are sent back to the KeySweeper operator over the Internet via an optional GSM chip, or can be stored on a flash chip and delivered wirelessly when a secondary KeySweeper device comes within wireless range of the target KeySweeper. A web based tool allows live keystroke monitoring.

KeySweeper has the capability to send SMS alerts upon certain keystrokes being typed, e.g. “www.bank.com”. If KeySweeper is removed from AC power, it appears to shut off, however it continues to operate covertly using an internal battery that is automatically recharged upon reconnecting to AC power.

Source:
http://samy.pl/keysweeper/

Posted in Hardware, Internet, Mobile, Privacy, Security | No Comments