 Your new post is loading...
Your new post is loading...
|
Scooped by
Gust MEES
December 2, 2016 5:53 AM
|
A million Google accounts have been compromised in a massive fraud campaign exploiting Android devices and Google Play.
At the heart of the campaign is a new variant of Android malware dubbed Gooligan, concealed in dozens of Android apps that exploit two unpatched flaws in Android to root infected devices.
The malware nabs email account information and authentication tokens for accessing Google accounts. The attackers use the tokens to install select apps from Google Play on an infected device to boost in-app advertising revenue. Learn more / En savoir plus / Mehr erfahren: http://www.scoop.it/t/securite-pc-et-internet/?tag=Android
|
|
Scooped by
Gust MEES
November 7, 2016 7:54 AM
|
|
|
Scooped by
Gust MEES
April 12, 2016 7:21 PM
|
A malvertising campaign has swamped most of the Netherlands’ most popular sites, affecting millions of users.
The campaign began to take root on Sunday, when security firm Fox-IT noted a spike in incidents involving malware exploit kits.
Spotted among those kits was the notorious Angler: the CaaS, or Crimeware-as-a-Service, that crooks have chosen to spread such nasties as the CryptoWall 4.0 ransomware.
As of Monday, at least 288 websites had been infected with malvertising, exposing millions to poisoned ads.
One example of how far its tentacles have reached: the campaign has hit Nu.nl, the most-visited Dutch-language news portal.
Nu.nl alone is estimated to have scored more than 50 million visitors in March, according to Tech Week Europe.
Other affected sites include eBay-style service Marktplaats.nl and well-known news and culture sites, according to Fox-IT.
|
|
Scooped by
Gust MEES
February 21, 2016 12:49 PM
|
|
|
Scooped by
Gust MEES
December 5, 2015 7:32 AM
|
An ongoing attack campaign combines a very effective password stealer, the most widespread exploit kit, called Angler, and the latest version of the infamous CryptoWall file-encrypting ransomware program.
|
|
Scooped by
Gust MEES
November 10, 2015 6:00 AM
|
The UK parliament's secure network has been breached and several computers on it have been compromised by hackers, The Times has reported.
The newspaper makes is sound like the attack was targeted, and the target was Chi Onwurah, MP for Newcastle upon Tyne Central and the Labour Party’s shadow minister for culture and the digital economy, and her employees.
But they also say that they hackers compromised the systems by delivering and spreading crypto-ransomware, which ended up encrypting sensitive files stored in a shared drive used by some 8,500 government employees (MPs, lords, staff, etc.).
After MP Onwurah was faced with the ransom note, she reported the problem and the Parliamentary Digital Service (PDS) first cut her off the shared drive, than took her computers and cleaned them up by replacing the hard drives.
The MP said that no files containing information about constituents were compromised.
Learn more:
http://www.scoop.it/t/securite-pc-et-internet/?tag=RANSOMWARE
|
|
Scooped by
Gust MEES
November 7, 2015 12:41 PM
|
|
|
Scooped by
Gust MEES
November 6, 2015 11:19 AM
|
|
|
Scooped by
Gust MEES
July 28, 2015 8:30 PM
|
What about malware on Linux?
Here's how the argument might go if you were to ask that question:
Malware is impossible on Linux because Linux is secure by design, unlike Windows.
Even if Linux malware were possible, users would have to agree to run it, so that wouldn't count.
Even if users agreed to run it, they wouldn't be root, so that wouldn't count.
Even if they were root, who cares? There isn't any malware for Linux, so there.
The simple truth, of course, is that Linux is much more similar to Windows – in design, implementation and real-world security – than it is different.
As a result: there is malware for Linux; it can do plenty of harm even if you aren't root; and it may be able to infect without you realising.
Just like on Windows.
For all that, the "malware scene" on Linux simply never unfolded like it did on Windows, because the vast
Learn more:
http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux
|
|
Scooped by
Gust MEES
February 16, 2015 8:07 AM
|
|
|
Scooped by
Gust MEES
January 28, 2015 6:35 AM
|
A recent incident at the White House showed that small aerial vehicles (drones) present a specific security problem.
While in this particular case the actual danger turned out to be non-existent, the fact that these devices can be hijacked and misused for malicious purposes is something that the manufacturers will have to think about very soon.
Learn more:
- http://www.scoop.it/t/securite-pc-et-internet/?tag=Maldrone
|
|
Scooped by
Gust MEES
January 15, 2015 8:34 AM
|
Bei einer Analyse eines sich seltsam verhaltenden Domain Controllers entdeckten Sicherheitsspezialisten eine ganz besondere Hintertür: Einbrecher hatten die Windows Server so manipuliert, dass ein Master-Passwort universellen Zugang gewährte.
Learn more:
- http://www.scoop.it/t/securite-pc-et-internet/?tag=Skeleton-Key
|
|
Scooped by
Gust MEES
January 14, 2015 12:17 PM
|
|
|
|
Scooped by
Gust MEES
November 23, 2016 5:31 PM
|
Ein Android-Updater der eher unbekannten Firma Ragentek ist nicht nur extrem unsicher, er verhält sich auch wie ein Rootkit. Das Programm steckt in etlichen Smartphone-Modellen chinesischer Hersteller, welche auch auf dem hiesigen Markt vertreten sind.
Über 2,8 Millionen Geräte kontaktierten die falschen Update-Server. Die Forscher versuchten, die Gerätemodelle zu identifizieren und Herstellern zuzuordnen.
Bild: AnubisNetworks In zahlreichen Android-Smartphone chinesischer Hersteller steckt eine Backdoor, durch die der Hersteller – oder ein Angreifer – beliebige Befehle mit Root-Rechten ausführen kann. Für das Security-Debakel ist offenbar ein Update-Prozess verantwortlich, der gewährleisten soll, dass die Geräte-Software auf dem aktuellen Stand ist.
Sie stammt von Ragentek und kommt nicht nur auf Android-Geräten dieses Herstellers zum Einsatz sondern auch bei BLU, Infinix Mobility, Beeline, Doogee, IKO Mobile, Leagoo und XOLO.
2,8 Millionen Geräte kontaktieren falschen Update-Server!!! Learn more / En savoir plus / Mehr erfahren: http://www.scoop.it/t/securite-pc-et-internet/?tag=Android
|
|
Scooped by
Gust MEES
June 1, 2016 1:00 PM
|
Die vom Security-Anbieter Doctor Web als “BackDoor.TeamViewer.49” bezeichnete Schadsoftware schleicht sich als vermeintliches Update für den Adobe Flash Player auf Windows-Rechner. Über die mitinstallierte Teamviewer-Software verschaffen sich die Kriminellen dann Zugang zu dem infizierten Rechner.
Der IT-Security-Anbieter Doctor Web hat vor einer neu aufgetauchten Malware gewarnt, mit der Kriminelle Windows-Systeme angreifen. Die Malware installiert dazu missbräuchlich die verbreitete Fernwartungssoftware Teamviewer und stellt darüber die Verbindung zu einem Server der Hintermänner her, um den Datenverkehr dann an eine vordefinierte Adresse weiterzuleiten. Die Cyberkriminellen verwischen so ihre Spuren und stellen eine Verbindung zu Remote-Befehlszentren über einen infizierten PC als Proxy-Server her. Learn more / En savoir plus / Mehr erfahren: http://www.scoop.it/t/securite-pc-et-internet/
|
|
Scooped by
Gust MEES
March 30, 2016 7:36 PM
|
Remaiten Linux Bot Targets Routers and Potentially Other Embedded (IoT) Devices
A new piece of malware is targeting embedded systems with the mission to compromise and make them part of a botnet, ESET security researchers have discovered.
Dubbed “Remaiten” (Linux/ Remaiten), the new threat combines the capabilities of previously spotted Tsunami (also known as Kaiten) and Gafgyt malware and also brings a series of improvements and new features. According to ESET, three versions of Remaiten have already emerged, while the malware authors call their creation “KTN-Remastered” or “KTN-RM.”
One of the capabilities that Remaiten borrows from Gafgyt is telnet scanning, though Remaiten enjoys a series of improvements, ESET’s Michal Malik explains in a blog post. Both, however, rely on improperly secured devices to successfully infect them.
Gafgyt attempts to connect to random routers via port 23, which it then issues a shell command to download bot executables for multiple architectures and tries to run them. Remaiten, on the other hand, carries downloaders for CPU architectures commonly used in embedded Linux devices, then tries to trigger the device’s platform to drop only the appropriate downloader. Learn more / En savoir plus / Mehr erfahren: http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things http://www.scoop.it/t/securite-pc-et-internet/?tag=Router
|
|
Scooped by
Gust MEES
December 30, 2015 2:31 PM
|
ProxyBack stealthily uses your bandwidth to route traffic from a shady Russian proxy seller. ...
For as long as people have been doing productive things with software, there have been jerks making malware to screw things up and make money. As security gets better, the malware has gotten smarter over the years. Some modern variants like ransomware are pretty clever, but Palo Alto Networks has just reported discovery of something new. ProxyBack sets up anonymous proxies on infected PCs to route traffic over the victim’s connection.
There is demand for proxy connections in various countries, for both legitimate and non-legitimate uses. When ProxyBack managed to infiltrate a system (probably via deceptive software downloads), it goes to work setting up a reverse tunnel on the machine. This allows ProxyBack to circumvent security measures like software and hardware firewalls that prevent the flow of data.
|
|
Scooped by
Gust MEES
November 11, 2015 5:25 PM
|
Researchers have exploited a flaw in the encryption procedure used by the Linux.Encoder.1 - the first ransomware targeting the Linux platform - to develop a decryption tool for victims.
On Thursday, Russian anti-virus company Dr. Web first disclosed the existence of Linux.Encoder.1, a strain of ransomware similar to other notorious ransomware families such as CryptoWall and TorLocker, but targeting computers running Linux rather than Windows. Evidence of infections by Linux.Encoder.1 are scattered across the net, because many websites appear to be revealing their impacted state in search engine results.
Learn more:
http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux
http://www.scoop.it/t/securite-pc-et-internet/?tag=RANSOMWARE
|
|
Scooped by
Gust MEES
November 9, 2015 2:55 PM
|
A new ransomware campaign dubbed Linux.Encoder.1 is targeting web servers using the Linux operating system and is demanding a payment of one bitcoin, or $380, from its victims for the release of the captured files.
Researchers at the anti-virus firm Dr. Web said the cybercriminals appear to target network administrator computers because these hold the web server software that they are interested in controlling. It was also noted that in some cases the attackers used the CMS Magneto vulnerability to attack the web servers.
The Dr. Web staff did not have a firm idea how prevalent these attacks have been, but they “presume that at least tens of users have already fallen victim to this trojan.” An email by SCMagazine.com to Dr. Web to confirm the number of infected systems has not yet been returned.
Learn more:
http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux
http://www.scoop.it/t/securite-pc-et-internet/?tag=RANSOMWARE
|
|
Scooped by
Gust MEES
November 7, 2015 11:37 AM
|
|
|
Scooped by
Gust MEES
October 2, 2015 7:29 PM
|
|
|
Scooped by
Gust MEES
May 27, 2015 4:40 PM
|
Die Einstiegshürde für angehende Online-Erpresser ist erneut gesunken: Ein Dienst im Tor-Netz erstellt nach wenigen Klicks den individuellen Erpressungs-Trojaner. Falls ein Opfer das geforderte Lösegeld zahlt, verdienen die Betreiber mit.
Die Einstiegshürde für angehende Online-Erpresser ist erneut gesunken: Ein Dienst im Tor-Netz erstellt nach wenigen Klicks den individuellen Erpressungs-Trojaner. Falls ein Opfer das geforderte Lösegeld zahlt, verdienen die Betreiber mit.
- http://www.scoop.it/t/securite-pc-et-internet/?tag=TOR
|
|
Scooped by
Gust MEES
February 7, 2015 6:41 AM
|
A malware program designed for Linux systems, including embedded devices with ARM architecture, uses a sophisticated kernel rootkit that’s custom built for each infection.
The malware, known as XOR.DDoS, was first spotted in September by security research outfit Malware Must Die. However, it has since evolved and new versions were seen in the wild as recently as Jan. 20, according to a new report Thursday from security firm FireEye, which analyzed the threat in detail.
XOR.DDoS is installed on targeted systems via SSH (Secure Shell) brute-force attacks launched primarily from Internet Protocol (IP) addresses registered to a Hong Kong-based company called Hee Thai Limited.
The attacks attempt to guess the password for the root account by using different dictionary-based techniques and password lists from past data breaches. FireEye observed well over 20,000 SSH login attempts per targeted server within a 24-hour period and more than 1 million per server between mid-November and end of January.
Learn more:
- http://www.scoop.it/t/securite-pc-et-internet/?tag=Linux
|
|
Scooped by
Gust MEES
January 28, 2015 5:53 AM
|
|
|
Scooped by
Gust MEES
January 14, 2015 2:37 PM
|
It's time to use two-factor authentication, folks.
The newly-discovered "Skeleton Key" malware is able to circumvent authentication on Active Directory systems, according to Dell researchers. The Dell SecureWorks Counter Threat Unit (CTU) teampublished their findings in an advisory notice this week.
|
Learn more / En savoir plus / Mehr erfahren:
http://www.scoop.it/t/securite-pc-et-internet/?tag=Android