Zeus Botnet Exploits PDF "Feature"

"The Zeus botnet is now using an unpatched flaw in Adobe's PDF document format to infect users with malicious code, security researchers said today.

"The attacks come less than a week after other experts predicted that hackers would soon exploit the `/Launch` design flaw in PDF documents to install malware on unsuspecting users' computers.

"The just-spotted Zeus variant uses a malicious PDF file that embeds the attack code in the document, said Dan Hubbard, CTO of San Diego, Calif.-based security company Websense. When users open the rogue PDF, they're asked to save a PDF file called `Royal_Mail_Delivery_Notice.pdf.` That file, however, is actually a Windows executable that when it runs, hijacks the PC.

"Zeus is the first major botnet to exploit a PDF's /Launch feature, which is, strictly speaking, not a security vulnerability but actually a by-design function of Adobe's specification. Earlier this month, Belgium researcher Didier Stevens demonstrated how a multistage attack using /Launch could successfully exploit a fully-patched copy of Adobe Reader or Acrobat..."

From ComputerWorld...

Tweeker Busted For High School Hack

"A 21-year-old former Evergreen Public Schools student has pleaded guilty to criminal charges in connection with a computerized payroll security breach in November that put more than 5,000 past and current Vancouver Public Schools employees at risk of identity theft.

"Christopher Berge, a 2006 Mountain View High School graduate last known to live in Oregon City, Ore., was sentenced to 10 years in prison on Wednesday by Clark County Superior Court Judge Roger Bennett.

"Berge pleaded guilty to 31 counts, including 24 counts of second-degree identity theft, first-degree computer trespass, forgery and possession of methamphetamine."

More at The Columbian...

MS, Adobe, Apple Bitch-Slapped At Pwn2Own

"The only researcher to `three-peat` at the Pwn2Own hacking contest said today that security is such a `broken record` that he won't hand over 20 vulnerabilities he's found in Apple's, Adobe's and Microsoft's software.

"Instead Charlie Miller will show the vendors how to find the bugs themselves.

"Miller, who yesterday exploited Safari on a MacBook Pro notebook running Snow Leopard to win $10,000 in the hacking challenge, said he's tired of the lack of progress in security. `We find a bug, they patch it,` said Miller. `We find another bug, they patch it. That doesn't improve the security of the product. True, [the software] gets incrementally better, but they actually need to make big improvements. But I can't make them do that.`"

From ComputerWorld...

Hinky Dink Publishes Koobface Data

"Mr. Hinky Dink, a Big Time Security Professional™ today released an analysis of the spread of the Koobface worm. Based on an exhaustive study of his database of over two and a half million open Web proxies collected over two years, Hinky’s findings demonstrate where the most vulnerable social networking users can be found.

"`With more losers piling into social networking sites this trend is very likely to continue,` said Hinky. `This study highlights the cities with the most gullible users on the Internet. This study will no doubt help cybercriminals, script kidz, and Cameroonian puppy scammers target their next online marketing campaigns.`"

Read the complete report here.

Can You Hack Me now?

"Malware-tainted memory cards may have ended up on as many as 3,000 HTC Magic phones, a greater number than first suspected, Vodafone said today.

"The problem came to light earlier this month after an employee of Panda Security plugged a newly ordered phone into a Windows computer, where it triggered an alert from the antivirus software.

"Further inspection of the phone found the device's 8GB microSD memory card was infected with a client for the now-defunct Mariposa botnet, the Conficker worm and a password stealer for the Lineage game.

"Vodafone said it was an isolated incident, but an employee at Spanish security company S21sec discovered another phone with an infected card, which it sent to Panda. That phone was purchased directly from Vodafone's Web site in the same week as the first phone, according to Panda.

"It is unclear how the batch of memory cards became infected and an investigation is under way, said a spokesman for Vodafone in Spain."

More at ComputerWorld...

Massive Oracle PWN@G3 At Black Hat

"In 2001, Larry Ellison brashly proclaimed in a keynote speech at the computing conference Comdex that his database software was "unbreakable." David Litchfield has devoted the last nine years to making the Oracle chief executive regret that marketing stunt.

"At the Black Hat security conference Tuesday afternoon, Litchfield unveiled a new bug in Oracle's 11G database software, a critical, unpatched vulnerability that would allow a hacker to take control of an Oracle database and access or modify information at any security level. `Anything that God can do on that database, you can do,` Litchfield [said] in an interview following his talk.

"The attack that Litchfield laid out for Black Hat's audience of hackers and cybersecurity researchers exploits a combination of flaws in Oracle's software. Two sections of code within the company's database application--one that allows data to be moved between servers and another that allows management of Oracle's implementation of java--are left open to any user, rather than only to privileged administrators. Those vulnerable subroutines each have their own simple flaws that allow the user to gain complete access to the database's contents.

"Litchfield says he warned Oracle about the flaws in November, but they haven't been patched. Oracle didn't immediately respond to a request for comment."

More at Forbes.com...

Microsoft Hacks Firefox Users

"An add-on that Microsoft silently slipped into Mozilla's Firefox last February leaves that browser open to attack, Microsoft's security engineers acknowledged earlier this week.

"One of the 13 security bulletins Microsoft released Tuesday affects not only Internet Explorer (IE), but also Firefox, thanks to a Microsoft-made plug-in pushed to Firefox users eight months ago in an update delivered via Windows Update.

"`While the vulnerability is in an IE component, there is an attack vector for Firefox users as well,` admitted Microsoft engineers in a post to the company's Security Research & Defense blog on Tuesday. `The reason is that .NET Framework 3.5 SP1 installs a 'Windows Presentation Foundation' plug-in in Firefox.`

"What was particularly galling to users was that once installed, the .NET add-on was virtually impossible to remove from Firefox..."

More at Computerworld...

PDF Pwnage Continues Unabated

"Attackers once again are targeting an unpatched vulnerability in Adobe Reader that allows them to take complete control of a user's computer, the software maker warned.

"Adobe said it planned to patch the critical security bug in Reader and Acrobat 9.1.3 for Windows, Mac and Unix on Tuesday, the date of the company's previously scheduled patch release for the PDF reader. According to Security Focus here, attackers can exploit the vulnerability by tricking a user into opening a booby-trapped PDF file.

"`Successful exploits may allow the attacker to execute arbitrary code in the context of a user running the affected application,` the security site warned. `Failed attempts will likely result in denial-of-service conditions.`

"The bug is presently being exploited in `limited targeted attacks,` Security Focus added, without elaborating. Adobe said only that the attacks target Reader and Adobe running on Windows operating systems."

More at The Register...

IT Employee Of The Week

"In a twist of Alanis Morrissettian irony, a man serving a six-year prison sentence for stealing millions of dollars through online credit card fraud recently succeeded in (surprise!) hacking into his prison's computer network, effectively paralyzing the entire system. The really incomprehensible part, though, is that officials at Ranby Prison, close to Retford, Nottinghamshire, England, gave him access to the computer.

"Apparently in dire need of an internal TV station at the facility, officers decided against hiring a third party (e.g., not a convicted hacker) to set up the system. They instead opted to keep the operation in (the Big) house, delegating the duty to one Douglas Havard. So, as convicted hackers are wont to do, Havard, left unguarded, worked his way into the prison's hard drive, and set up a labyrinth of passwords to lock everyone else out of the system....."

More at switched.com...

iPwn3d

"On Thursday, two researchers plan to reveal an unpatched iPhone bug that could virally infect phones via SMS.

"If you receive a text message on your iPhone any time after Thursday afternoon containing only a single square character, Charlie Miller would suggest you turn the device off. Quickly.

"That small cipher will likely be your only warning that someone has taken advantage of a bug that Miller and his fellow cybersecurity researcher Collin Mulliner plan to publicize Thursday at the Black Hat cybersecurity conference in Las Vegas. Using a flaw they've found in the iPhone's handling of text messages, the researchers say they'll demonstrate how to send a series of mostly invisible SMS bursts that can give a hacker complete power over any of the smart phone's functions. That includes dialing the phone, visiting Web sites, turning on the device's camera and microphone and, most importantly, sending more text messages to further propagate a mass-gadget hijacking."

More at Forbes.com...

Patch Tuesday Brings 0day Relief

"A critical ActiveX vulnerability used by hackers to exploit Microsoft Corp.'s Internet Explorer browser is a prime candidate for another Conficker-scale attack, security experts said.

"On July 6, just hours after security companies reported that thousands of compromised sites were serving up exploits, Microsoft acknowledged the flaw in the ActiveX control that can be accessed using IE. The bug has been used by hackers since at least June 9.

"Microsoft said it will issue a patch for the flaw on July 14..."

More at ComputerWorld...

MS Hacks Firefox Behind Your Back

"The Microsoft .NET Framework 3.5 Service Pack 1 update, pushed through the Windows Update service to all recent editions of Windows in February 2009, installs the Microsoft .NET Framework Assistant firefox extension without asking your permission.

"This update adds to Firefox one of the most dangerous vulnerabilities present in all versions of Internet Explorer: the ability for websites to easily and quietly install software on your PC. Since this design flaw is one of the reasons you may've originally choosen to abandon IE in favor of a safer browser like Firefox, you may wish to remove this extension with all due haste..."

More at annoyances.org...

Twits Scammed - AGAIN

"Twitter users who thought friends were directing them to a "funny blog" Thursday ended up experiencing something completely different: a phishing scam.

"Twitter was hit by two different rounds of phishing Thursday, as criminals tried to take control of user accounts and then use them as a springboard to attack others.

"Both Twitter and Facebook have been hit with phishing attacks in recent days. `The social networking attacks are becoming increasingly common,` said Jamie De Guerre, chief technology officer with antispam vendor Cloudmark. `Spammers are really moving to attack social networks because of the popularity of the social networks and also because they're not as well defended as most e-mail platforms.`"

From ComputerWorld...

New York ATM Customers PWN3D

"A band of brazen thieves ripped off hundreds of New Yorkers by rigging ATMs to steal account and password information from bank customers.

"They used the pilfered info to swipe half a million dollars from their victims' bank accounts - the latest twist in increasingly aggressive identity-theft scams, police said.

"`This crew is sophisticated,` said Deputy Inspector Gregory Antonsen, head of the NYPD's special investigations division. `And they are coming up with new ways to steal your identity every day.`"

More at NY Daily News...

Mini Servers For Mega Pwnage

"Tiny computers are everywhere—our cell phones, handheld gaming devices and set-top boxes, to name a few—so it should be no surprise that Marvell Technology in Santa Clara, Calif., one of the companies that makes the chips that go into such devices, managed to cram an entire home server into the SheevaPlug, a two-inch by four-inch (five- by 10-centimeter) box that plugs into any wall outlet and is almost indistinguishable from an oversize power supply.

"ScientificAmerican.com found some adventurous alpha geeks at the Massachusetts Institute of Technology's (M.I.T.) Computer Science and Artificial Intelligence Laboratory (CSAIL), Carnegie Mellon University, Intel and elsewhere and asked them what kind of uses they could come up with for the SheevaPlug. We came away with eight different ideas..."

More at ScientificAmerican.com...

I Like Big Bots And I Cannot Lie

Baby Got Haxx

"The world's largest-ever malware network has been uncovered, affecting 1.9 million corporate, government and consumer computers.

"Finjan Inc's Malicious Code Research Center (MCRC) uncovered the network as part of research into command and control servers operated by cybercriminals.

"`It is the biggest ever - 600,000 was the largest last year,` a spokesman for Finjan told TG Daily. He declined to name the organisations affected, but said `I think you can assume that most large corporations and most western governments are affected.`"

More at TG Daily...

Evidence Of Zombie Mac Botnet Found

"If you let yourself get tempted into installing the pirated versions of iWork or Photoshop CS4 that circulated on Bit Torrent earlier this year, you may have unwittingly turned your Mac into a zombie. Security researchers for Symantec have turned up evidence that these zombie machines are being used to create a Mac-based botnet.

"Botnets are used to perform DDoS attacks on systems, gather sensitive personal information, and send out a majority of the spam that clogs up the 'Net. While commonly made out of infected Windows computers, this is the first known attempt to create one from Macs..."

More at Ars Technica...

Beware The Smiley :-)

"Yoann Guillot and myself have been assessing the security of instant communication applications for a couple of years.

"For quite some time now, we have both suspected that it was possible to conduct both stealth and massive attacks on popular chat clients such as MSN, AIM, Trillian or mIRC.

"Today, we have verified our intuition by creating an encoder that can make any shellcode look like a smiley. It is possible to encode malicious shellcodes in emoticons, leaving exploits indistinguishable from genuine chat messages.

"This would make massive attacks against instant messaging applications impossible to catch by anti-virus, IDS or similar signature based technologies. Moreover, it is possible to conduct attacks with plausible deniability."

More at blogspot...

Security Researchers Admit To Having NO CLUE

No Surprise There

"Security researchers are in the dark about what will happen next week when the newest variant of Conficker, 2009's biggest worm by a mile, begins trying to contact its controllers.

"`It's impossible to know until we see something that has a clear profit motive,` said Joe Stewart, director of malware research at SecureWorks Inc. and a noted botnet researcher.

"PCs infected with Conficker.c, the third version of the worm that first appeared late last year, will use a new communication scheme on April 1 to establish a link to the command-and-control servers operated by the hackers who seeded the malware. The date is hard-coded into the worm, which in turn polls any of a number of major Web sites, including Yahoo, for the date, said Stewart.

"That tactic is just one of several designed to make it tough for security researchers to figure out what Conficker's all about, and more importantly, what it might do..."

From ComputerWorld...

Hackers Deflower Virgin Media

"More than a thousand hackers are using reconfigured cable modems to fraudulently access free high speed Virgin Media broadband, sources have revealed.

"The hack has been made possible by the recent launch of Virgin Media's 50Mbit/s `XXL` package. It relies on new equipment running the upgraded DOCSIS 3.0 data transmission standard.

"The launch has allowed hackers to apply the new configuration from Virgin Media's official up to 50Mbit/s home modem to legacy DOCSIS 1.0 hardware, to access the DOCSIS 1.0 platform at higher speeds. Our source said over a thousand lines have been seen obtaining about 30Mbit/s downstream.

"Virgin Media told The Register it was aware of the problem and was working to address it."

From The Register...