'Zombifying' Cyber-attack Could Affect +50 Million Internet Users

More than 50 million people per month could be at risk of a mass-scale 'malvertising' cyber-attack that turns computers into Zombies, according to researchers at Websense, reports Lara Lackie of Eskenzi PR. The attack routes through advertising platforms to target popular websites, with researchers noting breaches on Bejewelled Blitz on Facebook, CNN Indonesia, the official websites of Prague Airport and RTL Television Croatia, as well as Detik and AASTOCKS.

It was discovered that the attack utilizes open advertising platform OpenX, which sees up to 100 billion impressions per month, to compromise and inject malicious code which is spread to multiple websites. The injected code leads to a redirect which has been seen to lead to the highly prevalent Angler Exploit Kit, which exploited the latest Adobe Flash Player vulnerability (CVE-2015-3090), distributed CryptoWall 3.0, Bedep and Necurs, as well as a Trojan known as 'Bunitu.' The Bunitu malware dropped by Angler 'Zombifies' computers, by causing infected machines to act as a proxy. This enables it to be used for subsequent malicious activity and allows cybercriminals to hide behind legitimate users’ machines to avoid detection by the authorities.

Carl Leonard, principal security analyst at Raytheon|Websense, said, "Advertising networks are an increasingly popular focus for cybercriminals, as they open up avenues to infect millions of users with minimal effort. The growing nature of evasion, stealth and variation employed in the malicious code means that it's more important now than ever to deploy a security solution capable of stopping threats at multiple points in the kill chain."

TK Keanini, Lancope CTO, added, "I think this quote from Websense says it all, and let me call out a few things here to highlight the salient points.

"These methods are popular for cybercrime because they require minimal effort, which means lowering their operational costs. We, in turn, need to ensure that we are doing everything thing to raise their operating costs. Business leaders understand these economics, and until we treat this as a business problem, cyber crime will continue to operate at a low cost and high profit meaning their business is growing and they are expanding.

"He also says that we need to do everything to stop their operations along the kill chain. This kill chain terminology limits us in our discussion, and I prefer to call it the attack continuum because then we can, in the same thought process, speak about a defense continuum which describes perfectly the strategy we must instrument and operate. The defense continuum captures the defender's tactics, techniques and procedures that raise to the cost to the attacker's operation and objectives."

Protecting Mobile Networks and Devices 2015: Call for Book Chapter

Protecting Mobile Networks and Devices 2015

Call for Book Chapters: Protecting Mobile Networks and Devices: Challenges and Solutions (CRC Press-Taylor & Francis)

Call for Book Chapters: Protecting Mobile Networks and Devices

Call for Book Chapters: Protecting Mobile Networks and Devices

This book welcomes chapters on a wide range of issues related to mobile networks and devices, including all aspects of attacks and solutions. Indicative topics include, but are not limited to, the following:

- Intrusion detection and prevention schemes for mobile networks
- Tracing back mobile attackers
- Secure routing and access control
- Mobile authentication mechanisms
- Security testing of new or existing usability features,
- Agent based intrusion surveillance
- Wireless Access Technologies
- Multimedia security issues for tackling intruders

We welcome both surveys and technical chapters presenting novel analytical research, simulations, practical results and case studies.

http://www.wikicfp.com/cfp/servlet/event.showcfp?eventid=43962%C2%A9ownerid%3D74982

Android Ransomware Spreading via SMS

From Eskenzi PR Ltd:

Following the news that a Koler worm is spreading via SMS and holding Android phones for ransom  Mark James, security specialist at  ESET, explains how the attack works and how to get rid of it:

"The natural progression from desktop to mobile device for ransomware was going to pick up momentum at some point and sure enough, we are seeing more and more cases of malware on the mobile platforms (Android). The biggest factor in this is people's assumption that they are safe on a mobile.
"In this particular case, an SMS is used for the initial contact - which in itself can lure a level of trust that emails do not have - if the masked (truncated) link is followed by a page that will display some kind of tasty treat for free (that may include a free service or free app) which once installed will contain the malware, ransom screens are then presented on your device with no apparent way to get rid of them. These often will use such words as "child pornography" designed to scare the individual into paying the ransom to have it removed.
"Removing these type of infections is often very simple and can be done by either booting into safe mode (internet searches will often yield many results on how to do this yourself) and uninstalling the offending application (or the last installed app if you don’t remember the name) or as a last resort, factory resetting the device and restoring from your last good backup ( maybe 1 or 2  days prior to be safe ). The best advice I can give here is DO NOT install any apps from third party websites or links, both Apple and Google Play are by no means 100% safe but they are a lot safer than using a random website to install apps."

Related Books:

Android Malware and Analysis by Ken Dunham and Friends

Android Security: Attacks and Defenses by Anmol Misra and Abhishek Dubey

New Android Malware Is Disguised as a Security App

Nothing really new here, is there? Just some old scam moved to a new platform. We should expect this. Sometime soon, in order to make these appear more legitimate, will these apps carry a price tag and require payment?

Just Say No?

It wasn't easy to do when Nancy Reagan wanted kids to reject peer-pressure to try drugs, and it's apparently even harder to say no to users intent on BYOD.

The same people who want to create more security threats now want more security. I wonder what they'll think about more security when it'll require installation management software on their digital toys, and maybe have to submit to intense awareness training?

Mobile payments will boost crime

Well, here's another "dog bites man" story. Is there any technical advance that won't boost crime? Don't all these advances become challenges to those with a criminal bent, or just curious? I'm not at ease with this, even though I use online banking. I'm still not sure how banks allow deposits based on a photo from a smartphone. Seems like that's ripe for abuse, too.

Just when you thought it was safe to go to the mall

A new ISACA white paper warns of the risks of bad guys combining GPS data and PII to target victims.