Skip to main content

Home/ Indie Nation/ Group items tagged malware

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
John Lemke

Stepson of Stuxnet stalked Kaspersky for months, tapped Iran nuke talks | Ars Technica - 0 views

arstechnica.com/...-months-tapped-iran-nuke-talks

2015 kaspersky iran ars stuxnet malware cyber warfare espionage blackhat attack virus zero-day

shared by John Lemke on 10 Jun 15 - No Cached
  • Since some time in the second half of 2014, a different state-sponsored group had been casing their corporate network using malware derived from Stuxnet, the highly sophisticated computer worm reportedly created by the US and Israel to sabotage Iran’s nuclear program.
  • the malware was more advanced than the malicious programs developed by the NSA-tied Equation Group that Kaspersky just exposed. More intriguing still, Kaspersky antivirus products showed the same malware has infected one or more venues that hosted recent diplomatic negotiations the US and five other countries have convened with Iran over its nuclear program.
  • We see this battle or arms race emerging and now it involves some kind of confrontation between the security industry and nation-state sponsored spies
  • ...3 more annotations...
  • Kaspersky officials first became suspicious their network might be infected in the weeks following February's Security Analyst Summit, where company researchers exposed a state-sponsored hacking operation that had ties to some of the developers of Stuxnet. Kaspersky dubbed the highly sophisticated group behind the 14-year campaign Equation Group. Now back in Moscow, a company engineer was testing a software prototype for detecting so-called advanced persistent threats (APTs), the type of well-organized and highly sophisticated attack campaigns launched by well-funded hacking groups. Strangely enough, the developer's computer itself was having unusual interactions with the Kaspersky network. The new APT technology under development, it seemed, was one of several things of interest to the Duqu attackers penetrating the Kaspersky fortress. "For the developer it was important to find out why" his PC was acting oddly, Kamluk said. "Of course, he did not consider that machine could be infected by real malware. We eventually found an alien module that should not be there that tried to mask behind legitimate looking modules from Microsoft. That was the point of discovery."
  • What they found was a vastly overhauled malware operation that made huge leaps in stealth, operational security, and software design. The Duqu actors also grew much more ambitious, infecting an estimated 100 or so targets, about twice as many as were hit by the 2011 version.
  • So the Duqu 2.0 attackers pulled an audacious feat that Kaspersky researchers had never seen before. Virtually all of the malware resided solely in the memory of the compromised computers or servers. When one of them was restarted, the infection would be purged, but as the rebooted machine reconnected to the network, it would be infected all over again by another compromised computer in the corporate network. The secret lynchpin making this untraceable reinfection scheme possible was the Windows vulnerability Microsoft patched only Tuesday, which has been designated
John Lemke

F-Secure: Android accounted for 97% of all mobile malware in 2013, but only 0.1% of tho... - 0 views

thenextweb.com/...e-malware-2013-0-1-google-play

2014 indienationnews mobile malware google android

shared by John Lemke on 05 Mar 14 - No Cached
  • Android threats are primarily a non-US problem
  • F-Secure believes it would be incorrect to say that “Google hasn’t been actively making efforts to increase the security of the Android platform.”
  • At the very bottom of the list was Google Play itself, with the lowest percentage of malware in the gathered samples: 0.1 percent. F-Secure also noted that “the Play Store is most likely to promptly remove nefarious applications, so malware encountered there tends to have a short shelf life.”
John Lemke

Active malware operation let attackers sabotage US energy industry | Ars Technica - 0 views

arstechnica.com/...rs-sabotage-us-energy-industry

2014 indienationnews malware energy industry cuberattack hacking security

shared by John Lemke on 30 Jun 14 - No Cached
  • Researchers have uncovered a malware campaign that gave attackers the ability to sabotage the operations of energy grid owners, electricity generation firms, petroleum pipelines, and industrial equipment providers.
  • the hacking group managed to install one of two remote access trojans (RATs) on computers belonging to energy companies located in the US and at least six European countries, according to a
  • Called Dragonfly
  • ...3 more annotations...
  • "This campaign follows in the footsteps of Stuxnet, which was the first known major malware campaign to target ICS systems," the Symantec report stated. "While Stuxnet was narrowly targeted at the Iranian nuclear program and had sabotage as its primary goal, Dragonfly appears to have a much broader focus with espionage and persistent access as its current objective with sabotage as an optional capability if required."
  • been in operation since at least 2011
  • "The Dragonfly group is technically adept and able to think strategically," the Symantec report stated. "Given the size of some of its targets, the group found a 'soft underbelly' by compromising their suppliers, which are invariably smaller, less protected companies."
John Lemke

Caphaw Banking Malware Distributed via YouTube Ads - The Hacker News - 0 views

thehackernews.com/...alware-distributed-via_24.html

technology 2014 malware youtube ads indienationnews tech security

shared by John Lemke on 25 Feb 14 - No Cached
  • The Exploitation process relied upon a Java vulnerability (CVE-2013-2460) and after getting dropped into the target computer system, the malware detects the Java version installed on the operating system and based upon it requests the suitable exploit.
John Lemke

Uroburos Rootkit: Most sophisticated 3-year-old Russian Cyber Espionage Campaign - The ... - 0 views

thehackernews.com/...tkit-most-sophisticated-3.html

rootkit russian espionage 2014 indienationnews hacker technology tech security malware

shared by John Lemke on 05 Mar 14 - No Cached
  • The researchers claimed that the malware may have been active for as long as three years before being discovered and appears to have been created by Russian developers.
  • The two main components of Uroburos are - a driver and an encrypted virtual file system, used to disguise its nasty activities and to try to avoid detection. Its driver part is extremely complex and is designed to be very discrete and very difficult to identify.
  • The virtual file system can’t be decrypted without the presence of drivers, according to the Gdata’s analysis explained in the PDF.
  • ...2 more annotations...
  • we assume that the group behind Uroburos is the same group that performed a cyberattack against the United States of America in 2008 with a malware called Agent.BTZ
  • The attacks carried out with Uroburos are targeting government institutions, research institutions, intelligence agencies, nation states, research institutions or companies dealing with sensitive information as well as similar high-profile targets. The oldest drivers identified by the researchers was compiled in 2011 is the evidence that the malware was created around three years ago and was undetected.
John Lemke

FBI surveillance malware in bomb threat case tests constitutional limits | Ars Technica - 0 views

arstechnica.com/...case-tests-constitional-limits

2013 law due+process surveillance fbi constitutional malware spying legal yourrights

shared by John Lemke on 07 Dec 13 - No Cached
  • The FBI has an elite hacker team that creates customized malware to identify or monitor high-value suspects who are adept at covering their tracks online, according to a published report.
  • as the capability to remotely activate video cameras and report users' geographic locations—is pushing the boundaries of constitutional limits on searches and seizures
  • Critics compare it to a physical search that indiscriminately seizes the entire contents of a home, rather than just those items linked to a suspected crime. Former US officials said the FBI uses the technique sparingly, in part to prevent it from being widely known.
  • ...1 more annotation...
  • "We have transitioned into a world where law enforcement is hacking into people’s computers, and we have never had public debate,” Christopher Soghoian, principal technologist for the American Civil Liberties Union, told The Washington Post, speaking of the case against Mo. "Judges are having to make up these powers as they go along."
John Lemke

Self-repairing software tackles malware -- ScienceDaily - 0 views

www.sciencedaily.com/...141113140011.htm

software malware 2014 technology self-healing virus

shared by John Lemke on 17 Nov 14 - No Cached
  • Unlike a normal virus scanner on consumer PCs that compares a catalog of known viruses to something that has infected the computer, A3 can detect new, unknown viruses or malware automatically by sensing that something is occurring in the computer's operation that is not correct. It then can stop the virus, approximate a repair for the damaged software code, and then learn to never let that bug enter the machine again.
  • To test A3's effectiveness, the team from the U and Raytheon BBN used the infamous software bug called Shellshock for a demonstration to DARPA officials in Jacksonville, Florida, in September. A3 discovered the Shellshock attack on a Web server and repaired the damage in four minutes, Eide says. The team also tested A3 successfully on another half-dozen pieces of malware.
John Lemke

Java-based malware driving DDoS botnet infects Windows, Mac, Linux devices | Ars Technica - 0 views

arstechnica.com/...ects-windows-mac-linux-devices

2014 malware ddos windows mac linux technology tech security botnet

shared by John Lemke on 29 Jan 14 - No Cached
  • takes hold of computers by exploiting CVE-2013-2465, a critical Java vulnerability that Oracle patched in June. The security bug is present on Java 7 u21 and earlier. Once the bot has infected a computer, it copies itself to the autostart directory of its respective platform to ensure it runs whenever the machine is turned on. Compromised computers then report to an Internet relay chat channel that acts as a command and control server.
  • The botnet is designed to conduct distributed denial-of-service attacks on targets of the attackers' choice. Commands issued in the IRC channel allow the attackers to specify the IP address, port number, intensity, and duration of attacks.
John Lemke

NSA reportedly intercepting laptops purchased online to install spy malware | The Verge - 0 views

www.theverge.com/...a-cia-fbi-laptop-usb-plant-spy

2013 nsa spy malware yourrights surveillance spying law legal government

shared by John Lemke on 30 Dec 13 - No Cached
  • According to a new report from Der Spiegel based on internal NSA documents, the signals intelligence agency's elite hacking unit (TAO) is able to conduct sophisticated wiretaps in ways that make Hollywood fantasy look more like reality. The report indicates that the NSA, in collaboration with the CIA and FBI, routinely and secretly intercepts shipping deliveries for laptops or other computer accessories in order to implant bugs before they reach their destinations. According to Der Spiegel, the NSA's TAO group is able to divert shipping deliveries to its own "secret workshops" in a method called interdiction, where agents load malware onto the electronics or install malicious hardware that can give US intelligence agencies remote access. While the report does not indicate the scope of the program, or who the NSA is targeting with such wiretaps, it's a unique look at the agency's collaborative efforts with the broader intelligence community to gain hard access to communications equipment. One of the products the NSA appears to use to compromise target electronics is codenamed COTTONMOUTH, and has been available since 2009; it's a USB "hardware implant" that secretly provides the NSA with remote access to the compromised machine.
  • The Der Spiegel report, which gives a broad look at TAO operations, also highlights the NSA's cooperation with other intelligence agencies to conduct Hollywood-style raids. Unlike most of the NSA's operations which allow for remote access to targets, Der Spiegel notes that the TAO's programs often require physical access to targets. To gain physical access, the NSA reportedly works with the CIA and FBI on sensitive missions that sometimes include flying NSA agents on FBI jets to plant wiretaps. "This gets them to their destination at the right time and can help them to disappear again undetected after even as little as a half hour's work," the report notes.
  • John Lemke on 30 Dec 13
     
    While the scope or the targets are reportedly not known, the article also does not mention anything about a search warrant. This is what happens when the government feels they are above the law.
John Lemke

Leaked Snowden documents detail NSA's plans for 'millions' of malware attacks | The Verge - 0 views

www.theverge.com/...or-millions-of-malware-attacks

2014 leaked documents nsa malware attacks security privacy yourroights surveillance spying indienationnews law legal

shared by John Lemke on 12 Mar 14 - No Cached
  • A program known as TURBINE, first revealed last year, is meant to dramatically speed the process: one document says it will "allow the current implant network to scale to large size (millions of implants) by creating a system that does automated control implants by groups instead of individually."
  • The scaling process, according to Greenwald, started in 2004, when the NSA operated only 100 to 150 software implants. The number of implants used in the years between 2010 to 2012, by contrast, is described as numbering in the tens of thousands.
John Lemke

Destructive cyber attack inevitable: NSA chief - 0 views

www.physorg.com/...yber-inevitable-nsa-chief.html

2011 writeabout writeatlockergnome attack destructive cyber cyberattack malware security NSA USA threat wroteatindienation

shared by John Lemke on 01 Mar 11 - No Cached
  • John Lemke on 01 Mar 11
     
    The US National Security Agency (NSA) chief General Keith Alexander, pictured here in 2010, on Thursday urged top computer security specialists to harden the nation's critical infrastructure against inevitable destructive cyber attacks. LUMPY HAS NOTES BELOW THISQUOTE Ties in with Stuxnet and Anonymous and Antonymous having Stuxnet.  Might make a nice security and malware 30 news shows
John Lemke

Fraudsters break all records in Japan relief ripoffs - Boing Boing - 0 views

boingboing.net/...fraudsters-break-all.html

woteabout wroteatindienation 2011 fraudsters record scam Japan tsunami fraud fake 2011.03.25

shared by John Lemke on 25 Mar 11 - No Cached
  • John Lemke on 25 Mar 11
     
    Fraudster scumbags have beaten all records in setting up fake Japan relief pages, fielding more than 1.7 million malware pages, 419 scams trading on the Japanese disasters, 50+ fake domains with "Japan tsunami" or "Japan earthquake" in their URLs. MacWorld recommends donating via the Red Cross, or other established charities that you're familiar with.
John Lemke

Rent-to-own PCs surreptitiously captured users' most intimate moments | Ars Technica - 0 views

arstechnica.com/...ed-users-most-intimate-moments

2012 security malware spyware fraud USA Canada Australia

shared by John Lemke on 26 Sep 12 - No Cached
  • The software, known as PC Rental Agent, was developed by Pennsylvania-based DesignerWare. It was licensed by more than 1,617 rent-to-own stores in the US, Canada, and Australia to report the physical location of rented PCs. A feature known as Detective Mode also allowed licensees to surreptitiously monitor the activities of computer users. Managers of rent-to-own stores could use the feature to turn on webcams so anyone in front of the machine would secretly be recorded. Managers could also use the software to log keystrokes and take screen captures.
  • In some cases, webcam activations captured images of children, individuals not fully clothed, and people engaged in sexual activities, the complaint alleged. Rental agreements never disclosed the information that was collected, FTC lawyers said.
  • PC Rental Agent also had the capability to display fake registration pages for Microsoft Windows, Internet Explorer, Microsoft Office, and Yahoo Messenger. When customers entered their names, addresses, and other personal information in the forms, the data was sent to DesignerWare servers and then e-mailed to the rent-to-own licensees.
John Lemke

FBI Arrested CEO of 'StealthGenie' for Selling Mobile Spyware Apps - 0 views

thehackernews.com/...Mobile-spying-app.html

2014 indienationnews tech news surveillance spying malware spyware FBI UK StealtyGenie mobile arrested apps security

shared by John Lemke on 01 Oct 14 - No Cached
  • The Federal Bureau of Investigation (FBI) has arrested the CEO of a UK-based company for allegedly advertising and selling a spyware app to individuals who suspect their romantic partners of cheating on them.
  • The dodgy cell phone spyware application, dubbed as StealthGenie, monitors victims’ phone calls, text messages, videos, emails and other communications "without detection" when it is installed on a target's phone, according to the Department of Justice.
  • Once installed on the phone, it allows conversations to be monitored as they take place, enables the purchaser to call the phone and activate it at any time to monitor all surrounding conversations within a 15-foot radius, and collects the user’s incoming and outgoing email and SMS messages, incoming voicemail, address book, calendar, photographs, and videos. All of these functions are enabled without the knowledge of the user of the phone.
  • ...1 more annotation...
  • Akbar was charged with conspiracy, sale of a surreptitious interception device, advertisement of a known interception device and advertising a device as a surreptitious interception device in US District Court for the Eastern District of Virginia.
John Lemke

Researchers discover that cars can be hacked with music - Hack a Day - 0 views

hackaday.com/...-cars-can-be-hacked-with-music

researchers cars 2011 hack exploit malware vehicle security automobile mp3

shared by John Lemke on 17 Mar 11 - No Cached
  • John Lemke on 17 Mar 11
     
    ome car entertainment systems were susceptible to specially-crafted MP3 files. The infected songs allowed them to inject malicious code into the system when burned to a CD and played. While this sort of virus could spread fairly easily with the popularity of P2P file sharing, it would likely be pretty useless at present.
1 - 18 of 18
Showing 20▼ items per page