Infosec Feeder

National Chamber conducts Seminar on Cyber Crimes on September 25

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiPJOykpYJOhS0R-P8fhcJoRMbWCikTXruhbhF3Nk7_H0oYgJf0bYWtPCUSF7TlUV28PlvG-jt9Z_m0ClgixlcTEnNKFO385GdauAtSMfbcklumPPTKLU9mJdGW5_wdoAE1ypFJnmO9CWm/s1600/cybercrime.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="national-chamber-conducts-seminar-on-cyber-crime" border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiPJOykpYJOhS0R-P8fhcJoRMbWCikTXruhbhF3Nk7_H0oYgJf0bYWtPCUSF7TlUV28PlvG-jt9Z_m0ClgixlcTEnNKFO385GdauAtSMfbcklumPPTKLU9mJdGW5_wdoAE1ypFJnmO9CWm/s1600/cybercrime.jpg" title="national-chamber-conducts-seminar-on-cyber-crime" width="400" /></a></div>
<br />
An <b>cyber security awareness</b> seminar ‘<b>Cyber Crimes: A New Threat To Your Corporate Environment</b>’ will be held on Thursday, September 25, 2014  from 2.30 pm to 5pm at the National Chamber Auditorium,  450, D. R. Wijewardena Mawatha, Colombo 10.<br />
<br />
The event will be host by The <a href="http://www.mea.gov.lk/index.php/missions/mission-activities/3142-national-chamber-of-commerce-of-sri-lanka--nccsl-in-collaboration-with-sri-lanka-high-commission-in-the-united-kingdom-launches-a-web-based-information-gathering-system-to-help-sri-lankan-students-to-find-placement-employment-opportunities-in-sri-lank" target="_blank">National Chamber</a> of Commerce in collaboration with Sri Lanka (CERT|CC) Computer Emergency Readiness Team & Coordination Centre, (the Competent Authority to monitor cyber security in Sri Lanka)<br />
<br />
The <b>Sri Lankan cyber</b> situation is now getting out of hand and Cyber crimes may have an impact on national security, banking, financial /non financial sector and national data bases which are under severe threat today. Prevention of such incidents is of paramount importance.<br />
<br />
The seminar speakers, Lal Dias, CEO and Eng Roshan Chandraguptha of CERT|CC will covers the following areas, Threat of targeted attacks on individual or corporate networks (Case studies) Cyber-crime and fraud risks in Sri Lanka Financial / non-financial sectors, Various aspects of  cyber crimes and how they can be effectively mitigated and how Sri Lanka CERT|CC can help the private sector in identifying  cyber  crimes.<br />
<br />
The main objective of this seminar is to make corporate leaders aware on how to protect their customers informations from cyber attacks and how to protect their information systems from cyber attacks.<br />
<br />
The event will be useful for CEOs, CIOs, CFOs, I.T. Professionals, Financial Controllers, Managing Directors, CEOs CIOs. Seats will be available on first come, first served basis. For registrations contact the Chamber, Buddika 071 4842863 or Dilrukshi on 4741788.

National Chamber conducts Seminar on Cyber Crimes on September 25

An cyber security awareness seminar ‘ Cyber Crimes: A New Threat To Your Corporate Environment ’ will be held on Thursday, September 25,...

Payment system of Home Depot is Hacked : 60 Million users are affected

<div style="text-align: justify;">
<div class="separator" style="clear: both; text-align: center;">
<img alt="Payment system of Home Depot is Hacked : 60 Million users are affected" border="0" height="166" src="http://4.bp.blogspot.com/-siUAuaEIcnE/VBwMtfLC8dI/AAAAAAAAAAc/C39CpDchF4w/s1600/n-HOME-DEPOT-HACK-large570.jpg" title="" width="400" /></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
The Home Depot is one of the American retailer of home improvement and construction products and services. It operates many big-box format stores across the United States, all ten provinces of Canada, as well as Mexico. Home depot has admitted now that its system was hacked and the credit card details of 60 million users are at risk. Home Depot said that the hackers used a <a href="http://www.infosecfeeder.com/2014/09/kyle-and-stan-malvertising-network.html" target="_blank">malware</a> which make use of a zero day (a vulnerability about which system vendors are unaware of). they also mentioned that this malware is impossible to be detected by a traditional antivirus software. Now they have removed those malwares and they have started to use point to point encryption technology.</div>
<div class="separator" style="clear: both; text-align: left;">
<br /></div>
<div class="separator" style="clear: both; text-align: left;">
“We apologize to our customers for the inconvenience and anxiety this has caused, and want to reassure them that they will not be liable for fraudulent charges,” Home Depot CEO Frank Blake said in a statement. “<i>From the time this investigation began, our guiding principle has been to put our customers first, and we will continue to do so</i>.”</div>
<div style="text-align: left;">
<br />
Are you one of those affected users?<br />
<br />
Don't forget to find more <a href="http://www.infosecfeeder.com/p/ethical-hacking-in-sri-lanka.html" target="_blank">exclusive Ethical Hacking News over here</a>.</div>
</div>

Payment system of Home Depot is Hacked : 60 Million users are affected

The Home Depot is one of the American retailer of home improvement and construction products and services. It operates many big-box fo...

AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps

<div class="separator" style="clear: both; text-align: center;">
<a href="http://www.infosecfeeder.com/2014/09/appbuyer-new-ios-malware-steals-apple.html"><img alt="AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgRDco-CIx2C398tqEus4op3GmNagBbJLRAr8OXbXZoEWRNwn0w7a-dKJctit4BXHF0mKT_6N0SFZ6j2NGnT1bVoITGsHc98hp48yrizIiKsEGpP7x7j8KN4N8bBR5dEKpuJ51_jkKm7rAI/s1600/AppBuyer-Malware-iOS-Jailbreak.jpg" title="" /></a></div>
<br />
The researchers at Palo Alto Networks report that was recently found and analyzed a <a href="http://www.infosecfeeder.com/p/ethical-hacking-in-sri-lanka.html" target="_blank">new <b>malware</b></a> called <b>AppBuyer</b> which affects broken iOS devices to steal Apple ID and Passwords. The <a href="http://www.infosecfeeder.com/search/label/Malwares" target="_blank">malware</a> will connects to server C & C, in order to download and <a href="http://www.infosecfeeder.com/2014/09/kyle-and-stan-malvertising-network.html" target="_blank">execute malicious files</a>, with the target to steal the Apple ID and password in order to purchase applications from App Store.<br />
<br />
At the moment it is not clear how AppBuyer installed in jailbroken devices , but the PA Network said that the program was set to execute three actions, First, it downloads an EXE file to generate a singular UUID, second it downloads a Cydia Substrate tweak to steal the consumer’s ID and password, and third, it downloads a utility to login to the App Store and purchase apps.<br />
<br />
For users who have already done the jailbreak to their devices, here is a way to determine if one or some of these files exist in the file system. You can use iFile, iExplorer or similar software to find if any of the following files are on your device,  If these files are present, there is a good chance that you are affected.<br />
<ul>
<li>/System/Library/LaunchDaemons/com.archive.plist</li>
<li>/ Bin / updatesrv</li>
<li>/tmp/updatesrv.log</li>
<li>/ Etc / uuid</li>
<li>/Library/MobileSubstrate/DynamicLibraries/aid.dylib</li>
<li>/ Usr / bin / gzip</li>
</ul>
We highly recommend iOS users not jailbreak their devices. AdThief, another iOS malware found by Palo Alto Networks in this year, which also targets jailbroken iOS devices, has infected more than 75,000 devices. Another example is Unflod, which is a malicious Cydia Substrate tweak, will steal a victim’s Apple ID in the similar way. said, Claud Xiao, security researcher at PA Network on a <a href="http://researchcenter.paloaltonetworks.com/2014/09/appbuyer-new-ios-malware-steals-apple-id-password-buy-apps/" target="_blank">blog post</a>.<br />
<br />
<br />

AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps

The researchers at Palo Alto Networks report that was recently found and analyzed a new malware called AppBuyer which affects broken iO...

WikiLeaks Releases FinFisher Malware, A weaponised German surveillance malware

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<img alt="finfisher" border="0" height="228" src="http://3.bp.blogspot.com/-Tq3CdsTUbkY/VBhmTOB0gpI/AAAAAAAAAAM/nBxIaZLNh-Q/s1600/download.jpg" title="finfisher" width="400" /></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<br />
WikiLeaks has released copies of <a href="https://wikileaks.org/spyfiles/files/0/289_GAMMA-201110-FinSpy.pdf" target="_blank">FinFisher</a> to the public in its website. FinFisher is used by (some) government agencies to monitor the people anonymously. With the release of these files it is expected to develop some methods to detect FinFisher infection and tools to remove it.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
FinFisher is a German based company established first a part of Gamma Group in 2007. From 2013 it is functioning as a independent company. WikiLeaks also releases brochures, video documents, database containing details of customers of FinFisher.</div>
<blockquote class="tr_bq" style="text-align: justify;">
<blockquote class="tr_bq">
<span style="background-color: white; color: #555555; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; line-height: 20px;">FinFisher continues to operate brazenly from Germany selling weaponised surveillance malware to some of the most abusive regimes in the world. The Merkel government pretends to be concerned about privacy, but its actions speak otherwise. Why does the Merkel government continue to protect FinFisher? This full data release will help the technical community build tools to protect people from FinFisher including by tracking down its command and control centers</span></blockquote>
</blockquote>
<div style="text-align: justify;">
 said <a href="http://en.wikipedia.org/wiki/Julian_Assange" target="_blank">Julian Assange</a>, WikiLeaks Editor in Chief.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Visit Here to take a look at the wikileak's page: https://wikileaks.org/spyfiles4/<br />
<br /></div>
<div style="text-align: justify;">
Visit here to take a look FinFisher's Documents: https://wikileaks.org/spyfiles4/documents.html</div>
</div>

WikiLeaks Releases FinFisher Malware, A weaponised German surveillance malware

WikiLeaks has released copies of FinFisher to the public in its website. FinFisher is used by (some) government agencies to monitor ...

“Kyle and Stan” Malvertising network threat

<b><a href="http://en.wikipedia.org/wiki/Malvertising" target="_blank">Malvertising</a> </b>(also known as Malicious advertising) mean using online advertising to to <a href="http://www.infosecfeeder.com/p/ethical-hacking-in-sri-lanka.html" target="_blank">spread malware</a>. In the internet you can see thousands of ads and it’s a very hard to find which is real. Attackers targets major advertising networks to display these types of malicious ads and if it is displayed for a few minutes without being detected then many computers can be infected.<br />
<br />
<a href="http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html" target="_blank">Cisco security researchers</a> uncovered a major network used for malvertising. In their research they have found more than 700 domains related to that and over 9541 connections to the malicious domains. This was named <b>“Kyle and Stan”</b> because “Kyle” and “Stan” used in the sub domain name.
<br />
<br />
The <b>“Kyle and Stan”</b> network is a highly sophisticated malvertising network. The goal is to infect Windows and Mac users alike with spyware and adware. The attackers use clever techniques and encryption to avoid detection. The large number of domains allows them to use a domain for a short time.This helps avoiding reputation and black list based security solutions. This is a well engineered Malware delivery network.
<br />
<br />
<b>How?</b><br />
<b><br /></b>
1. You visit a webpage with the malicious advertisement.<br />
2. You get redirected to a different website that redirects you based on user agent. We observed that Windows and Mac users get redirected to different malware in order to infect both operating systems.<br />
3. The final page starts the download of a malicious file.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJZnPBk-QeUSrMpgH8PQhHYNO5dJKsWvZ7nkAGQYysD9bbEXsHy7iyE2Mbk6C78RqR52DgZRw-KZRF9LRIagkjNheSBkXILmKFMNp9ILOd6bvvA61mT9qlN3e0Mhmymg6CzOb9QewhEsku/s400/Malversting.png" /></div>

“Kyle and Stan” Malvertising network threat

Malvertising (also known as Malicious advertising) mean using online advertising to to spread malware . In the internet you can see thousa...

5 Million Gmail Username and Passwords Leaked Online

<div class="separator" style="clear: both; text-align: center;">
<img alt="Gmail" border="0" height="303" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkFLKS9tsNSMR-F5OaLjyCBPW_d5pyTmRvivi3CieXi7p0tu48CCJ9UAa_jVHKz30K9k8GaJEQ9lGGiN3XHGcQz4T3-bqtun_BHLaEzyP-U12ne-10S9I_bzUYl9v-j6VVtBIPnKz_3IwK/s1600/Gmail-icon.jpg" title="Gmail" width="400" /></div>
<br />
Millions of Gmail credential leaked in Russian bitcoin security forum. It caused the Gmail users worldwide to change their Gmail passwords. File containing Gmail credentials was posted on <b><a href="https://forum.btcsec.com/index.php?/topic/9426-gmail-meniai-parol/" rel="nofollow" target="_blank">Russian Bitcoin Security forum</a></b> by a user <b>tvskit</b><br />
<br />
Google says that it was not a result of a security breach in the Google system. Google believe that credentials were stolen by phishing campaigns.<br />
<div>
<br />
In the <a href="http://googleonlinesecurity.blogspot.in/2014/09/cleaning-up-after-password-dumps.html" rel="nofollow" target="_blank">google security blog</a> they wrote”<i>We found that 2% of the username and password combinations might have worked and our automated anti-hijacking systems would have blocked many of those login attempts. We have protected the affected accounts and have required those users to reset their passwords</i>".<br />
<br />
So, does your Google account secure? Go ahead and set up <a href="https://www.google.com/landing/2step/" target="_blank">two step verification</a> to your Google account.</div>

5 Million Gmail Username and Passwords Leaked Online

Millions of Gmail credential leaked in Russian bitcoin security forum. It caused the Gmail users worldwide to change their Gmail password...

Critical Vulnerability in popular Joomla e-commerce extension puts online shops at risk

<div class="separator" style="clear: both; text-align: center;">
<img alt="Joomla" border="0" height="266" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2FFCzXRM-7Px5qwjy6SeUKGe_70yC2LtMIUCs4VmsVYQtRFD_WIoK1du02qZfxeX89XKoJIfbAnkZY0y1qWdImXtLzepQk4S-naq_qrlCq5PFPbicX7VwVARXlAzvgD1DqLihPHMJ8UuQ/s1600/joomlaecommerce-100428418-primary.idge.jpg" title="Joomla" width="400" /></div>
<br />
A <b>critical vulnerability</b> in a popular e-commerce extension called <a href="http://extensions.joomla.org/extensions/extension-specific/virtuemart-extensions" target="_blank">VirtueMart extension</a>, which allows users to set up online shops on their sites in the Joomla content management system could allow an attacker to gain super-admin privileges to sites that run the software.<br />
<br />
<b>VIRTUEMART USED BY MILLIONS OF WEBSITES</b><br />
<b><br /></b>
This issue is actually serious because VirtueMart is being used by millions of websites. Extension has been downloaded more than 3.5 million times, said Marc-Alexandre Montpas, a researcher at Web security firm <a href="https://sucuri.net/" target="_blank">Sucuri</a>, in a blog post on Wednesday.<br />
<div>
<br /></div>
<div>
<b>WHAT ARE THE RISKS? </b><br />
<b><br /></b></div>
<div>
A successful exploit would allow an attacker to become a Super-Administrator and do anything as they like, this could include running spam campaigns, uploading backdoors to your server or <a href="http://www.infosecfeeder.com/2014/09/kyle-and-stan-malvertising-network.html" target="_blank">distributing malware</a> to your site users.</div>
<div>
<br /></div>
<div>
<div>
VirtueMart uses Joomla’s JUser class “bind” and “save” methods to handle user accounts information. That’s not a problem in it of itself, but this class is very tricky and easy to make mistakes with. <a href="http://blog.sucuri.net/2014/09/security-advisory-virtuemart-for-joomla.html" rel="nofollow" target="_blank">said</a> Marc-Alexandre Montpas, a researcher at Web security firm Sucuri. </div>
<div>
<br /></div>
<div>
<div>
The issue was discovered last week and was patched in VirtueMart 2.6.10, released on Sept. 4. Already the VirtueMart advises users that "<i>everyone using a version lower than 2.6.10 should update as soon as possible for security reasons</i>".</div>
<div>
<br /></div>
<div>
Sucuri originally posted technical details about the vulnerability, but now they have removed the details because of the developer's request.<br />
<br /></div>
</div>
</div>
<div>
We are removing the technical details as requested. Other extensions might be vulnerable to the same issue, so we will do more research on that. Montpas added. </div>
<div>
<br /></div>
<div>
<b>UPDATE NOW</b><br />
<b><br /></b></div>
<div>
The vulnerability was found in VirtueMart 2.6.8c. VirtueMart have released an update on september 4 to address this problem and all users should update to the latest version ( <b><a href="http://www.smartaddons.com/component/k2/item/1063-important-update-virtuemart-2610-299b-with-security-release" target="_blank">2.6.10</a></b> ) as soon as possible.</div>

Critical Vulnerability in popular Joomla e-commerce extension puts online shops at risk

A critical vulnerability in a popular e-commerce extension called VirtueMart extension , which allows users to set up online shops on th...