The Vienna Connection? Trying To Stamp Out Flame, Researchers Find Clues To Its Origins

Researchers at Kaspersky Lab, domain registrar GoDaddy and OpenDNS have taken steps to cut off Internet access for machines infected with the Flame worm. In the process, the researchers say they uncovered a large and complex command and control infrastructure of more than 80 Web domains and...

Tiny New Tinba Banker Trojan Found Stealing Financial Data

Security researchers have discovered a tiny new banking Trojan that comprises just 20 KB of code and uses a number of well-word man-in-the-browser tricks in an attempt to defeat two-factor authentication. Known as Tinba, the new malware doesn’t bother with any encryption or packing and yet is...

Months After A Patch, Targeted Attacks Still Using Adobe Flash Bug

More than three months after it was patched, attackers are still using a vulnerability in Adobe’s Flash product in targeted, ‘APT-style’ attacks. The vulnerability, identified as CVE-2012-0754 was patched in February and linked to targeted attacks weeks later. But new attacks targeting unpatched...

Coming Up With Better Ways to Count — and Counter — Botnets

As botnets continue as a major purveyor of malicious activity, finding new and improved ways to measure their influence will be key to preventing future attacks. But gaining an accurate read on active populations continues to prove difficult. In recent years more research has been devoted to...

New Malware Found Exploiting Mac OS X Snow Leopard

Many Mac users recently have found themselves stumbling out of the darkness, shielding their eyes from the spotlight that attackers and malware writers are now shining on them. Malware having been a rarity on OS X, it’s taking some time to adjust, but while that’s happening the attackers are busy...

Flashback Creators May Be Raking in $10K a Day

Unprotected users visiting a page hosting the much-discussed Flashback Trojan could be earning some serious cash for the malware’s creators, according to new research from Symantec. In a post to the company’s Security Response blog, Symantec notes the Flashback Trojan could be earning up to $10,0...

New Mac Malware, SabPub, Used In Targeted Attacks

Researchers at Kaspersky Lab says a new malicious program, dubbed SabPub, exploits the same Java security hole as the Flashback Trojan and enables targeted attacks against Mac users. The new malware was identified in a blog post by Kaspersky Lab expert Costin Raiu on Saturday and is described as ...

Apple, Following Microsoft's Lead, Plans to Disable Flashback Botnet

Apple, which usually doesn’t get involved much in security issues outside of issuing patches when needed, said it is working with internet service providers around the world to disable the Flashback botnet’s command and control servers. Flashback exploits a security flaw in Java, Apple explains,...

Apple Developing Fix For Flashback Malware

Apple is planning to release a software fix that will find and remove the Flashback malware that has been haunting Mac users for several months now. The latest version of Flashback has built a botnet that at times has included more than 600,000 infected machines. Apple said on Tuesday that it was...

Flashback Mac Trojan Hits More than 500K Machines

The Flashback Trojan that has been infecting Mac OSX machines of late appears to have become the most successful piece of Mac-based malware in the short history of such things. Researchers say that there have been upwards of 500,000 Macs infected by the malware, and that number may still rise...

New Android Malware Variant Can Remotely Root Phone

A new version of Android malware has been tweaked so it doesn’t require user interaction for an attacker to own the device, according to research published by Lookout Mobile Security yesterday. An updated variant of the Legacy Native LeNa malware utilizes the GingerBreak exploit to gain root...

POC Android botnet - Command and Control Channel over SMS

POC Android botnet - Command and Control Channel over SMS To avoid detection, this proof-of-concept code utilizes the Short Messaging Service SMS as a command & control channel. This adds fault tolerance because, if a smartphone is not available on the GSM network due to being powered off or out...

Kelihos Returns: Same Botnet or New Version?

The twice-shut-down Kelihos botnet remains active and continues spamming with a new variant, despite yesterday’s efforts by Kaspersky Lab and CrowdStrike that knocked offline and sinkholed the most recent version of the botnet. According to a Seculert report, the indomitable botnet is using a...

Kaspersky Knocks Down Kelihos Botnet Again, But Expects Return

For the second time in six months, researchers from the Russian antivirus company, Kaspersky Lab, carried out an operation to take down the newest iteration of the Kelihos botnet, also known as “Hlux.” Microsoft and Kaspersky worked together in September, 2011, on the first Kelihos take-down. The...

Kaspersky finds Malware that resides in your RAM

Kaspersky finds Malware that resides in your RAM Kaspersky Lab researchers have discovered a drive-by download attack that evades hard-drive checkers by installing malware that lives in the computer's memory. The 'fileless' bot is more difficult for antivirus software to detect, and resides in...

Chinese Trojans Gh0stRAT used to attack pro-Tibet organisations

Chinese Trojans Gh0stRAT used to attack pro-Tibet organisations AlienVault has discovered a range of spear phishing attacks taking place against a number of Tibetan organizations apparently from Chinese attackers. The security firm believes that the attacks are originating from the same Chinese...

"Cyber China", from Operation Aurora to China Cyber Attacks Syndrome

"Cyber China", from Operation Aurora to China Cyber Attacks Syndrome Security Expert, from Security Affairs - Pierluigi Paganini takes us on a visit to China via The Hacker News January Edition Magazine Article and makes us wonder just how influential China's hacking is on world internet security...

Malware automatically uploading stolen data to the File sharing sites

Malware automatically uploading stolen data to the File sharing sites Roland Dela Paz, a threat response engineer with Trend Micro have discovered a piece of malicious software that automatically uploads its stolen data cache to the SendSpace file-sharing service for retrieval. File-storage...

Ongoing Targeted Attack Campaign Going After Defense, Aerospace Industries

Researchers have identified a strain of malware that’s being used in a string of targeted attacks against defense contractors, government agencies and other organizations by leveraging exploits against zero-day vulnerabilities. The attacks may have been going on since 2009 in some form and the...

Phishers Bait City Workers in Seattle With Phony Speeding Tickets

Hundreds of government employees in Seattle, Washington received fraudulent emails yesterday that appeared to be traffic violation notifications but were, in fact, vehicles for infection by malicious software. According to the Microsoft Malware Protection Center and the Seattle Police Department,...