Malware Infects Two Power Plants Lacking Basic Security Controls

During the past three months, unnamed malware infected two power plants’ control systems using unprotected USB drives as an attack vector. At both companies, a lack of basic security controls made it much easier for the malicious code to reach critical networks. In one instance, according to a...

Stuxnet is Back ! Iran reported another cyber attack

Iran claims to have repelled a fresh cyber attack on its industrial units in a southern province. In the last few years, various Iranian industrial, nuclear and government bodies have recently come under growing cyber attacks, widely believed to be designed and staged by the US and Israel. A powe...

Kelihos Update Includes New TLD and USB Infection Capabilities

There’s a little Michael Myers in the Kelihos botnet; maim it, kill it and it keeps on coming back to wreak more havoc. The 2011 takedown of the Kelihos botnet was one of Microsoft’s high-profile success stories against spambots and the like, yet Kelihos was back for more at the start of 2012 usi...

Dorkbot Now Worming Its Way through Skype

The Dorkbot worm that fooled many a Facebook and Twitter user is now socially engineering Skype users into downloading the malware, whose payload now includes a mechanism to lock down machines. Various antivirus and security companies are reporting the latest iteration rummages through an infecte...

ARMY : USB Drive responsible for over 70 percent of Cyber Security Breaches

A ban on the use of pen drives has not been able to safeguard cyber security as it has now been labeled as a major threat in defence forces, the Army officials said. The use of pen drives as an easy-to-carry storage device has increased in the recent past and internal reports have confirmed that...

Microsoft Carries out Nitol Botnet Takedown

A botnet known as Nitol, built on the backs of PCs and laptops loaded with malware somewhere in the supply chain, was taken down by Microsoft. Microsoft’s Digital Crimes Unit was given permission this week by the U.S. District Court for the Eastern District of Virginia to take over the 3322.org...

CVE-2012-4736

The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions a...

Hijacking Virtual Machines with Crisis malware

The Windows version of Crisis, a piece of malware discovered in July, is capable of infecting VMware virtual machine images, Windows Mobile devices and removable USB drives, according to researchers from antivirus vendor Symantec.The installer was actually a Java archive JAR file which had been...

New Morto Strain Emerges With File Infection Capability

A new strain of the Morto worm has added a file infection capability in addition to its existing ability to compromise remote desktop connections, according to new research from Microsoft. Now Morto is infecting files in the default RDP file share, ‘tsclient,’ after it determines which drives it...

Honeynet Project Launches 'Ghost' To Snare USB Malware

The Honeynet Project launched a new project Thursday that is designed to snare malware that spreads by infecting removable USB universal serial bus storage drives, citing the increased reliance of malicious programs on portable drives to move from computer to computer. The ghost-usb-honeypot uses...

Keylogging Version of Anti-Censorship Software Simurgh Found

Citizen Lab found a compromised version of an anti-censorship tool that’s popular in Iran and Syria circulating with a backdoor installed. The software, Simurgh, is described by Citizen Lab as a stand-alone proxy software for Microsoft Windows users. It was used predominantly by Iranians in the...

Microsoft Windows Worm.Win32.Flame.A Information Collection

An information collection vulnerability has been reported in all versions of Microsoft Windows. Worm.Win32.Flame.A is a computer worm that targets Windows users. The worm propagates via removable drives and network shares. Once resident, Flame can compromise user privacy using methods such as...

Study Finds One in 10 Hand-Me-Down Hard Drives Still Hold Personal Data

A U.K. organization today released independent study results that show one in 10 secondhand hard drives sold online may contain “residential personal information,” such as bank statements, passports and medical details. In an effort to underscore the need to throughly scrub machines, mobile phone...

Authorities Shut Down Carder Lab in Dominican Republic

Authorities in the Dominican Republic have shut down a carder lab in the city of Santo Domingo, and have arrested a 62-year-old man who they say is one of the alleged leaders of the group. Law enforcement officials had been investigating the group for several months, according to local reports, a...

Fedora 16 : kdelibs-4.7.3-5.fc16 (2011-16151)

Includes fixes for : - khtml: CVE-2010-0046: CSS format argument memory corruption - solid hardware does not detect NFS drives Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean...

Report: Virus Infects U.S. Military Drones

Wired’s ThreatLevel Blog reported on Friday that a computer virus is plaguing the systems used to remotely control the U.S. military’s fleet of unmanned drone aircraft. According to the report, which is unconfirmed, personnel at Creech Air Force Base in Nevada have been battling the persistent an...

Offline Windows Analysis and Data Extraction (OWADE) - Forensics tool to expose all your online activity

Offline Windows Analysis and Data Extraction OWADE - Forensics tool to expose all your online activity Researchers "Elie Bursztein" from Stanford University in California have managed to bypass the encryption on a PC's hard drive to find out what websites a user has visited and whether they have...

Windows Gather Physical Drives and Logical Volumes

This module will list physical drives and logical volumes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework List physical drives and logical volumes on the remote system R. Wesley McGrew [email protected]...

Conficker Worm in Hiding at an Australian Supermarket Chain

The once-prolific Conficker worm has turned up in the most unlikely of places: Australian discount supermarket, Aldi. The worm was discovered pre-installed on a four-in-one external hard-drive, DVD, USB, and card reader combination device. According to a warning from the Australian Computer...

OSForensics – Digital investigations faster

OSForensics – Digital investigations faster Here there is a new utility called OSForensics, currently it is freely available that I found very useful for conducting a computer forensics. OSForensics can retrieve data about recently accessed applications, documents, media and network shares by...