Malware

New Mac malware opens secure reverse shell

A new backdoor Trojan for OS X is making the rounds, attempting to set up a secure connection for a remote hacker to connect through and grab private information.

The malware, dubbed "Pintsized" by Intego, is suspected of using a modified implementation of OpenSSH to set up a reverse shell that creates a secure connection to a remote server.

The use of an encrypted connection makes it more difficult to detect and trace, especially since it uses the common SSH protocol. In addition, the malware attempts to hide itself by disguising its files to look like components of … Read more

Ransomware cybercrime ring dismantled in Europe

A cybercrime ring that infected millions of computers with ransonmware to extort possibly millions of dollars from people in 30 nations has been broken up, the European police agency said today.

Masquerading as police agencies, the suspects paralyzed computers with a virus and told their owners that illegal online activity had been detected and that a fine would have to be paid to unlock their computers, Europol announced in Madrid.

Investigators said they had identified up to 48 variants of the virus, which typically installs itself by tricking users into downloading a malicious executable filed via a socially engineered message. … Read more

Old OS X malware used in increased attacks against Uyghur groups

Kaspersky labs and Alienvault have released a new analysis that outlines recent increases in targeted attacks against Uyghur groups in China, where an apparent ongoing politically motivated effort is using old vulnerabilities in Microsoft Word to infect their systems with malware.

The effort is using unpatched versions of Microsoft Word 2004 and 2008 for OS X, where maliciously crafted documents can exploit an old and patched vulnerability to execute code and install backdoor software without the user's consent. The malware in this case installs a common remote-access shell called "TinySHell" that in itself is not intended as … Read more

Android a growing target for mobile malware -- report

The Android platform is becoming a key mobile target for cybercriminals, who are getting much more efficient with their malware, according to a report from Web-security company Blue Coat Systems.

In a mobile malware report, Blue Coat notes that Android is a popular target. Here's a look at the volume of Android malware:

Blue Coat noted:

The Android-based malware blocked by WebPulse included an Android root exploit and a variety of rogue Android software. Forty percent of Android malware was delivered via malnets, demonstrating how cybercriminals can successfully utilize embedded infrastructures to attack mobile users. In the most recent … Read more

BlackBerry taps Trend Micro to scan apps for malware

BlackBerry is counting on Trend Micro to help ensure the security of its third-party apps.

Like other app store owners, BlackBerry already scans apps for malware to protect BlackBerry World customers. But the company will add Trend Micro's Mobile Application Reputation Service to take that protection a few steps further.

Both current and new apps submitted to BlackBerry World will be scanned by Trend Micro's cloud-based service to hunt for malware.

"BlackBerry is working with Trend Micro to implement a more robust approach for addressing privacy and security concerns related to third-party applications," Adrian Stone, director … Read more

Android malware uses your PC's own mic to record you

A couple of Android apps masquerading as cleanup tools actually had a sneakier mission in mind.

Uncovered last month by Kaspersky, two apps named Superclean and DroidCleaner posed as software that claimed to clean up your Android smartphone or tablet. Instead, these two were actually pieces of malware designed to snoop on your conversations by infecting your computer.

The programs worked by downloading files that automatically execute after plugging an Android device into a Windows PC, according to Kaspersky's blog. After executing, the malware would trigger the audio recorder function in Windows, write the information to a file, and … Read more

Chinese hackers said to wage cyberwar on The New York Times

After a lengthy newspaper investigation on China's prime minister, The New York Times claims, the newspaper's computer systems were infiltrated and attacked by Chinese hackers.

The attacks began four months ago and culminated with hackers stealing the corporate password for every Times employee, according to the paper. The personal computers of 53 of these employees were also broken into and spied on.

The Times discovered the attacks after observing "unusual activity" in its computer system. Security investigators were then able to get into the system and track the hackers' movements, see what the infiltrators were after, … Read more

U.S. is home to greatest number of botnet servers, says McAfee

The United States is responsible for the highest number of botnet servers in the world, according to new data from McAfee.

A map and a list of major countries posted by McAfee yesterday show the greatest concentration of botnet servers to be in the U.S., with 631. That's more than two and a half times higher than the second country on the list -- the British Virgin Islands with 237.

The Netherlands took third place with 154 servers, followed by Russia with 125, Germany with 95, and Korea with 81. Among the Top 10, Canada fared the best … Read more

3 charged in malware scheme targeting bank accounts

U.S. authorities have charged three foreign nationals with creating and distributing a virus that allowed thieves to steal tens of millions of dollars from victims' bank accounts.

The three are accused of creating the Trojan virus Gozi, which infected more than 1 million computers worldwide and 40,000 in the United States, including computers belonging to NASA, according to court documents unsealed today by U.S. Attorney Preet Bharara in Manhattan. Nikita Kuzmin, 25, Deniss Calovskis, 27, and Mihai Ionut Paunescu, 28, are accused of creating "one of the most financially destructive computer viruses in history."

The … Read more

Beware of fake Java updates

Following recent security vulnerabilities in Java, malware developers are taking a new approach to exploit the Java platform by issuing false updates that pose as legitimate updates for the runtime.

The latest version of the Java runtime that fixes recent vulnerabilities is update 11, and Kaspersky labs is reporting that a new malware is out that poses as "Java Update 11." The malware is packaged in a Java archive file called "javaupdate11.jar" that contains two Windows-based executables called "up1.exe" and "up2.exe." When installed the programs open a back door … Read more