Creators of SpyEye Virus Sentenced to 24 Years in Prison

In Brief
Two International hackers, Aleksandr Andreevich Panin and Hamza Bendelladj, have been sentenced to a combined 24 years and 6 months in prison for their roles in developing and distributing SpyEye banking trojan, a powerful botnet similar to the infamous ZeuS malware.

Both hackers were charged with stealing hundreds of millions of dollars from banking institutions worldwide.

Red Hat Security Advisory 2016-0676-01

Red Hat Security Advisory 2016-0676-01 – The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix: Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws.

Red Hat Security Advisory 2016-0675-01

Red Hat Security Advisory 2016-0675-01 – The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fix: Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws.

Cleaning Up Your Digital Life

Spring is here! The sun is shining, winter clothes are pushed to the back of the closet, and people are heading to the beaches and parks to embrace spring weather.  Well, at least here in California.

For many of us, we view spring as a time to purge and clean – out with the old and in with the new – a new opportunity to throw out old clothes or to make the garden look a little tidier.  So why not clean up your digital life as well?

Your phone may not be the first thing you think of when you think of Spring Cleaning but if your phone is like mine, then your entire life is on it!  Looking at my photos alone, I have 944 pictures.  Many of them are duplicates, as I always take more than one to make sure I get a good one and then I forget to delete them later.   If I go through them one-by-one it will be time consuming, not to mention that I’ll probably get distracted by messages and other notifications.

That why I recommend you install AVG Cleaner™ for Android™ from the Google play store.  It has a great photo cleaning app that identifies “bad” photos and allows you to review them the way you could review photos in some dating apps, swipe right to keep or left to reject.  It also shows duplicate photos and makes automatic recommendations.

Because photos contain a lot of data, it’s also a good time to review the settings on your phone to ensure that you don’t fall foul of publishing your location when you did not mean to.  Here are a couple things to keep in mind:

–        Photos can contain specific location information stored in metadata within the image itself.

–        The location data usually includes the precise GPS coordinates of where the photo was taken, as well as the time and date it was captured.

It’s an easy task to switch off the feature that allows location data to be stored in the photo.  Here are the steps:

  • Disable location services for the camera on your smartphone.
  • Be aware of location options in apps or online services and social media.

In addition to cleaning out photos, AVG Cleaner™ for Android™ also identifies apps and games that you don’t use, which allows you to delete them to save valuable space.  It also contains tools that give you data on which apps use the most storage, battery and data – all so you can make the decision whether to keep them.  In my phone, I deleted 13 apps; including a parking payment apps in cities where I visited one time and apps I downloaded once just to see what they do.

And of course, I can’t write a blog about cleaning up your phone without mentioning updating your antivirus.  If you have AVG AntiVirus for Android™, open it up to run a scan for viruses.  If you don’t have the app, you can always download it here.

Not only does cleaning your phone make the phone perform better but it’s like new again!  Mine is ready for the next round of stuff that I am going to load on it.  All I need is a new screen protector!

To learn more about me and receive the latest news from AVG:

Follow me on Twitter @TonyatAVG

Follow AVG on Twitter @AVGFree

 

 

 

FTC Releases Alert on Earthquake Disaster Email Scams

Original release date: April 20, 2016

The Federal Trade Commission (FTC) has released an alert on email scams that cite the recent earthquakes in Ecuador and Japan. The scam emails may contain links or attachments that direct users to phishing or malware-infected websites. Donation requests from fraudulent charitable organizations commonly appear after major natural disasters.

US-CERT encourages users to take the following measures to protect themselves:

  • Review the FTC alert and their information on Charity Scams.
  • Do not follow unsolicited web links or attachments in email messages.
  • Keep antivirus and other computer software up-to-date.
  • Check this Better Business Bureau (BBB) list for Ecuador Earthquake Relief before making any donations to this cause.
  • Verify the legitimacy of any email solicitation by contacting the organization directly through a trusted contact number. You can find trusted contact information for many charities on the BBB’s National Charity Report Index.
  • Refer to Security Tip ST04-014 – Avoiding Social Engineering and Phishing Attacks – for more information on social engineering attacks.

This product is provided subject to this Notification and this Privacy & Use policy.

Executable installers are vulnerable^WEVIL (case 33): GData's installers allow escalation of privilege

Posted by Stefan Kanthak on Apr 20

Hi @ll,

the executable installers of G-Data’s “security” products for
Windows, available from <https://www.gdata.de/downloads>, allow
escalation of privilege!

The downloadable executables are self-extractors containing the
real executable installer as resource: they create the subdirectory
%TEMP%{guidguid-guid-guid-guid-guidguidguid}
using another resource containing the hardcoded value of this GUID,
extract the real…

[ERPSCAN-16-004] SAP NetWeaver 7.4 (Pmitest servlet) – XSS vulnerability

Posted by ERPScan inc on Apr 20

Application: SAP NetWeaver
Versions Affected: SAP NetWeaver J2EE Engine 7.40
Vendor URL: http://SAP.com
Bugs: Cross-Site Scripting
Sent: 01.09.2015
Reported: 01.09.2015
Vendor response: 02.09.2015
Date of Public Advisory: 12.01.2016
Reference: SAP Security Note 2234918
Author: Vahagn Vardanyan (ERPScan)

Description

1. ADVISORY INFORMATION
Title: SAP NetWeaver J2EE Engine 7.40
Advisory ID: [ERPSCAN-16-004]
Risk: Medium
Advisory URL:…

[ERPSCAN-16-005] SAP HANA hdbxsengine JSON – DoS vulnerability

Posted by ERPScan inc on Apr 20

Application: SAP HANA
Versions Affected: SAP HANA
Vendor URL: http://SAP.com
Bugs: DoS
Sent: 28.09.2015
Reported: 28.09.2015
Vendor response: 29.09.2015
Date of Public Advisory: 12.01.2016
Reference: SAP Security Note 2241978
Author: Mathieu Geli (ERPScan)

Description

1. ADVISORY INFORMATION

Title: SAP NetWeaver J2EE Engine 7.40
Advisory ID: [ERPSCAN-16-005]
Risk: Medium
Advisory URL:…