Tag Archives: featured1

Panda Security

They’ll hack your Android in T Minus 10 seconds

FOTO 1

The word that scared all Google users last summer is back and worse than ever. Stagefright, nicknamed by its founder Metaphor, is even more dangerous in its new version.

Much like its name’s meaning, Stagefright, hides deep in the Android library, unnoticeable to Android users as they watch videos of cute puppies and crafty DIY hacks, all the while exposing themselves to its vulnerabilities.

How many devices are affected?

Now in its second swing, these Stagefright vulnerabilities have already affected hundreds of thousands of Android devices through holes in the multimedia library. More specifically, they have even affected those who use versions 5.0-5.1 (23.5% of affected Androids) and some using versions 2.2 and 4.0 (unsafe due to old terminals that had been exposed to previous viruses).

Google fights back

After the bugs’ discovery, Google implemented a series of bug-fixes and other security measures, even creating its own group of vulnerabilities to counter the attacks. Upgrades and patches were set up to make it more difficult for Stagefright to infiltrate an Android in a real attack.

Unfortunately, Metaphor has been able to dodge these protection mechanisms that were added to the more modern versions of the Android. With this new exploit, as their own creators have shown, Stagefright can easily control devices as diverse and modern as the Nexus 5, Samsung Galaxy S5 UN, UN LG G3 or HTC One UN.

So, how exactly does Stagefright break in?

Sneakily. The user does not need to be using their smartphone during an attack, really. In the case of Stagefright, the attacker can gain access through a particular website (e.g. through a malicious video link received by email or MMS). In a proof of concept, an email with a corrupted video link promoting videos of kittens leads to a page actually containing this material. The recipient has no way of knowing, that while the video is rendering, their Android is also being attacked. It can take as little as 10 to 15 seconds for the cyber-criminal to have control of their victim’s terminal.

Spent some time today messing with Lightroom's post-processing tools to teach myself. I don't want to end up relying on them for every shot but it's nice to know what I have to work with.

Metaphor’s strategy is not exactly new. It largely relies on the attacks that were released last summer, when the holes were first discovered. However, today’s danger lies in Stagefright’s ability to bypass ASLR, which is the barrier Google raised in all versions of Android after 4.1. The problem is that this new threat binds itself not only to older devices but also to more modern ones. Those who have Android´s Lollipop 5.1 are not even safe, representing about 19% of all of Android smartphones.

No matter what, the best way to protect your Android and all other risks associated with Stagefright is to keep your operating system as up-to-date as possible and install a good antivirus. If your phone has been left out of the recent updates, take caution: you should not browse pages unless they are fully trusted. Even those who promise photos of adorable and fluffy kittens.

Panda Security

IOC: a buzz word and a hot topic, but do we really know its capabilities?

IOCs

 

In order to secure and maintain an IT infrastructure, it is vital to know what is going on in the network that the Endpoint is running on. This means that managers and other stakeholders need to know if something unusual is happening within the corporate network. When we use the word “unusual” we mean any potential threat or suspicious activity that may have happened or is currently happening within the company infrastructure.

Until now, the main service that most security-intelligence businesses could offer us was a subscription alerting us of the latest threats, malware, IPs and URLs with malicious intent; etc.  Adding this information to an infrastructure’s perimeter security system has allowed engineers to proactively plan and prepare, and has helped them to detect and prevent any threats their company may otherwise be susceptible to. In the IT industry, these updates are very common and companies will not hesitate to pay a certain amount in exchange for the latest updates offered.

With this service, it’s easy to prevent malware vulnerabilities but can we fully protect our infrastructure? The answer is yes, but the value of these services is high and the lifetime of their deliverables, in general, is very short.  So, what can we do to boost our protection?

 

The next generation in threat detection.

Every day, security analysts piece together different events related to new threats. When it comes to cyber-security, these analysts need a faster way to share information regarding the incident and must have the fastest response time possible. These incidents can be a simple observable (an IP, URL, a hash…), or can be more complex, requiring advanced analysis and reverse engineering. When all of these patterns have been assembled, the result is what we call an Indicator of Compromise (IOC). This may sound foreign to most of us, but security analysts should be familiar with the concept of an IOC and all of its capabilities.

So what exactly is an IOC?

In computer forensics, an IOC is an activity and/or malicious artifact identified on a network or an Endpoint.  We can identify these IOCs and can thus improve our abilities to detect a future attack.

 

Seems simple, right?

If we focus on their use cases, you can be described from a list of indicators to a full incident cybersecurity for analysis, research and/or response and can get answers to ‘What, Who, Why, How, Where and When ‘of the incident. Some of these use cases might be:

  • Inbox e-mails with falsified information (phishing)
  • Malware behavior patterns
  • Discovery of a specific vulnerability and actions to combat it
  • The distribution of a list of IPs related to Command and Control
  • Discovery of a specific vulnerability and actions to combat it
  • Sharing policies and patterns of behavior related to a certain incident (automatically or manually) so they can be exploited by third parties.

We can also use a list of standards to discover the IOC based on its needs (e.g., subsequent detection, characterization or sharing).

This was a brief introduction to IOCs.  We will continue to investigate this issue in the articles we publish in the future and our goal is to help security analysts understand more about the following:

  • What standards currently exist to help us find IOCs? State of the art, benefits, Use Cases…
  • How can we characterize an Indicator of Compromise?
  • How are we able to share Indicators of Compromise?
  • IOC Accuracy: Quality, life-time…

The post IOC: a buzz word and a hot topic, but do we really know its capabilities? appeared first on MediaCenter Panda Security.

Avast

What is SafeZone Browser?

Avast SafeZone browser makes online shopping and banking more secure.

Avast has long provided an extra layer of defense called SafeZone Browser in our premium products. We are currently giving SafeZone to a select number of Avast Free Antivirus users so we can learn what they think of the browser.

Avast SafeZone browser makes online shopping and banking more secure

Avast

Fake mobile antivirus apps promise rainbows and safety forever

fakeAVads4.pngAnnoying popups advertising fake antivirus apps appear in mobile browsers.

Those evil popups. We all know them, we all see them every day on our PCs while we are reading news, watching videos, or just generally – clicking. As tempting as they might sound, let me assure you that you’re not a 1000000th visitor and you certainly just didn’t win a lottery. Also no magic diet pills for you. Popups are not your friend. Close them, block them, and never trust them.

Panda Security

Who are the most famous hackers in history?

 

PandaSecurity-most-famous-hackers-in-history

Since the beginning of the internet, there have been hackers who have used the Net to benefit at the expense of other users.  Some have managed to attack so many people, or companies and institutions so large, that they have become internationally infamous.  These are the great villains of the internet.

At Panda Security, we have spent the last 25 years successfully fighting against these cyber criminals. We work every day to protect all of our users from the threats these hackers create, making your Panda antivirus purchase more than worthwhile 😉

Today we are going to recall some of the biggest hackers, whose cyber-crimes made them famous and led to arrest and jail time. Some of them even switched sides, saying goodbye to the dark side of the Internet.

1. “Cracka”: The mysterious British teenager who hacked into the CIA director’s database

The latest cyber-criminal to draw international press attention is a 16-year-old British boy who managed to hack into the personal mailings of the CIA Director, FBI Director and the Director of National Intelligence.  He was also able to hack into the Director of National Intelligence’s phone bills, revealing the identities of 31,000 US government agents (CIA, Homeland Security, and FBI).

The true identity of this kid has not been disclosed but we know that he calls himself “Cracka” and claims to be a member of the group of hackers, “Crackas with Attitude”, who act in defense of the Palestinian movement. “Cracka” was arrested last month in the southeast of England.

PandaSecurity-cracka-cia

2. “The homeless hacker” who betrayed Bradley Manning

Adrian Lamo is known as “The homeless hacker” because he was always traveling, connecting, and attacking via WiFi at Internet cafes and other public access points. Although he began his hacking career legally; analyzing security threats for large companies like Microsoft, Fortune 500, Bank of America or Yahoo!; he was later arrested for stealing data from more than 2,000 subscribers of The New York Times.

In 2002, he was sentenced to six months of house arrest and two months of probation for the above crime.  He is also remembered for his betrayal of US soldier Bradley Manning; in 2010 he reported Manning to the Federal Government for leaking classified information about the army and the Secretary of State to another famous hacker, WikiLeaks.

PandaSecurity-adrian-lamo

Adrian Lamo, Kevin Mitnick, and Kevin Poulsen (2001).

 

3. “Soupnazi”: 170 million credit cards hacked from Miami Beach

Albert Gonzalez is the hacker hiding behind the alter-ego “Soupnazi” and the person responsible for one of the largest identity thefts in the history of the Internet.  He gained access to accounts and stole more than 170 million credit cards from users worldwide.

This hacker was arrested in 2008 at a Miami Beach hotel and, in 2010, was sentenced to 20 years in prison by a New Jersey Federal Court. It is believed that Gonzalez was working with hackers hiding in other countries, making them impossible to catch.

 

PandaSecurity-miami-beach-hacked

 

4. The St. Petersburg hacker who stole $10 million from Citibank network

After the end of the Cold War, St. Petersburg became one of the main hot-spots for cyber-crime.  This is where Vladimir Levin had a remarkable career that could be straight out of a James Bond film.

In 1994, after graduating from Saint Petersburg State Institution of Technology, Levin managed to steal $10 million from Citibank clients, all from his apartment in St. Petersburg.  Unfortunately for Levin, Interpol tracked him down and arrested him in London’s Stansted airport. He was extradited to the United States, where he was sentenced to serve three years in prison and pay a fine of $240,015 (plus return all of the stolen money).  It is believed that Levin could be part of an organized group (leading it or taking orders) connected to the Russian mafia.

 

5. The Most Wanted cyber-criminal in the United States

Kevin Mitnick’s case is probably the most controversial in Internet history. In 1983, he managed to hack into the Pentagon network and into the systems of very large corporations (similar to Nokia or Motorola).  He combined social engineering practices by hacking both computers and telephone networks. This made him the most wanted cyber-criminal in the world, in a highly-publicized investigation that ended with his arrest two years later.

After serving five years in prison, Mitnick decided to leave the dark side of the Net. He became a security consultant for several companies and began to hold conferences about cyber security on universal forums. He currently runs his own security consulting company, Mitnick Security Consulting, LLC.

PandaSecurity-cyber-criminal

These are our Top 5 hackers. We are very well-informed about the malware these hackers create and we analyze it every day so that you can have the best virus protection. Who do you think is the worst hacker?

 

The post Who are the most famous hackers in history? appeared first on MediaCenter Panda Security.

Panda Security

Cyber-crooks can use your wireless mouse and keyboard!

wireless-keyboard

Remember how the problems you had with the nightmare of tangled cables going in and out of your computer went away the day you discovered wireless devices? In fact, you swore never to touch a wired device again after buying a keyboard and mouse capable of communicating with your computer without needing to be physically connected to it. You even went as far as to replace your laptop’s touchpad with a mouse that communicates with your computer via a small USB connector as if by magic.

Well, we have news for you: A group of security experts have discovered that these devices, as convenient as they are, are not very safe. Cyber-criminals can take control of users’ computers remotely by exploiting flaws found in wireless keyboards and mice from seven major manufacturers (Logitech, Dell, Microsoft, HP, Amazon, Gigabyte and Lenovo).

The security hole affects millions of devices that use chips sold by the Norwegian firm Nordic Semiconductor. These chips allow devices to establish a short-wave radio communication with the target computer. Although these chips are capable of encryption, they require that vendors write their own firmware to implement that encryption and secure the connection between computers and peripheral devices. However, many companies don’t take the precaution to encrypt those communications.

And even if they did, it wouldn’t be much use. The companies that do encrypt their communications do not properly authenticate communicating devices, allowing rogue devices to inject unencrypted keystrokes over the same connection. Actually, the security experts that unveiled this vulnerability found several flaws in the firmware of the keyboards and mice that use those chips.

crazyradio-usb

A simple and affordable USB adapter with an antenna and a laptop was all they needed to demonstrate that it is possible to interfere with the radio protocol used by these devices to communicate with their USB dongle and send commands to the target computer. To do that, the target computer must be relatively close to the antenna, although they have been able to control Lenovo wireless devices from 180 meters away.

So, any attacker that used the method discovered by these researchers could take over a computer without laying a finger on its mouse or keyboard. The commands sent by the hacker would be interpreted by the computer as coming from the legitimate device.

Now, what could an attacker that took advantage of this flaw actually do on the affected system? Nothing much, really. Even if they managed to access the targeted computer, they wouldn’t be able to see its screen, so even unlocking the computer would be a difficult task not knowing the relevant password.

According to these experts, if the computer were actually unlocked, the cyber-crook would be able to download malware that could allow them to take full control of the computer.

However, the attacker would only have the same privileges as the legitimate user. If the computer were in an office, for example, they probably wouldn’t have the necessary permissions to install malicious programs on it.

keysweeperA Logitech spokesperson has already claimed that the “vulnerability would be complex to replicate” and “is therefore a difficult and unlikely path of attack.”  Despite that, the company has decided to develop a firmware update for the affected devices.

Similarly, Lenovo has announced that it will give users the option to replace the affected devices.  Microsoft, however, has simply stated that it will only launch an update as soon as possible.

This is not the first time that researchers warn of the dangers of wireless keyboards and mice. Last year, renowned security expert Samy Kamkar developed Key Sweeper, a keylogger hidden in a fake USB charger that logged the keystrokes typed on any Microsoft wireless keyboard.  With the help of an Arduino board, anyone could develop this keylogger software and find out what others were typing.

This research is extremely significant as it demonstrates that millions of devices are vulnerable. Taking into account that it may encourage cyber-criminals to start doing some tests, it may be a good idea to start updating your devices’ firmware whenever possible, and even replace vulnerable keyboards and mice with wired peripherals or, better still, wireless devices that communicate with computers via Bluetooth.

Bear this in mind, however: as cyber-crooks need to be close to the target device to carry out this attack, it seems logical that they set their eyes on companies rather than home users. But don’t lower your guard: prevention is better than cure…

The post Cyber-crooks can use your wireless mouse and keyboard! appeared first on MediaCenter Panda Security.

Avast

TGIF: Avast security news wrap-up for March 2016

Get your Avast update on ransomware, mobile security, social media, and enterprise security.

Mac ransomware demands paymentMac users get first taste of ransomware

Mac users got attacked by ransomware in the first fully functional attack on OS X. Now that hackers have proven that Mac users are a viable target, it’s time to move on from the myth that Macs are impervious to attack and get protection. 

Locky_campaign_flow-132996-edited.pngA closer look at the Locky ransomware

Ransomware attacks targeting PC users are quite successful. New variants are introduced, but they have the same format- encrypt your files and demand payment for the key to unlock them. The Avast Virus Lab did a deep analysis of ransomware dubbed Locky. This is deep look was followed by Locky’s JavaScript downloader, which describes the phishing campaign that has emerged as the main infection vector.

Avast

Locky’s JavaScript downloader

Locky is a considerable security threat that is now widely spread.

It seems that Locky’s authors are now predominately using one campaign to spread the ransomware. Last week, we published a blog post about Locky Ransomware, the ransomware that is most likely being spread by the infamous Dridex botnet. In our last blog post, we described three campaigns the Locky authors are using to spread their malware. Now Locky’s authors are mainly using the campaign with javascript packed into a zip file sent to people through phishing emails.