“Search Engine Security” to Protect IE Users Against BlackHat SEO Links

Security solutions provider Zscaler revealed its latest product designed to aid Internet users while surfing the web. It’s called Search Engine Security (SES) and it’s meant to protect Internet Explorer customers against BlackHat SEO links in search engines.

SES already exists for Mozilla Firefox and Google Chrome, but now the company also made the Internet Explorer variant available.

The way SES works is simple. Normally, when cybercriminals hijack a website and alter it to serve their purposes, they use Referer and User-Agent headers to decide if the user should be directed to the malicious webpage or a harmless one.

If it’s installed in the web browser, SES ensures that each time the user accesses a link from Google, Yahoo! or Bing, the headers are modified so that the hijacked site sees him as not being human, avoiding to redirect him to the malware-infested site.


Internauts who install SES will see a small piece of text at the top of the search engine result page which indicates if the feature is active or not.

The tool also allows customers to whitelist specific pages if they’re certain that they can’t cause any harm.

The control panel of the Internet Explorer version can be found in the Tools menu, under Search Engine Security options.

In the options menu, the user can activate the security feature for each search engine individually, he can set the Referer header, and add sites to the whitelist.

Internet users are advised to give SES a try, especially if they’re in the habit of using search engines on a regular basis.

Search Engine Security for Internet Explorer, Chrome and Firefox is available for download here.

softpedia.com

China Wants to Take Out US Satellites with Microwave Pulses

Lin Shishan, a colonel in the General Staff Fourth Department, wrote an article in which he detailed the People’s Liberation Army’s (PLA) plans to take out United States computer networks and satellite communications.

According to Pakalert Press, the latter category would be targeted with high-power microwave pulses that would penetrate the satellite via its antennas and cables, causing serious damage to the electronic components inside.

Members of the China Academy of Space Technology, Wu Gang, Song Zhiqiang, and Liu Bo, stated that the country is highly aware of the fact that satellite systems are of maximum importance, which is why they’re bound to become targets on cyber warfare.


“When the power or energy reaches a certain level of magnitude, it would interfere with the internal electronic equipment or components, rendering them unable to function normally, or even burning the semi-conductor components and integrated circuit of the electronic equipment,” they explained regarding the attacks on satellite systems.

Another paper published sometime in March by Liu Wangxin reveals that China may try to take over the Internet information nodes and facilities governed by the US.

On the other side of the fence, US experts don’t seem to be too surprised by the news.

“As expected, they view our communications and GPS navigation systems as priority targets at the start of a conflict and are spending time and effort figuring out their vulnerabilities and attack strategies,” said Dmitri Alperovitch, CTO of CrowdStrike.

For now, the US has the upper hand from a technological standpoint and that’s probably why the Chinese will try to cause some damage by relying on whatever technology they already possess.

However, this doesn’t mean that United States is not preparing for battle. Edward Timperlake, a former Pentagon security expert claims that the country’s forces from the Pacific need to be reinforced with new technologies, training and tactics which can ensure that anything China has in store can be dealt with.

softpedia.com

Microsoft Details Mac OS X Malware That Exploits Office Vulnerability

Malware that targets Mac OS X machines is becoming widespread and most major companies have come to realize that Apple products are not as safe from malicious viruses as they were once. As expected, Microsoft also came forward to provide an example of a Mac OS X threat.

This particular malware, identified as Exploit:MacOS_X/MS09-027.A, leverages a remote code execution vulnerability in Microsoft Office, which was addressed by the company back in 2009.

Although the infection rates are not as widespread as in the case of the now-infamous Flashback Trojan, the company’s security experts reveal that there are still a number of computer owners who have failed to apply the security update, thus putting their assets at risk.

So how does the infection work?


First of all, it has been determined that the exploit works only on Snow Leopard or earlier versions of the operating system because starting with Lion, the memory address targeted by the malware is read–only.

As the diagram shows, the stack-based buffer overflow vulnerability is used to corrupt a local variable, which is later utilized to deploy the “stage 1” shellcode to a specific area.

This “stage 1” shellcode then leads to the “stage 2” shellcode, which is the location in the memory where the actual infection occurs.

“Stage 2” creates a number of three files: tmp/launch-hs, /tmp/launch-hse, and /tmp/file.doc. The first file actually contains a shell script or an executable which launches /tmp/launch-hs and and opens /tmp/file.doc.

The latter is actually a decoy document that’s designed to trick users into believing that there’s nothing malicious involved.

/tmp/launch-hse is the main payload file that, once it’s executed, starts communicating with the malware’s command and control server.

“Statistically speaking, as this operating system gains in consumer usage, attacks on the platform will increase. Exploiting Mac OSX is not much different from other operating systems. Even though Mac OSX has introduced many mitigation technologies to reduce risk, your protection against security vulnerabilities has a direct correllation with updating installed applications,” Jeong Wook Oh of the MMPC concluded.

softpedia.com

Skype Vulnerability Leads to User IP Disclosure

A security hole found recently in Skype, the popular messaging application, allows users, even with low skill levels, to find out the IP addresses of other customers.

It’s uncertain at this point who found the vulnerability, but it appears that it first surfaced on Pastebin, later being picked up by the Skype-Open-Source blog.

The proof of concept is fairly simple. All an attacker needs to do is download a special Skype variant and alter a few registry keys to enable debug-log file creation.

When adding a Skype contact, before sending the actual request, the victim’s information card can be viewed. At this point, the log file records the user’s IP address.

As many may be aware, the IP address embeds valuable information regarding a user’s location, including country, city and the name of the Internet service provider he/she utilizes.

Microsoft was notified on the issue and the company is currently working on a fix.


“We are investigating reports of a new tool that captures a Skype user’s last known IP address. This is an ongoing, industry-wide issue faced by all peer-to-peer software companies. We are committed to the safety and security of our customers and we are takings measures to help protect them,” Adrian Asher, director of product security for Skype told Neowin.

Ever since Microsoft took over Skype, the communications app has evolved a great deal. The Redmond company has already made it available on Play Station Vita, being determined to also add it to Xbox.

However, in the past period, security experts highlighted a number of vulnerabilities that affected not only Skype websites, but also the application itself.

First, on February 17, we learned that Vulnerability Lab researchers identified a high risk memory corruption issue that could have allowed an attacker to remotely crash a computer.

More recently, at the end of March, the same team of experts discovered a number of high-risk flaws, including a pointer corruption problem and a persistent weakness vector.

softpedia.com

Hacker Helps Pakistani Singer Zaain Ul Abeedin Recover His Facebook Page

The famous Pakistani singer Zaain Ul Abeedin recently found that his Facebook page was taken over by a cybercriminal. Authorities failed to help the celebrity so he turned to ethical hacker Himanshu Sharma, who in less than 24 hours managed to recover the account.

This is not the first time when a celebrity’s social media account is hijacked, but this time the hacker didn’t phish his credentials as in most of the other scenarios. Instead, the cybercrook relied on the zero day vulnerability in Hotmail to gain access to his email account, from which he was able to reset the passwords.

According to Zaain, the ill-intended hacker who breached his social media account started urging his friends to Like another Facebook page, but didn’t cause any other damage.


It’s believed that, most likely, this was a case of sabotage ordered by the competition with the purpose of ruining the reputation of Zaain.

So how did he manage to regain his accounts?

Initially, the star went to Pakistani authorities to report the crime, but they couldn’t help him so they suggested that he contact the ethical hacker Ankit Fadia.

In the end, Zaain and his manager contacted another well-known ethical hacker, Himanshu Sharma, or нα¢кєя. Only 18 years of age, Himanshu is already famous for finding security holes in the sites owned by Apple, Google, Microsoft and even Facebook.

The security expert not only managed to recover the Facebook account, but he was also able to track down the hacker’s location and phone number.

“It was a hard task the hacker left almost no trace , but i was lucky enough to find a keylogger posted by him online which upon some reverse engineering took me to the hacker,” Himanshu said.

The attacker's identity was not made public, but the point is that he was stopped before he could cause any serious damage.

Zaain made this story public because he felt that ethical hackers are not as appreciated as they should be.

On the other hand, we wanted to highlight once again that hackers are not all bad. White hats and ethical hackers are the ones that keep everything in balance, making sure that profit-driven cybercriminals can’t go too far with their wrongdoings.

softpedia.com

New guide to Facebook helps school counselors create better digital citizens

Today’s generation of children can sync digital devices to computers and troubleshoot problems with the click of a mouse.
But they may not be able to handle the overwhelming situations online and problems that arise from making uninformed decisions.
That’s where educators come in. School counselors can play a vital role in helping students learn to make safe, smart and responsible choices online.
However, it can be difficult to help students become better digital citizens if you don’t understand how they are using technology and social networks.
To remedy this, our friends at the Internet Keep Safe Coalition (iKeepSafe) recently partnered with Facebook (an NCSA Board Member company) to develop the Facebook Guide for School Counselors.
The guide has four suggested action items for school counselors: develop school policies, respond to online incidents that impact learning conditions, detect at-risk behavior and learn about technology literacy, online reputation and social awareness.

The guide also discusses potential situations that can arise online, such as problems with bullying, reputation, identity theft and cyber crimes. It teaches counselors everything from basic Facebook settings to how to detect at-risk behavior.
Emily Ensign, iKeepSafe’s Director of Content Development, says it’s important for all schools to build a positive school climate where students feel safe sharing information that may be of concern.
“Building an environment of trust and understanding is essential,” Ensign says. “Teachers, school counselors, administrators – all school staff – need to be proactive rather than reactive.”
iKeepSafe offers these tips:

• Review and update your acceptable use policy (AUP)
• Work as a team to develop strategies for managing cyberbullying and harassment
• Build a positive school climate where students feel safe
• Teach students to proactively protect their classmates from harassment and harm by being upstanders rather than bystanders.
• Ensure students and faculty are alert to red flags and know how to respond

iKeepSafe hopes the guide will show educators how important the online world is to children, and how their actions can profoundly affect their offline world.
“We all want to keep our kids safe, but that won’t happen if we create barriers and block device usage,” iKeepSafe CEO & President Marsali Hancock says.
“Only when we empower them to explore their connected world will they be keyed in to the pitfalls and advantages of social navigation across all platforms.”
The Facebook for School Counselors is free and available to download at www.facebook.com/safety or www.facebook.com/education.

staysafeonline.org

Anonymous Initiates Phase Two of Operation Against CISPA

Anonymous released a video which reveals the start of the second phase of Operation Defense, the op initiated by hacktivists as a form of protest against the Cyber Intelligence Sharing and Protection Act (CISPA).

If in the first phase supporters of the Anonymous movement were called to protest online, the second part of Operation Defense becomes more physical.

“We are calling upon the citizens of the United States to physically protest. This includes all the Occupy movement. Our rights are being taken away,” the hacktivists said.

The hackers admit that distributed denial-of-service (DDOS) attacks are not as effective as they were one year ago, mainly because the owners of websites have upgraded their servers to better withstand the large number of packets sent their way during such an operation.


Until now, the sites of companies such as Microsoft, IBM, AT&T, Boeing, Verizon, and the Financial Services Roundtable have been targeted with DDOS attacks.

Even though some of the attacks proved to be a success, it’s clear that they weren’t taken as a serious threat, CISPA successfully passing the vote of the US House of Representatives.

In the meantime, Mike Rogers, one of the initiators of the bill, came forward in an attempt to explain that the new cybersecurity law doesn’t target Americans, but the Chinese, who in the past years have been constantly stealing secrets from the US.

His words have provided little comfort to those who oppose the act so, starting tomorrow, May 1, physical demonstrations are programmed to take place throughout the United States.

Between May 1-5, AT&T headquarters and shops will be targeted, followed by IBM, Intel, Microsoft, Verizon Wireless, and Bank of America.

Starting with June 3, Chase Bank, Pepsi and Coca Cola, Target, Walmart, and CVS locations will be visited.

Here is the video Anonymous released to announce phase two of Operation Defense:

softpedia.com

Filipino Hackers Ignore Rulers, 14 Chinese Government Sites Defaced

Filipino officials urged the local Anonymous community to put an end to the cyberbattle with China, but their message fell on death ears as the hackers breached and defaced a number of 14 websites managed by the Chinese government.

“You may continue bullying our country’s waters but we will not tolerate you from intimidating our own cyber shores. Those defacements are just a mere response to what you have initially started. We are not trying to start anything. We are just trying to tell you that we do not want to be bullied in our own cyberspace too,” the hackers wrote.

According to NewsBytes, the reasons for which the breaches part of OpChinaDown were performed are still the same: supremacy over Spratlys and Scarborough Shoal.


Again, the rulers of the country are displeased with the actions of Anonymous Philippines, a spokesperson of the government publicly stating the disapproval for such operations, Ground Report informs.

“Vigilantism, however mushy, ultranationalist, or, sympathetic can only increase tensions. .It is understandble there is anger over the situation at Bajo de Masinloc, But we must be united and not do unilateral acts which only inflames tensions,” he explained.

At press time, all the affected Chinese government sites were taken offline, so we could not determine which ministries or departments had been defaced. However, most likely the targets were chosen randomly.

It seems that Anonymous benefits from the support of Pinoy citizens. A blogger who was among the first to report the attacks encouraged the hackers, who are fed up with being bullied around over the controversial regions.

At this point, we lost count of all the websites that were breached on both sides and unfortunately, the situation seems to escalate, despite the many warnings of the Philippines government.

softpedia.com

Cybercriminals Control Android TigerBot Via SMS

At the beginning of April, security researchers found that a number of shady Chinese Android stores were pushing apps that masked a piece of malware called TigerBot (ANDROIDOS_TIGERBOT.EVL).

Also known as Spyera, the malicious element was analyzed by Trend Micro experts. They discovered that the malware was controlled by its masters via SMS or phone calls, being capable of performing a number of tasks, including call recording and GPS tracking.

The list of commands accepted by TigerBot includes DEBUG, CHANGE_IAP, PROCESS_LIST_ADD, PROCESS_LIST_DELETE, ACTIVE, and DEACTIVE.

Let’s take a better look at these commands. First, DEBUG allows the cybercriminals to learn the names of the currently running processes, TigerBot’s configuration, and check the network status.


When the malware receives the CHANGE_IAP command, it connects to the network by changing the infected device’s Access Point Name. Depending on whether the action is successful or not, the attacker receives an SMS with the task’s status.

The codes for PROCESS_LIST_ADD and PROCESS_LIST_DELETE don’t seem to be complete, but the keywords are basically designed to manage processes. The processes added to the list are killed every 5 minutes.

The ACTIVE command, as you may suspect, activates TigerBot. When the string is sent, the malicious element sends an HTTP POST containing the phone’s IMEI, app key, timestamp and signature to the backend server.

In order to deactivate TigerBot, a phone call to *#[key] must be placed.

There is another list of SMS commands that can be sent to the malware. For instance, UPLOAD_NETWORKINFO returns GSM and CDMA location. SEND_MSG_TO_TARGET sends an SMS to a certain number with arbitrary content.

If the cybercrooks want to restart the device or take a screenshot, they can use commands such as RESTART_DEVICE and CAPTURE_IMAGE.

Android users who want to verify if a TigerBot infection is present can send a DEBUG command to the phone. To do this, simply take another phone, write "* *" in a text message and send it to the device you want to check. If a list of processes is returned, you are a victim.

softpedia.com

Experts Present Theoretical Dangers Behind Internet-Enabled Home Appliances

Security researchers from Norman put their imagination to good use and came up with four doomsday scenarios that could happen if Internet-enabled home appliances such as toasters, fridges, TVs, and alarm clocks would be somehow compromised by hackers.

While the theories seem a bit far-fetched, in a future where every single appliance will be connected to the Internet they might just come true.

It’s obvious that these days when researchers come up with new inventions and innovations they don’t put much thought into the security measures that should protect against misuse and online threats. A perfect example is wireless medical devices.

They’ve been around for quite a while, but only now, since experts have proved that they can be hacked into and altered with devastating effects, enhanced protection mechanisms are being taken into consideration.


So, let’s take a look at the toaster of the future, the one that we’ll be able to program directly from our computer, or from our phone. What if someone with an ill intent would hack into the programing system and set it to turn on and stay on for longer periods of time. Because of the heat, a fire could start.

When it comes to TV sets, it’s even more serious, because experts have already proved that they can be controlled via the Internet. Norman experts speak of brainwashing, but activists may argue that you don’t need to hack into a TV to alter someone’s belief system.

The temperatures of a refrigerator that’s web-enabled could be tampered with to make sure that the food stored inside it doesn’t last as long as it should. Fridges that store expiry dates could be programed to dupe their owners into believing that expired food is still good. In this case, food poisoning and dangerous bacteria comes to mind.

Finally, alarm clocks could be set to ring at random intervals to drive an individual crazy. Sort of like a Chinese water torture.

While it’s unlikely that these scenarios will occur in the near future, we have considered they were worth mentioning because the inventors of smart devices need to focus their efforts more on the security aspect of their creations.

There was a time when you could connect something to the Internet without worrying too much, but now, in the era in which online threats lurk at every corner, security must always be on top of the list.

softpedia.com

Fake Windows Antivirus Series Still Doing the Rounds

Not long ago we've presented a series of fake Windows antivirus programs designed to fool users into purchasing shady pieces of software that allegedly cleaned up infections that didn’t exist in the first place. Experts warn that new versions of the phony AV applications are making the rounds.

Until now, the fake antiviruses were named Process Director, No-Risk Agent, AntiHazard Center, Health Keeper, Guardian Angel, Software Keeper, Problems Stopper, and No-Risk Center.

The newer variants found by GFI researchers work in the same way, but their names have changed to Windows Care Taker, Efficiency Reservoir, Process Accelerator, Stability Maximizer, Cleaning Tools, Component Protector, Antibreaking System, Foolproof Protector, Crucial Scanner, Protection Unit, or simply Windows Antivirus.

While their names may have changed, and continue to change almost daily, the way they function remains mostly the same.


Once on a computer, the rogue pieces of software will alert the user that a number of threats that urgently need to be addressed are found on the system.

In reality, there aren’t any Trojan Downloaders, Monitors, Spoofers, Trojan-DDoSs and Worms, but the well-designed window that apparently scans the PC may trick some users into believing that they exist.

In order to get rid of the infections, victims are requested to purchase a cleaner that can apparently make everything go away. However, the cleaning application is just as phony as the antivirus programs, so in reality, internauts end up paying for an inexistent service.

Fortunately, GFI provides removal tools for each of these malicious elements. However, in some scenarios, the scareware is designed to block the installation of legitimate security solutions to ensure a higher rate of success.

In this situation, victims can turn to special apps offered by security firms, such as the VIPRE Rescue Disk from GFI, which removes the threat before the operating system starts.

softpedia.com

Phishing Emails Lure Santander Customers with Software Update Notice

An email allegedly coming from Santander Bank urges customers to upgrade their software. However, this is nothing more than a clever phishing scam that’s designed to steal online banking details.

The malicious email, provided by Hoax Slayer, reads:

Dear Valued Customer,

Santander Online Banking technical services department is carrying out a scheduled software upgrade to improve the quality of services for the bank's customers. Please upgrade immediately by clicking on this link below:

Secure Sign-In Access

Thank you for your prompt attention to this matter.
Regards,
Security Department

Internauts who fall for the plot and click on the link are taken to a webpage that tries to replicate the official Santander site. On this page, users will find a number of forms that request information such as personal ID, passcode, PIN, mobile phone number, landline number, date of birth, secret questions and their answers.


In the end, a message pops up, informing the victim that the verification has completed successfully. Unfortunately, at this point, all the data is safely stored in a database controlled by the cybercriminals.

The basic rule is the same and it will not change in the near future. Banks and other financial institutions never ask you via email to provide credit card numbers, passwords, PINs and other information that can be used for online shopping or transactions.

If you’ve reached the end of the phony verification and realize that you have been duped, or even days after you come to the conclusion that it was all a scam, the first thing you must do is call Santander and have them block all transactions until your credit card and online account can be changed.

The longer the time that passes since the information is submitted, the chances that the account is emptied increase, so in these situations time is of the essence. Of course, the ideal situation is the one in which users completely ignore such requests and delete the emails or report them to the bank.

softpedia.com

Iranian Science, Research and Technology Ministry Fends Off Cyberattack

Iran’s Ministry of Science, Research and Technology released a statement revealing that the organization had recently managed to protect its networks against a cyberattack.

According to Fars News, the ministry’s systems were targeted by hackers, but the countermeasures set in place by authorities proved to be effective.

“Despite the frequent efforts made by hackers, the cyber attack has failed to leave any impact on the data system,” read the statement issued by ministry officials.

The computer networks owned and operated by the county’s government are constantly attacked and the main suspects, as always, are considered to be the United States and Israel.

Another recent target was the Ministry of Petroleum whose representatives claim that a computer virus was used in an attempt to cause damage to hard drives. This attack also failed.


After the Stuxnet incident, which may have been part of a larger plot designed to disrupt the state’s nuclear program, Iran seems to have deployed enhanced mechanisms to protect its networks against their enemies.

The presence of Stuxnet has long been debated. If at first everyone believed that the main culprits were the United States and Israel, later, the finger was pointed even at Russia.

More recent reports showed that Iranian double agents working for Israel might have manually planted Stuxnet by using a memory stick.

It’s believed that the operation against Iran’s nuclear facilities is more than just about computer viruses. Some voices claimed that as part of the same campaign a number of nuclear scientists were assassinated.

It seems that this episode is far from being over. Just like the US constantly accuses China and Russia of launching state-funded cyberattacks against its infrastructures, Iran will continue to blame Israel and the United States.

softpedia.com