Robert Lemos

DroidDream turns Androids into zombies

The malicious code that led Google to remove more than 50 Trojan applications from the Android Marketplace appears to mainly be a "dropper" -- a program designed to load other code to further compromise the affected smartphone, according to a security firm's analysis.

The code, dubbed "DroidDream," attempts to use two exploits to gain root privilege on a compromised smartphone by breaking out of the sandbox designed to limit what applications can do on Android devices, mobile security firm Lookout stated in its most recent analysis.

CSO Online

PCI Compliance Means Getting Your App Security Together

Many companies' applications still don't meet the security standards outlined in the Payment Card Industry (PCI) Data Security Standards, according to a recent study.

During the 18-month study, which was published last week, security firm Veracode scanned the binary code of more than 2,900 applications on behalf of its clients. Its findings are sobering: Nearly six out of every 10 applications had an "unacceptable" level of security; more than eight out of 10 applications failed to catch classes of Web application vulnerabilities required for remediation under PCI DSS.

While the customers eventually fixed the flaws, most enterprises' applications fail to meet with PCI standards -- a rather low bar for Web application security, says Chris Eng, senior director of security research at Veracode.

DarkReading

InfoWorld Tech Watch Blog - Week of August 16, 2010

Published this week: Got Adobe ColdFusion? Start patching • Network Solutions versus the wily widget • Intel + McAfee = Desperate mobile move

Mobile Flaw Could Cloak Clicks

It's possible to craft a malicious website so that a user's clicks are secretly redirected to a legitimate site in a way that steals a user's passwords and other data. Many Web developers have added protections to block the tactic on standard Web sites, but Stanford University researchers warn that there are not nearly enough defenses against the technique on mobile websites, which are accessed from devices such as the iPhone.

As a result, a smart-phone user could think he's tapping to check a baseball score but is actually tapping on a button in a hidden page to confirm a money transfer.

Technology Review

Not Deserving of Trust

When he wants to break into a corporate network, Kevin Johnson looks first to social networks to provide a way in.

The popular services, such as Facebook and Twitter, provide Johnson with connections to employees, information about their habits and a way to deliver hacking programs designed to infiltrate their computers. As a penetration tester for security firm InGuardians -- where he pretends to be the bad guy to help clients spot holes in their security -- Johnson has come to appreciate the ease with which social networks can be used to attack users.

YourSecurityResource.com

Rise of the Point-and-Click Botnet

In 2005, a Russian hacker group known as UpLevel developed Zeus, a point-and-click program for creating and controlling a network of compromised computer systems, also known as a botnet. Five years of development later, the latest version of this software, which can be downloaded for free and requires very little technical skill to operate, is one of the most popular botnet platforms for spammers, fraudsters, and people who deal in stolen personal information.

Last week, the security firm NetWitness, based in Herndon, VA, released a report highlighting the kind of havoc the software can wreak. It documents a Zeus botnet that controlled nearly 75,000 computers in more than 2,400 organizations, including the drug producer Merck, the network equipment maker Juniper Networks, and the Hollywood studio Paramount Pictures. Over four weeks, the software was used to steal more than 68,000 log-in credentials, including thousands of Facebook log-ins and Yahoo e-mail log-ins.

Technology Review

Your Money or Your Data

In the summer of 2008, a particularly nasty piece of code started spreading among computers in Russia and Europe. Known as GPCode, the program was designed for a specific mission: infect the system, find more than 130 different file types on the hard drive, encrypt them and deleted the originals.

In essence, the program kidnapped a victim's data. And like any proficient kidnapper, the program left behind a note.

"Your files are encrypted with RSA-1024 algorithm," read a message on the screen. "To recover your files, you need to buy our decryptor."

YourSecurityResource.com

Conficker data highlights infected networks

Conficker may be under control, but the malicious family of programs is resident on more than 6.5 million computers worldwide, with more than 5 percent of some network's Internet addresses showing signs of infection.

On Wednesday, the ShadowServer Foundation took the wraps off a revamped statistics page, showing how far the three main variants of Conficker have spread and the degree to which the world's networks are infected. More than 12,000 networks, as represented by their autonomous system numbers (ASNs), show signs of infection by Conficker. The ShadowServer Foundation limited their displayed data to the top 500 networks.

SecurityFocus

Week in Review: UnsafeBits Blog at Technology Review

Here is a list of my posts on the UnsafeBits blog hosted by MIT's Technology Review for the week of August 17:

• Taking on Security with Beckstrom's Law
• Georgian Cyberattacks Traced to Russian Civilians
• Different Countries, Different Scams
• Antivirus' Multiengine Mess

Antivirus Protection Gets Social

People often rely on their circle of friends for support. Now one start-up company hopes to harness those social connections to create and deliver security software that will protect users from computer viruses and other digital threats.

On Wednesday, start-up Immunet announced its first product, Immunet Protect, a program that checks downloaded files against a directory of malicious software, such as viruses and Trojan horses. The company joins a handful of others in turning much of its detection capabilities into a service offered over the Internet, or the "cloud." Yet, the real difference, say its founders, is the software's ability to protect digital communities--those users connected together via social networks such as instant messaging, Facebook or Twitter.

Technology Review