Nexus

Exploit WordPress: OptimizePress Theme - File Upload Vulnerability

Read

Read More Add comment

Sunday Reads - Life, Assam Violence, & Brand NaMo

Read

Read More Add comment

tutorial - List of OpenSource Performance Testing Tools

Read

Read More Add comment

Penetration Testing with BackTrack (Lab Guide)v3.0

Read

Read More Add comment

Hackers target Windows XP users with Internet Explorer attacks

Read

Read More Add comment

Android users targeted by over 99 percent of mobile malware

Read

More than 99 percent of new mobile malware is designed to target Google's Android operating system (OS), according to security firm F-Secure.

F-Secure reported that more than 99 percent of the 277 new mobile threat families it detected during the first quarter of the year were designed to infect Android devices, in itsMobile Threat Report Q1 2014.

The figure marked a spike in Android malware levels. F-Secure reported that 91 percent of detected mobile malware targeted Google's OS during Q1 2013. The increase was indicative of a wider year-on-year increase in mobile malware levels. F-Secure detected only 149 new mobile malware variants in Q1 2013.

Great Britain was the most targeted region during the quarter, with F-Secure reporting blocking an average of 15-20 malware files per 10,000 Android users. By comparison, F-Secure blocked an average of 5-10 malware files for every 10,000 users in the US, India and Germany.

F-Secure warned that Android malware is getting more sophisticated, revealing that it detected its first bootkit and crypto currency-mining mobile attacks during Q1 2014.

The crypto currency-mining malware is designed to hijack control of an infected Android device and force it to mine for virtual currencies, such as Litecoin and Bitcoin, without the user's knowledge.

The bootkit attack was highlighted as particularly dangerous as it affects the earliest stages of an Android device's bootup routine. The early stage of the attack process makes the malware more difficult to detect and remove.

Chief research officer at F-Secure Mikko Hypponen said he expects to see more evolved mobile malware variants appear in the near future.

"These developments give us signs as to the direction of malware authors," said Hypponen. "We'll very likely see more of these in the coming months. For example, mobile phones are getting more powerful, making it possible for cyber criminals to profit by using them to mine for crypto currencies."

Despite the discovery of the advanced attacks, the majority of the mobile malware detected during the period was fairly basic. F-Secure reported 83 percent of all mobile malware during the period was designed to force infected devices to send SMS messages to premium numbers or SMS-based subscription services.

F-Secure's findings mirror those of numerous other technology vendors. Telecoms giant Cisco reported that 99 percent of all detected mobile malware targeting its customers was designed to infect Android in January.

Read More Add comment

Serious security flaw in OAuth, OpenID discovered

Read

Following in the steps of the OpenSSL vulnerability Heartbleed, another major flaw has been found in popular open-source security software. This time, the holes have been found in the log-in tools OAuth and OpenID, used by many websites and tech titans including Google, Facebook, Microsoft, and LinkedIn, among others.

Wang Jing, a Ph.D. student at the Nanyang Technological University in Singapore, discovered that the serious vulnerability "Covert Redirect" flaw can masquerade as a log-in popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter.

For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication.

If a user chooses to authorize the log in, personal data (depending on what is being asked for) will be released to the attacker instead of to the legitimate website. This can range from email addresses, birth dates, contact lists, and possibly even control of the account.

Regardless of whether the victim chooses to authorize the app, he or she will then get redirected to a website of the attacker's choice, which could potentially further compromise the victim.

Wang says he has already contacted Facebook and has reported the flaw, but was told that the company "understood the risks associated with OAuth 2.0," and that "short of forcing every single application on the platform to use a whitelist," fixing this bug was "something that can't be accomplished in the short term."

Facebook isn't the only site affected. Wang says he has reported this to Google, LinkedIn, and Microsoft, which gave him various responses on how they would handle the matter.

A sample list of websites that are affected by the Covert Redirect vulnerability.

Google (which uses OpenID) told him that the problem was being tracked, while LinkedIn said that the company has published a blog on the matter. Microsoft, on the other hand, said an investigation had been done and that the vulnerability existed on the domain of a third party and not on its own sites.

"Patching this vulnerability is easier said than done. If all the third-party applications strictly adhere to using a whitelist, then there would be no room for attacks," said Wang.

"However, in the real world, a large number of third-party applications do not do this due to various reasons. This makes the systems based on OAuth 2.0 or OpenID highly vulnerable," he added.

LinkedIn engineer Shikha Sehgal wrote a blog post about the creation of a whitelist for the site more than a month before Wang published his findings.

"In order to make the LinkedIn platform even more secure, and so we can comply with the security specifications of OAuth 2, we are asking those of you who use OAuth 2 to register your application's redirect URLs with us by April 11, 2014," she said.

Sehgal did not explicitly say that the measure was in response to a flaw in OAuth 2, but the social network did confirm to CNET that the vulnerability that Wang detailed is the same one that inspired the blog post.

PayPal also has addressed the flaw.

"When PayPal implemented OAuth2.0/OpenID, we engineered additional security measures to protect our merchants and customers. These measures protect PayPal customers from this specific OAuth2.0/OpenID vulnerability," James Barrese, PayPal's CTO, said in a blog post on Friday. PayPal declined to add details about those measures.

Jeremiah Grossman, founder and interim CEO at WhiteHat Security, a website security firm, agreed with Wang's findings after looking at the data.

"While I can't be 100 percent certain, I could have sworn I've seen a report of a very similar if not identical vulnerability in OAuth. It would appear this issue is essentially a known WONTFIX," Grossman said.

"This is to say, it's not easy to fix, and any effective remedies would negatively impact the user experience. Just another example that Web security is fundamentally broken and the powers that be have little incentive to address the inherent flaws."

Further corroborating Wang's findings is Chris Wysopal, CTO at programming code verification firm Veracode.

Wsyopal told CNET that it looks to be a "very real issue" and that OAuth 2.0 looks vulnerable to phishing and redirect attacks.

"Given the trust users put in Facebook and other major OAuth providers I think it will be easy for attackers to trick people into giving some access to their personal information stored on those services," he said.

Users who wish to avoid any potential loss of data should be careful about clicking links that immediately ask you to log in to Facebook or Google. Closing the tab immediately should prevent any redirection attacks.

While this issue isn't as severe as Heartbleed, it's relatively easy to do so unless the flaw gets patched, which according to Wang, is quite difficult to implement due to third-party sites having "little incentive" to fix the problem. Cost is a factor, as well as the view that the host company (such as Facebook) bears the responsibility for making the attacks appear more credible.

Read More Add comment

200 PLUS WEBSITES HACKED BY ANONGHOST

Read

Read More Add comment

Get Rid of Loadyyz.com Pop-ups and Fix Chaos

Read

Read More Add comment