Mozilla has released version 3.6.13 of its popular Firefox web browser.
This new version contains fixes for 11 security holes, nine of which have been given the worst rating of “critical” severity, as the vulnerabilities can be used to run malicious attack code and install software – the user has to do nothing to be hit in this way, just normal browsing is enough.
Fortunately Firefox contains an integrated update mechanism (Help / Check for Updates to kickstart the process) which can help ensure that most users are rapidly upgraded to the latest version.
However, don’t dawdle. Malicious hackers could try to exploit the vulnerabilities - described on Mozilla’s website – to infect your computer with malware.
Malicious hackers have spammed out an attack that pretends to be an email from Facebook support saying that your password has been changed.
The messages, which have a variety of subject lines including “Facebook Service. A new password is sent you”, “Facebook Support. Your password has been changed” and “Facebook Service. Your account is blocked”, have a ZIP file attached which carries a Trojan horse.
A spam is sent from your Facebook account.
Your password has been changed for safety.
Information regarding your account and a new password is attached to the letter.
Read this information thoroughly and change the password to complicated one.
Thank you for your attention,
Sophos products detect the attached ZIP file as Mal/BredoZp-B, and the Trojan horse contained within as Troj/Agent-PLG.
It’s possible that the attackers are attempting to exploit the problems many female Facebook users had this week when the social network disabled many accounts by accident.
Don’t forget – you should always be extremely suspicious of any unsolicited email which arrives out of the blue, encouraging you to open an attachment.
Last week we spoke about the Boonana cross-platform malware, using a malicious Java applet to deliver a cross-platform attack that attempts to download further malware to computers running Windows, Unix and Mac OS X.
Since then some we have seen variants of the original Boonana attack. The samples we have seen have been functionally the same, with the hackers behind them seemingly having obfuscated their code to try and waltz around detection.
Their attempts haven’t been good enough to get past Sophos’s products so far (including our new free anti-virus for Mac home users), and we haven’t had to update our generic detection method.
In the samples we have analysed to date, the attack specifically targets Windows and Mac OS X systems, and just happens to infect other platforms that run Java. Depending upon the flavour of Unix, it doesn’t usually complete its ‘life cycle’ if you’re not running Windows or Mac OS X systems.
Of course, we will update our detection of Troj/Boonana should we see new variants that require it.
In the meantime, watch this video I made last week demonstrating the original version of this attack on Windows, Mac OS X and Ubuntu:
Microsoft has warned users of all supported versions of the Internet Explorer browser that an unpatched vulnerability exists in the product that is being actively exploited by malicious hackers in targeted attacks.
The zero-day vulnerability, described in aMicrosoft’s security advisory, allows cybercriminals to execute code on remote users’ computers without their permission.
In other words, simply clicking on a link in an email could take you to a webpage which would silently install malicious code (such as a backdoor Trojan horse) onto your computer. In short, you could be one click away from having a hacker access your computer or comandeer it into being part of a botnet.
Sophos is adding detection of the malicious webapges as Mal/20103962-A, and the Trojan horse that we have seen being downloaded as Troj/GIFDldr-A.
According to Microsoft’s advisory, Data Execution Prevention (DEP) – which is enabled by default in Internet Explorer 8 on Windows XP SP3, Windows Vista SP1, Windows Vista SP2, and Windows 7 – helps to protect against the attacks.
All eyes will now be on Microsoft to see how quickly they can issue a fix for this vulnerability – it would certainly be impressive if they managed to roll-out a patch in time for next Tuesday’s “Patch Tuesday”, but that may be a little optimistic.
A new member of the Koobface family of malware has been making the headlines in the last 24 hours. The reason why the threat, which is sometimes being referred to as “Boonana”, has been getting so much attention is that it doesn’t just infect Windows, but targets Mac OS X and Linux computers too.
This incarnation of the Koobface worm appears to have been spread via Facebook in messages asking “is this you in this video”.
IMPORTANT! PLEASE READ. Hi <username>. Is this you in this video here : <link>
Clicking on the link takes you to an external website that displays an image of a woman (grabbed from the Hot Or Not website).
Visitors to the webpage who want to see more are prompted to give permission for an applet called JPhotoAlbum.class to be run from inside a Java Archive (JAR) called JNANA.TSA.
Whether you are running Windows, Mac OS X or Linux on your computer, if you give permission for the highly obfuscated Java app to run then the malware will sneakily download a variety of programs from the internet which it will then execute on your computer.
Files which can be downloaded include:
Sophos detects various components of the attack as Troj/KoobStrt-A, Troj/KoobInst-A, Troj/KoobCls-A, Troj/Agent-PDY, Troj/DwnLdr-IOX, and Troj/DwnLdr-IOY. In addition, Sophos’s web protection blocks access to the malicious webpages.
Don’t forget to always be careful about what links you click on, even if they appear to have been shared by someone you know on Facebook.
And if you’re a user of Linux or Mac OS X, don’t think that the malware problem only exists on Windows. Malicious hackers are becoming increasingly interested in targeting other platforms, and if users of your operating system have a reputation for being dismissive of malware warnings on your preferred OS, the bad guys may consider you a soft target.
Sophos has launched its first application for the Apple iPhone – designed to give you a better view of the security threats that are out there, with live hourly updates direct from SophosLabs.
The app, which also runs on the iPod Touch and the iPad, allows you to access Sophos information when you’re on the move or away from your desk, and includes the following supa-dupa features:
Threat Spotlight Experts from our labs detail some of the most interesting threats that they have analysed in the last week, explaining who is at risk, details of the attack and how to avoid becoming a victim.
Latest threats A dynamic list of the latest top ten threats analysed by the experts in SophosLabs, providing detailed information on their prevalence and a helpful link to further details on the Sophos website.
Stats Sexy graphs to bamboozle your boss with – showing in technicolour pie charts the latest stats for top email attachment malware attacks, spam and web-based threats.
Maps Now this is funky. Your iPhone will show you a world map, allowing you to view not just the latest email, spam and web attacks – but where they have been spotted around the world. You can even zoom in on particular countries, and view the subject lines of spams being sent around the globe.
Info Links to our blogs, our latest threat report, and loads of other good stuff.
So, what are you waiting for? Grab it from the Apple App Store now, or search for “Sophos” in the iTunes App Store.
We’re very interested in getting feedback as to what you think of this Sophos app. So please do leave us a rating and a review on iTunes, as it will help us decide if we should develop it further.
Also, if you have the time, why not quickly fill in the following survey to tell us what you’d like to see next from the Sophos Security Threat Monitor app?
Adobe has issued a security bulletin detailing critical vulnerabilities that have been discovered in the current versions of Adobe Flash Player for Windows, Macintosh, Solaris and Linux.
An update issued by Adobe claims to resolve 32 vulnerabilities in Flash Player – which if left unpatched could leave open a door for hackers to infect innocent users’ computers. Some of the security holes are already being exploited by malicious hackers.
Adobe is recommending that users upgrade to Adobe Flash Player 10.1.53.64.
If you’re not sure which version of the Adobe Flash Player you have installed, visit theAbout Flash Player page. Remember that if you use more than one browser on your computer you should check the version number on each.
Adobe further recommends that users of Adobe AIR version 18.104.22.16830 and earlier versions update to Adobe AIR 2.02.12610.
It is becoming more and more common for cybercriminals to exploit vulnerabilities in Adobe’s software – so it would be a very good idea for everyone to update vulnerable computers as soon as possible.
SophosLabs are intercepting a major new malicious spam campaign which is disguising itself as a greeting card from “someone who cares about you”.
The messages, which have been sent to email addresses around the globe, typically read similar to the following:
You have just received a postcard Greeting from someone who cares about you..
Please find zip file with your Greeting Card attached to this mail!
Thank you for using www.Greetings.com services !!!
Please take this opportunity to let your friends hear about us by sending them a postcard from our collection !
The messages come complete with an attached ZIP file (Greeting_Card.zip) which contains a malicious payload, designed to infect Windows computers.
A researcher has found a critical security flaw on Facebook that could be exploited by hackers to expose sensitive information about users.
M J Keith, a senior security analyst with security firm Alert Logic, discovered the vulnerability which could lead to private information being exposed, or users’ Facebook pages being maliciously defaced.
IDG security reporter Robert McMillan has explained the problem well:
The bug has to do with the way that Facebook checked to make sure that browsers connecting with the site were the ones they claimed to be. Facebook's servers use code called a "post_form_id" token to check that the browser trying to do something -- liking a group, for example -- was actually the browser that had logged into the account. Facebook's servers check this token before making any changes to the user's page, but Keith discovered that when he simply deleted the token from messages, he could change many settings on any Facebook account.
This is called a CSRF (Cross-site request forgery attack), which – if left unpatched – would allow hackers to set up malicious webpages that could submit instructions to the victim’s Facebook account without validation.
The consequence? Well, a hacker could make your hitherto private information public, or force your profile to “like” a Facebook group that you may find embarrassing.
M J Keith reports on AlertLogic’s website that he informed Facebook of the problem on the 11th of May, and that the problem has now been fixed.
However, IDG has reported that the security hole is still present.
Hopefully, if it’s not already patched, this privacy flaw – which comes at an embarrassing time for Facebook – will be removed soon.
If you’re a regular user of Facebook, you could do a lot worse than join the Sophos page on the site to ensure you are kept up-to-date with the latest security news. Oh, and remember to be careful about clicking on suspicious links..
By Graham Cluley, Sophos
A hacker called “ins3ct3d” has demonstrated that he can access the personal information of 168,000 users of public transport in The Netherlands via an insecure website.
A campaign to encourage residents living in the provinces of Gelderland, Overijssel and Flevoland to use public transport has been promoting a website called “Experience the OV” at www.ervaarhetov.nl, which allows people to request a card allowing them to try out public transport travel for free.
However, as magazine Webwereld reports, a simple SQL injection attack allowed “ins3ct3d” to access how to access the personal information of subscribers – including names, addresses, birth dates, email addresses and phone numbers.
The hacker, who has chosen to remain anonymous, demonstrated the attack to the magazine by accessing the personal data of one of Webwereld’s reporters.
Explaining his reason for exposing the security vulnerability, “ins3ct3d” explained that he felt compelled to warn his fellow citizens as long as the government continues to use unsafe systems. “This time it’s sensitive personal data, next time your fingerprints or EPD,” he said.
(EPD is the Electronische Patientdossier.. I guess I don’t need to give a translation of that for you to realise why that’s not data you want falling into the wrong hands).
There’s no confirmation that banking data was exposed, but there were fields in the databases for ID card numbers, payment agreements and so forth. At the request of Webwereld, the hacker did not retrieve more data, so there’s no telling if any of these fields had been filled.
Webwereld contacted the authorities, and the website is currently “temporarily unavailable”:
I guess we should all breath a sigh of relief that, in this instance, the hack appears to have orchestrated with the interests of exposing poor security, rather than stealing users’ data and identities. Hopefully this incident might play some smart part in raising awareness around the world of the need to ensure your website is coded securely, and not at risk of leaking sensitive information.
By Graham Cluley, Sophos