Pandemiya - New Trojan, New Code, Novel Technique

"This malicious code writer has chosen to use quite a novel technique for injecting its malicious code into every new process in the victim's computer," 

As a part of that injection mechanism, the malware assures its persistence on a system by checking to ensure that Explorer.exe is injected with its code each time a new process is initiated.

The link below has more information:-

http://www.darkreading.com/new-commercialized-trojan-takes-fresh-approach-to-password-stealing/d/d-id/1269550

Two 9th grade kids hack ATM - What is strange about it - They used the operator's Manual

Apparently, even the password was not changed from the default one.

(From the article)

Matthew Hewlett and Caleb Turon, both Grade 9 students, found an old ATM operators manual online that showed how to get into the machine's operator mode. 

Hewlett and Turon were even more shocked when their first random guess at the six-digit password worked. They used a common default password.

The link below has more information:-

http://www.winnipegsun.com/2014/06/08/code-crackers--charleswood-teens-hack-into-grant-avenue-atm

iOS8 - Randomizing Mac addresses

Is it for privacy reason or is Apple expecting everyone to buy this information from them, instead of collecting it free.


When iOS 8 devices look for a connection, they randomize that address, effectively disguising any trace of the real device until it decides to connect to a network.

The link below has more information:-
http://www.theverge.com/2014/6/9/5792970/ios-8-strikes-an-unexpected-blow-against-location-tracking

Google Mail - end-to-end encryption available for Chrome.

Nice to have another additional layer of security

(from the article)

Google is now offering a plug-in called End-to-End for the Chrome browser -- in alpha test -- that lets users encrypt their web email messages.

The new End-to-End Chrome extension encrypts, decrypts, digitally signs, and verifies signed messages within the browser using OpenPGP. 

Both the sender and the recipient would need to be using OpenPGP, says Alex McGeorge, a senior security researcher for Immunity Inc. "You still have to go through the whole process of exchanging keys,"

"Once we feel that the extension is ready for primetime, we'll make it available in the Chrome Web Store,

Just how secure the extension will be also is unclear, McGeorge says. "JavaScript and crypto have typically been incompatible. A lot has to do with getting good randomness. That is super important for PGP."

The link below has more information:-

http://www.darkreading.com/endpoint/privacy/google-adds-chrome-encryption-option-for-webmail/d/d-id/1269434

5 QUESTIONS EVERY CEO SHOULD ASK THEIR CIO / CISO

Nothing hi-tech here, just a few important common sense questions

(from the article)

1. Can we identify unusual user or network activity to cloud services?

2. Can we track who accesses what cloud-hosted data and when?

3. How are we protecting against insider attacks at the cloud service providers?

4. How do we know unprotected sensitive data is not leaving the corporate network?

5. Can we reduce surface area of attack by limiting access based on device and geography?

The link below has more information:-

https://blog.cloudsecurityalliance.org/2014/06/05/dont-get-snowdened-5-questions-every-ceo-should-ask-their-cio-ciso/

VIPER - To Manage and Explore Malware Samples

According to the article:-

Viper is "a framework to store, classify and investigate binary files." This project is an improvement on another tool called VxCage.Viper is lightweight (due its usage of SQLite),

Viper project is maintained by Claudio Guarnieri (@botherder), Kevin Breen (@KevTheHermit) and Mariano Graziano (@emd3l). This tool is included in the latest version of REMnux. To take full advantage of the latest features of Viper, update the version of the tool included with REMnux using the instructions below. Some of the features available in the updated version of Viper are:

• The introduction of projects
• Additional processing and reporting modules
• Multiple fixes (see Github history for more info

The link below has more information:-

http://digital-forensics.sans.org/blog/2014/06/04/managing-and-exploring-malware-samples-with-viper

Android/Simplocker - Ransomware that encrypts your files till you pay $21.40

Something that we will need to get used to and the solution is simple , MAKE BACKUPS.

According to the article:-

“Android/Simplocker.A will scan the SD card for files with any of the following image, document or video extensions: jpeg, jpg, png, bmp, gif, pdf, doc, docx, txt, avi, mkv, 3gp, mp4 and encrypt them using AES [the Advanced Encryption Standard],” 

The malware will then display a ransom message in Russian asking for a payment of 260 Ukrainian Hryvnia (around US$21.40) to be made through a service called MoneX

The new threat masquerades as an application called “Sex xionix,” but it wasn’t found on Google Play and its distribution so far is most likely low.

Another interesting aspect of Simplock.A is that it uses a .onion command-and-control (C&C) domain address. The .onion pseudo-top-level domain is only used inside the Tor anonymity network for accessing so-called hidden services.

The link below has more information:- 

http://www.pcworld.com/article/2360460/trojan-app-encrypts-files-on-android-devices-and-asks-for-ransom.html