This is not good - Trojanized Putty Client

From the article:

According to Symantec researchers, an unofficial version of the open-source Secure Shell (SSH) client PuTTY has been discovered in the wild which may compromise the privacy and safety of developers.

The Trojanized PuTTY version was first discovered in 2013, however the researchers believe scanner tests were being performed at this time due to low levels of distribution. However, the file is now being downloaded after users seek a download through Google and inadvertently pick a compromised third-party website to download the program rather than its official source.

The compromised website then redirects the user several times, ultimately connecting them to an IP address in the United Arab Emirates, according to Symantec. The altered version of PuTTY then is downloaded.

Use the link below for more details:

http://www.zdnet.com/article/trojanized-version-of-putty-client-discovered-online/

4 strategies that could prevent 85% of targeted high risk vulnerabilities (??)

This is something most sensible security guys always knew.

1. Application white-listing 
2. Patching applications: 
3. Patching operating system vulnerabilities:  
4. Restricting administrative privileges to operating systems and applications based on user duties: 

Check the following link for more details
http://h30499.www3.hp.com/t5/HP-Security-Products-Blog/Can-these-4-strategies-prevent-85-of-targeted-high-risk/ba-p/6744269

FREE - Virtualization Security Best Practice White Paper from CSA

The link below has the PDF




https://downloads.cloudsecurityalliance.org/whitepapers/Best_Practices_for%20_Mitigating_Risks_Virtual_Environments_April2015_4-1-15_GLM5.pdf

VENOM - Perfect Name for a BUG

Good news is that the patch would be available tomorrow
Bad news is that we won't know if it  would be applied immediately by our  cloud vendors


From the Article:

Affected platforms include Xen hypervisors, KVM, Oracle VM VirtualBox and the native QEMU client. Geffner estimates that these machines account for the majority of the virtual machine market, due to their widespread use by cloud computing services, infrastructure as a service providers and appliance vendors.

It's a stealthy back door into corporate networks that is hard to detect with current security technology, he said.

To add insult to injury, even if administrators have disabled the virtual floppy drive code -- because really, who uses floppy drives? -- another, totally unrelated bug, still allows that code to be accessed.



For more details follow the link below:
http://www.csoonline.com/article/2921589/application-security/significant-virtual-machine-vulnerability-has-been-hiding-in-floppy-disk-code-for-11-years.html

Starbucks App Hacked?

From the Article:

Those carrying out the attacks have taken advantage of a feature of the smartphone apps called "auto top-up" which automatically added a pre-defined amount of money to your card when it drops below a certain figure.

In one attack, reported by consumer journalist Bob Sullivan, an Orlando woman had her balance of $34.77 (£23.93) wiped off her account before it auto-updated with $25 and then again with a further $75 after the hackers changed the auto top-up amount

For more details follow the link below:

http://www.ibtimes.co.uk/starbucks-customer-accounts-hacked-through-smartphone-apps-1501118

Smart Guys - Created a Botnet that exploits default username /passwords

Are there drivers that do not know how to adjust their car mirrors or the seats ?

If there are (almost) none, how come we still have users that do not change the default passwords

The vendors could  force us  change the default password when we configure the system the first time but, they are not responsible for our security so, they don't care. (after all, even we don't seem to care)

From the article:

Incapsula discovered a botnet, still largely active, that primarily consists of routers manufactured by the California-based networking company Ubiquiti Networks. While the firm initially assumed the routers suffered from a shared firmware flaw, researchers were able to determine that all units are remotely accessible via HTTP and SSH on their default ports, and could also be accessed via vendor-provided default login credentials. 

The botnet scans for other routers that may have been misconfigured and executes shell scripts to access their SSH ports via default credentials.

“For perpetrators, this is like shooting fish in a barrel, which makes each of the scans that much more effective,” the firm said in a report released Tuesday,

Follow the link below for more details

https://threatpost.com/default-credentials-lead-to-massive-ddos-for-hire-botnet/112767

I am sure you won't like this - A cybersecurity company faked hacks and extorted clients to buy its services

I guess they had a simple three step strategy: 

1. Hack a company
2. Inform the company and force them to get their service.
3. If they don't listen , destroy them (I am not exaggerating)

After all Fear is the best sales tool (Governments use them regularly )



From the article:

In a federal court this week, Richard Wallace, a former investigator at cybersecurity company Tiversa, said the company routinely engaged in fraud -- and mafia-style shakedowns.

The results were disastrous for at least one company that stood up to Tiversa and refused to pay.

In 2010, Tiversa scammed LabMD, a cancer testing center in Atlanta, Wallace testified. Wallace said he tapped into LabMD's computers and pulled the medical records.

The cybersecurity firm then alerted LabMD it had been hacked. Tiversa offered it emergency "incident response" cybersecurity services. After the lab refused the offer, Tiversa threatened to tip off federal regulators about the "data breach."

When LabMD still refused, Tiversa let the Federal Trade Commission know about the "hack."

Follow the link below for more details:

http://money.cnn.com/2015/05/07/technology/tiversa-labmd-ftc/index.html