News

• Researchers propose TLS extension to detect rogue SSL certificates

  A pair of security researchers have proposed an extension to the Transport Layer Security (TLS) protocol that would allow browsers to detect and block fraudulently-issued SSL certificates.

• Cross-browser worm spreads via Facebook, security experts warn

  Malware writers have used Crossrider, a cross-browser extension development framework, to build a click-fraud worm that spreads on Facebook, security researchers from antivirus firm Kaspersky Lab said on Monday.

• Microsoft: Win8 simplifies, improves parental monitoring of kids computer activities

  Microsoft has designed Windows 8 to make parental monitoring and control of children's computer activities simpler and more effective, the company said on Monday.

• Police-themed ransomware starts targeting US and Canadian users

  A ransomware application that locks computers and asks their owners to pay fines for allegedly violating several laws through their online activity is targeting U.S. and Canadian users, malware experts from security firm Trend Micro said on Wednesday.

• Financial malware tricks users with claims of free credit card fraud insurance

  A piece of financial malware called Tatanga attempts to trick online banking users into authorizing rogue money transfers from their accounts as part of the activation procedure for a free credit-card fraud insurance service purportedly provided by their banks, security researchers from Trusteer said Tuesday.Tatanga is an online banking Trojan horse that was first discovered in May 2011. It is able to inject rogue Web pages into browsing sessions and affects nine different browsers, including Internet Explorer, Mozilla Firefox, Google Chrome, Opera and Safari.The malware is known to use social engineering techniques against victims in order to bypass security measures enforced by banks, like one-time passwords (OTPs) or transaction authorization numbers (TANs).A new Tatanga configuration detected recently by Trusteer displays a rogue message inside the browser when the victim authenticates on their bank's website, claiming that their bank is offering free credit-card fraud insurance to all customers.The message claims that the new service is provided in partnership with Visa and MasterCard and covers losses that might result from fraudulent online transactions performed with the victim's credit or debit card. The malware grabs the user's real account balance, rounds it up, and presents the result as the allegedly insured sum.The rogue message includes a bank account number that's supposed to be the victim's new insurance account opened by the bank. However, in reality, this account belongs to a money mule -- an individual paid to receive money from fraudulent activity on behalf of cybercriminals -- said Ayelet Heyman, a security researcher at Trusteer, in a blog post Tuesday.The user is told that to activate the service they need to authorize a transaction from their bank account to their new insurance account. In order to do this, they need to input the transaction authorization code sent by their bank to their mobile phone number.This code allows the malware to finalize the rogue transfer in the background and send the victim's money to the money mule. "In all likelihood, the victim does not expect any funds will be transferred out of their account," Heyman said.The maximum sum that is transferred by the malware in a single transaction is €5,000 or about US$6,500. "We can assume that fraudsters have identified this amount (5,000 Euros) as the upper threshold that triggers the bank to address the transaction as high risk," Heyman said via email.The rogue message displayed by the Tatanga configuration analyzed by Trusteer is written in Spanish, which suggests that it targets users in Spain or other Spanish-speaking countries. The company hasn't seen a version of this attack in a different language yet, but the malware is known to have targeted users in other European countries and the U.S. in the past, Heyman said via email.The Trusteer researcher advises users to call their banks over the phone and check the validity of sudden announcements or requests that appear on banking websites. If an online banking website suddenly starts asking users for sensitive information like card security codes or PIN numbers, it's most likely because of a malware infection, he said via email.Users should also install the security software recommended or supplied by their financial institution and should use some type of browser-based security solution that prevents financial fraud, Heyman said.

• Hackers blackmail Belgian bank with threats to publish customer data

  Hackers claimed to have breached the systems of the Belgian credit provider Elantis and threatened to publish confidential customer information if the bank does not pay €150,000 (US$197,000) before Friday, May 4, they said in a statement posted to Pastebin. Elantis confirmed the data breach on Thursday, but the bank said it will not give in to extortion threats.

• Dutch court temporarily frees 17-year-old KPN hacking suspect

  A Dutch 17-year-old suspected of compromising customer account data on hundreds of servers belonging to telecommunications operator KPN is set to be freed temporarily on Thursday, allowed to wait at home for his criminal proceedings to begin, the Dutch Public Prosecution Service said on Wednesday.

• Most of the Internet's top 200,000 HTTPS websites are insecure, Trustworthy Internet Movement says

  Ninety percent of the Internet's top 200,000 HTTPS-enabled websites are vulnerable to known types of SSL (Secure Sockets Layer) attack, according to a report released Thursday by the Trustworthy Internet Movement (TIM), a nonprofit organization dedicated to solving Internet security, privacy and reliability problems.

• Russian-speaking cybercriminals earned $4.5 billion in 2011, researchers estimate

  Russian-speaking hackers earned an estimated US$4.5 billion globally using various online criminal tactics and are thus responsible for 36 percent of the estimated total of $12.5 billion earned globally by cybercriminals in 2011, Russian security analyst firm Group-IB said in a report published on Tuesday.

• WordPress security update patches external libraries, several vulnerabilities

  The WordPress development team released WordPress 3.3.2 on Friday in order to address several vulnerabilities in the popular blogging platform as well as in three external libraries that are bundled with it by default.

• Twitter spam campaign infects users with fake antivirus programs

  A large spam campaign observed on Twitter during the last couple of days directed users to malicious websites that exploited vulnerabilities in browser plug-ins to infect their computers with rogue antivirus programs, according to security researchers from antivirus firm Kaspersky Lab.

• Upcoming Firefox click-to-play feature will stop automated plug-in exploits

  Mozilla developers are working on a new Firefox feature that will block the automated display of plug-in-based content like Flash videos, Java applets or PDF files, and will protect users from attacks that exploit vulnerabilities in browser plug-ins to install malware on their computers.

• Trend Micro unearths more links between China and hacker group

  Security vendor Trend Micro has been tracking a hacking campaign called Luckycat that has been linked to 90 attacks, including some aimed at Tibetan activists, and has tied it to a group based in China, the company said in a new report.

• Java-based Web attack installs hard-to-detect malware in RAM

  A hard-to-detect piece of malware that doesn't create any files on the affected systems was dropped onto the computers of visitors to popular news sites in Russia in a drive-by download attack, according to security researchers from antivirus firm Kaspersky Lab.

• Few tech issues will move in Congress for the rest of the year

  As the U.S. Congress begins to gear up for November's elections, several technology-related issues remain unresolved. Lawmakers have pushed in recent months for new cybersecurity legislation, online copyright enforcement provisions, new online privacy protections and an Internet sales tax, but progress will get tougher in the coming months.