Google Chrome blocks access to Twitpic for Malware risk

Suddenly today Google Chrome start detecting Twitpic.com as malware threat. Twitpic is one of the most popular website for Sharing photos and videos on Twitter. Twitpic denies and said that there is no malware on the website and is trying to contact Google.

We also notice that, Twitter profiles and pages with Twitpic URL in tweets are also blocked curretly by Chrome. Many people also complaining about this on Google Help forum.

An official statement from Twitpic via tweet,"Working to fix the google chrome malware notice when visiting Twitpic.com as this is not true or the case, trying to contact google".

Google's Safe Browsing Diagnostic page for twitpic.com saying, "Site is listed as suspicious - visiting this web site may harm your computer. Of the 12029 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-30, and suspicious content was never found on this site within the past 90 days."

Also Google report said,"No, this site has not hosted malicious software over the past 90 days. In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message."

Source: THN

Samsung smart TV vulnerability allow attacker to read storage remotely

 ReVuln Ltd. , a small security company headed by Donato Ferrante and Luigi Auriemma, post a video that demonstrates that how attacks can gain root on the appliances.

Samsung smart vulnerability allow attacker to read storage remotely

Samsung Smart TV contain a vulnerability which allows remote attackers to swipe data from attached storage devices.

In this demonstration readers will see how it is possible to use a 0-day vulnerability to retrieve sensitive information, root access, and ultimately monitor and fully control the device remotely.

Auriemma said, “We have tested different Samsung televisions of the latest generations running the latest version of their firmware. Unfortunately we can't disclose additional information but we can only say that almost all the people having a Samsung TV at home or in their offices are affected by this vulnerability.".

Source: THN

100k IEEE site Plain-Text Passwords found on Public FTP

A Romanian researcher – Radu Drăgușin found that 100000 usernames and passwords of the Institute of Electrical and Electronics Engineers (IEEE) was stored in plaint-text on a publicly accessible FTP server.

According to him, on Sept. 18 he first discovered a log with usernames and passwords in plaintext, publicly available via IEEE’s FTP server for at least a month. He informed them of his find yesterday, and evidently the organization is addressing the issue.

On the FTP server, according Dragusin were the logfiles for the offers and ieee.org spectrum.ieee.org – Total data to approximately 376 million HTTP requests. Including 411,308 log entries with login and password in plain text.

Among the users who’s information was exposed are researchers at NASA, Stanford, IBM, Google, Apple, Oracle and Samsung. IEEE’s membership of over 340,000 is roughly half American (49.8 percent as of 2011).

“IEEE suffered a data breach which I discovered on September 18. For a few days I was uncertain what to do with the information and the data. Yesterday I let them know, and they fixed (at least partially) the problem. The usernames and passwords kept in plaintext were publicly available on their FTP server for at least one month prior to my discovery. Among the almost 100.000 compromised users are Apple, Google, IBM, Oracle and Samsung employees, as well as researchers from NASA, Stanford and many other places. I did not and will not make the raw data available to anyone else.” Message posted on researcher’s site.

Source: THN

Billions of Windows Users Affects with Java Vulnerability

Researchers at Security Explorations disclosed a new vulnerability in Java that could provide an attacker with control of a victim's computer. The researchers have confirmed that Java SE 5 – Update 22, Java SE 6 – Update 35, and Java SE 7 Update 7 running on fully patched Windows 7 32-bit operating systems are susceptible to the attack.

 

This Flaw allowing a malicious hackers to gain complete control of a victim’s machine through a rigged website. The affected web browsers are Safari 5.1.7, Opera 12.02, Chrome 21.0.1180.89, Firefox 15.0.1, and Internet Explorer 9.0.8112.16421.

Though Oracle released a fix for the most critical vulnerabilities reported by Security Explorations on August 30th, the security firm quickly found another flaw in that fix that would allow a hacker to bypass the patch. That bug in Oracle’s patch still hasn’t been patched, leaving users vulnerable to both the new flaw and the previous attack.

SOURCE: THN

Wiper, the Destructive Malware possibly connected to Stuxnet and Duqu

Kaspersky Lab publishes research resulting from the digital forensic analysis of the hard disk images obtained from the machines attacked by the Wiper – a destructive malware program attacking computer systems related to oil facilities in Western Asia.
Security researchers from Kaspersky Lab have uncovered information suggesting a possible link between the mysterious malware that attacked Iranian oil ministry computers in April and the Stuxnet and Duqu cyber espionage threats.
The malware wipes data from hard drives, placing high priority on those with a .pnf extension, which are the type of files Stuxnet and Duqu used, and has other behavioral similarities, according to Schouwenberg.
It also deletes all traces of itself. As a result, researchers have not been able to get a sample, but they’ve reviewed  mirror images left on hard drives. Kaspersky’s researchers were not able to find the mysterious malware, which was given the name Wiper, because very little data from the affected hard disk drives was recoverable.

Even though a connection to Flame is unlikely, there is some evidence suggesting that Wiper might be related to Stuxnet or Duqu.For example, on a few of the hard drives analyzed, the researchers found traces of a service called RAHDAUD64 that  loaded files named ~DFXX.tmp where XX are two random digits from the C:\WINDOWS\TEMP folder.
No one has ever found a sample of Wiper in order to study its code and determine exactly what it did to machines in Iran. According to Kaspersky, the malware’s algorithm is “designed to quickly destroy as many files as effectively as possible, which can include multiple gigabytes at a time.”
Although Flame can be updated by its creators with various modules, including conceivably a module that would destroy data,  there has never been any evidence found that Flame had a module that was used to destroy data on machines or wipe out hard drives.
Source: NETASQ