"Your friend added a new photo with you to the album" spam leads to malware

Posted by EHN Reporter on Wednesday, August 29, 2012 |

1

Spam mails which disguised as Facebook notification informs users that a friend has added a new photo with you to the album, intercepted by Sophos

The mail is designed such that it will look similar to the original Facebook notification and are titled "Your friend added a new photo with you to the album"

“One of Your Friends added a new photo with you to the album. You are receiving this email because you've been listed as a close friend. View photo with you in the attachment,” the messages read.

The attached ZIP file contains malware, designed to allow hackers to gain control over your Windows computer. The malware is detected as Troj/Agent-XNN by Sophos products.

"But there are surely many people who could be duped into believing that they have been tagged by one of their friends in a photograph, and want to see if they look overweight, unattractive or simply fabulous (delete as applicable)." Sophos experts says

SHORT CUT KEYS IN GMAIL

Today i "accidentally' discovered the set of shortcut keys in Gmail by pressing Shift+ ?
hereis the link for it
http://mail.google.com/mail/?kbd=1

check it out
is it attack from all directions?
http://www.ehackingnews.com/2012/08/bangladeshi-hackers-warns-indian-hackers.html

Bangladeshi Hackers warn Indian Hackers

Posted by EHN Reporter on Monday, August 27, 2012 |

Hackers from the 3xp1r3 Cyber Army are once again threatening Indian hackers, urging them to stop attacking websites from Bangladesh.

“Dear, Indian Hackers We are like storm which is brewing & our shadow like thunder in the distance. No one knows that how capable we are. So, don't do anything more than you are capable of, you will probably be unhappy if we stand against. Don’t Hack Bangladeshi websites again (sic),” Softpedia quoted as hackers saying.

“Don’t worry! Storm is not started yet; just wind blows slowly with a flash of light. Take it as a precaution of a destructive storm.So, guys think twice before facing a storm by crossing the limit otherwise you might be cried.”

They conclude by revealing the fact that their message will also be posted on a number of Indian website they’re about to hack.

Latest Mobile Apps...ooh so Coooooool. Lets try this out first before anyone else doesit...and the next moment you are hacked...your privacy gone.BEWARE AND BE AWARE

CHECK THIS LINK
http://www.dailymail.co.uk/sciencetech/article-2192554/Privacy-concerns-scary-site-publishes-twitter-users-home-addresses.html

Privacy alert over 'scary' site which publishes home addresses of Twitter users from around the world

• Controversial site claims it is alerting users to the security risks of Twitter
• Privacy experts warn of increasing number of mobile phone apps that reveal your locations

By Mark Prigg
PUBLISHED: 14:54 GMT, 23 August 2012 | UPDATED: 06:40 GMT, 24 August 2012

• Comments (43)
• Share

A controversial web site that publishes twitter users home addresses online has come under fire from security experts.
The site uses location information it says many people unwittingly transmit every time they send a tweet.
It then matches this to their home address, even providing a Google Street View image of their home in some cases.

weKnowYourHouse.com checks for users who have included the work home in a tweet and have transmitted their location. It then displays their address, and even a picture

HOW IT WORKS

Many mobile phone twitter apps can transmit a user's location.
The site looks for this location in any tweet containing the word 'home'.
When it finds a match, it uses Google Maps to match the location with an address.
After removing the most sensitive parts of the address, it it published on the web site

The creators of WeKnowYourHouse.com say they are providing a service by alerting users to the location feature.
They describe the site as 'an experiment'.
they also claim similar privacy issues exist with other services such as FourSquare and Google's Latitude.
'Our advice is don't check in at your own home, whether using Twitter with locations, Foursquare, Google Latitude, or any other location-aware service, because you're telling the world exactly where you live,' the team say on the site.
'This website simply takes that, runs it through a geocoder to turn it into a human readable address, and links it with Google Street View.'
The team even boast of how simple the site was to set up.
'The code is not particularly complicated either, and is done completely automatically.'
The site says it deletes user's data after an hour, and also offers user an option to opt out of the site.

The site displays a constantly rolling list of usernames and addresses, with full details removed to retain some privacy for users.

Security experts have described the site as 'scary'.
'The site promises that it only keeps the last hour of data, and then fully deletes it, but it's scary to see how much information can be compiled against someone so quickly, using information that is freely available,' said Anna Brading of security firm Sophos.

The site also explains how to switch off location capabilities in twitter software on mobile phones.

The site's creators say it was built as a warning to users.
'The idea is simple: many people tweet about being at home, and some even attach their location to it.
'This is represented as the latitude and longitude, and is completely open for any website or application to access.'
Nick Pickles, director of privacy campaign group Big Brother Watch, believes the site could actually help users by drawing attention to the location information.
'The simple truth is that mobile phones are tracking devices that let us make calls,' he said.
'Many people are sharing their location with a whole range of services without realising just how seriously they are compromising their privacy.
'As this website shows, the number of people who share information that could identify where they live continues to be a major cause for concern and it’s a very useful tool to highlight just how big a problem this is.
'It further highlights the need for much stronger regulation of what happens with our personal information, particularly geolocation data.'
He also called on technology firms such as Google, Apple and Twitter to be more open about their capabilities and help educate users.
'Equally, the organisations involved need to do much more to educate consumers about what data is being shared and how they can take control of it.'

Mobile phone user's could be accidentally revealing their home address when they tweet, a controversial website that publishes twitter user's location online claims.

Mr Pickles fear that as firms begin to harness the potential of using mobile phone user's location data to target them with adverts, the problem could get much worse.
'However, when profit from targeted advertisements relies on using location data, consumers are seeing the perils of companies putting profit before privacy.'
Twitter initially suspended the @WeKnowYourHouse account earlier this week, temporarily cutting off its access to tweets.
However, the account appeared to have been reinstated today, and the site was working normally.
Twitter did not respond to requests from MailOnline to clarify its position.

Read more: http://www.dailymail.co.uk/sciencetech/article-2192554/Privacy-concerns-scary-site-publishes-twitter-users-home-addresses.html#ixzz24aFOjNl1

Is "Flame"Extinguished....

This allays the same fear of "IS Stuxnet and Flame  Dead" ....even after the so called :Kill Code" generated and given  a go ahead. check out the li\nk of FOX .

is-government-helping-cyber-crooks/
As the U.S. government defends our interests and technology in the escalating global cyberwar, could it inadvertently be handing cyberweapons to criminals?
Last week, security firm Kaspersky hinted that such a nightmare situation may have taken one step closer to reality. Kaspersky revealed that a sophisticated program had been used to record instant messaging and social networking logins and bank account information and passwords -- including targets such as Citibank and PayPal accounts -- on some 2,500 infected PCs.
It may have been based on the Stuxnet cyberweapon widely attributed to the U.S.
This program, dubbed Gauss, raised alarms for its financial focus: Rather than trying to disrupt nuclear lab equipment or steal cruise missile plans it seemed devised for monetary gain, the very goal of cybercriminals worldwide.
"There's no doubt in our mind that the authors [of Gauss] needed to have access to that [Stuxnet] source code to create this malware," Roel Schouwenberg, senior researcher at Kaspersky Lab, told FoxNews.com. "Therefore, we're convinced this is coming from the same factory which created Stuxnet."
"The only alternative is that the source code has been leaked or stolen, which is an extremely scary scenario."

'We're convinced this is from the same factory which created Stuxnet. The only alternative is an extremely scary scenario.'

- Roel Schouwenberg, senior researcher at Kaspersky Lab

Millions of dollars were invested in viruses like Stuxnet, which was designed by the United States and Israel, according to The New York Times, to infiltrate and then disrupt Iran's nuclear program. If that cutting-edge, expensive software fell into the wrong hands, and hackers were able to reverse engineer the program, then banks, brokerages, and businesses all over the planet could be vulnerable.
Unfortunately, once a program like Stuxnet or its derivative Flame is released on the Web, it is then "in the wild," meaning that a determined crook -- or other espionage agency -- could get his hands on it and turn it into his own weapon of choice.
Contrast this situation to the days of the Cold War, when a foreign power would have to physically steal a fighter jet, James Bond-style, to uncover an enemy's secret technology. Today, simply releasing a spy program on the Net could mean that one is essentially handing over the blueprints to your country's latest cyberstealth technology.
That possibility is "scary" because of the level of sophistication of this espionage software. For example, Flame can not only record every keystroke on a computer but also grab screen images and turn on a microphone, eavesdropping on conversations in the room or during an online call.
Programs like Flame are also difficult to trace and difficult to detect because they contain multiple self-destruct mechanisms like a modern-day "Mission Impossible" tape recording. There's also the challenge of determining exactly who created it or what information the program is seeking because portions of the software are encrypted to such a degree that Kaspersky Lab has been unable to crack it.
"Malware overall is an arms race," noted Michael Sutton, vice president of security research at Zscaler, pointing out that the techniques used by Flame and other programs "will certainly be studied and adapted by other malware authors that may well be involved in cybercrime."
The extreme efforts taken by the software to conceal Gauss' source mean it's difficult to say who's responsible -- cybercrooks or cyberspies -- but this very feature also is a potential silver lining: If security researchers can't crack its encryption, then it's unlikely that any hackers can copy the software. (Kaspersky is now petitioning other researchers to help it crack Gauss.)
There is at least one reason to think that Gauss is the work of government espionage and not crooks looking to skim millions from bank accounts. Most of the infected computers -- but by no means all -- were in the Middle East and most of the targeted banks were in Lebanon. Some of those banks have been accused of laundering money for drug smugglers and terrorists.
Whoever developed the software may have simply been looking for terrorists, following Deep Throat's advice to "Follow the money."
Terrorist networks tend to trade information via SMS and funnel money through online banks. Tracing the flow of money could lead a government to a terrorist's physical location and reveal networks of operatives.
Unfortunately, the malware genie may already be out of the bottle. It's been demonstrated time and again that just about any encryption scheme can be broken -- given the proper amount of effort and computing resources. So it may only be a matter of time until criminals -- or other governments -- have their hands on espionage-grade software.
If they don't already.


Read more: http://www.foxnews.com/tech/2012/08/21/is-government-helping-cyber-crooks/#ixzz24U0LaHga

Be Careful while replying to innocent surveys...they may be gathering information

How To Defeat Social Engineering Attacks

By Grant Taylor, VP, Cryptzone Europe, CRN August 14, 2012 The online world is full of tricksters and fraud—and the threat to businesses is great. Employees can easily be lured into what seems to be a trusting relationship, which is actually a social engineering scam. Cryptzone's Taylor offers tips on safeguarding your firm from harm.—Jennifer Bosavage, editor Social engineering attack-driven threats have gone through the roof in direct response to the surge in the take-up of social networking sites and services, especially within the last two years. While most stories have been associated with private individuals being conned into parting with bank details, usernames and passwords, the threat is just as real for businesses and public bodies — although understandably less well publicized when an attack is successful.
Related: How To Build More Secure, Flexible Networks
One of the more extreme incidents reported last year, was when the manager of a Belgian supermarket agreed to meet a new Facebook friend. It led to him being gagged and blindfolded and forced to hand over the keys to his apartment. One of the attackers subsequently found the keys to the supermarket and proceeded to empty the vault.
Few attacks are so dramatic – if they were, more people would pay attention to the security training they are given. However, the incident demonstrates social engineering primarily exploits human weaknesses. This makes them almost impossible to prevent using purely technical controls. As security professionals we need to help our customers to implement security awareness campaigns that comprise more than a list of dos and don’ts, and how to use the IT security tools we sell them, as if this is a panacea to resolving all their security problems. As the UK Information Security Breaches Survey Results 2012 from PwC indicated, “the root cause of data breaches is often a failure to invest in educating staff about security risks.” We therefore need to be sharing creative ways to communicate IT security risks and in particular ensure employees have sufficient knowledge to thwart social engineering tactics. Many users simply don’t understand the value of the information they are tempted to share, especially when perhaps they provide just one piece of the information jigsaw.
Here are six simple lessons for customers to communicate to their employees the over-arching message: "Could any of the information I am making known damage the organization I work for?" followed by my tips to ensure this message is retained and acted upon.
6 Simple Lessons for Employees (they are simple but easily forgotten)
Telephone: If someone calls in and asks for information, don’t presume they have a right to know. Verify who is calling and why they need the information. Persistent questioning displays a level of security consciousness that will put off some social engineers, who seek to catch people off guard.
On-line chat: Using informal communications tools often creates the appearance of a closer relationship than actually exists. Don’t be fooled into sharing information with a so-called friend.
In person: Don’t let people you don’t know follow you into the building, even if it makes you look a bit silly. Politely challenge people you don’t know and don’t be intimidated by any protestation. You will be forgiven if they turn out to be the CEO!
Shoulder-surfing: Just as when you enter your bank pin at the cash machine, always assume the person behind you may be looking at your screen. Be aware of what you are displaying within the office environment, but especially when in public places.
Email: If you don't know who the sender is and the topic is not relevant, immediately delete the email to prevent the download of malware to your computer. Never click a link in a suspicious email or respond to requests to enter account information for verification.
Paper: Don’t leave sensitive information lying around and ideally only print sensitive information if you can retrieve it immediately from the printer. If your print out is not there, don’t just print another, be suspicious. If you are discarding confidential records, sensitive memos or reports, make sure they are shredded rather than leaving them in the garbage.
Helping the message sink in 1. Ensure your customers’ procedures and guidelines are in clear language, well communicated and easily accessible when people need to reference them.
2. Suggest customers use multi-sensory techniques, including posters, videos, PA system or role play, to get their message across.
3. Encourage organizations to reinforce policies and procedures with regular security reminders. They should try to make them entertaining, so they are more memorable.
4. Get customers to consider introducing testing, either for all or a proportion of users. They will be able to identify weaknesses, and therefore focus training energies to the necessary areas.
5. Occasionally offer customers a trial social attack. They can reward those who stop it, you can review and correct any security lapses.
Your customers’ environment can never be 100 percent protected from a social engineering attack, but the more informed employees are, the less opportunity will be available to a would-be social engineer for a successful attack.

https://www.facebook.com/cyberoxen

"Cusiosity" Targetted????

Well, this is actually scary. The annonymous group targetting "Curiosity". Means that its never going to hurt to be careful and paranoid for safety in cyber world. Checkout more  at http://www.gmanetwork.com/news/story/269564/scitech/technology/anonymous-hackers-may-be-targeting-mars-rover-says-security-firm