WhatsApp bug opened door to hacking

Fixed: A flaw in the Web version of WhatsApp made it possible for hackers to hide malicious code in seemingly innocent “vCards” containing contact information. — AFP

Fixed: A flaw in the Web version of WhatsApp made it possible for hackers to hide malicious code in seemingly innocent “vCards” containing contact information. — AFP

SAN FRANCISCO: WhatsApp recently patched a flaw that left 200 million users vulnerable to being hacked using booby-trapped digital cards for contact details, according to a US computer security firm.

Facebook-owned messaging application WhatsApp boasts more than 900 million users, some 200 million of them who access the service on computer browser software that mirrors activity from mobile devices.

A flaw in the Web version of WhatsApp made it possible for hackers to hide malicious code in seemingly innocent “vCards” containing contact information.

Opening tainted cards allowed viruses to infect computers, potentially allowing hackers to steal control or information, according to an online post by Check Point computer security firm.

Hackers would only need a target’s smartphone number and for the person to open the “vCard.”

Check Point said that it disclosed the vulnerability to WhatsApp last month and that an updated version of the application was released. — AFP

Source: The Star Online

Google Malaysia service disrupted by hackers

A computer user poses in front of a Google search page in this photo illustration taken in Brussels

A computer user poses in front of a Google search page in this photo illustration taken in Brussels, May 30, 2014. Reuters/Francois Lenoir

 

Internet users were denied access to Google Inc’s Malaysia website on Tuesday, and were redirected to a hacked page saying “Google Malaysia Hacked by Tiger-Mate #Bangladeshi Hacker.”

The company has reached out to the organization that manages the domain name to resolve the issue, MYNIC, a Google Malaysia spokesperson said in a statement to Reuters.

MYNIC is operated by the country’s ministry of communications and multimedia, and is the administrator for all websites ending with “.my,” according to the company’s website.

The website for Malaysia Airlines experienced a similar problem in January, but the airline quickly reassured users that their bookings and private data had not been compromised.

Source: Reuters

China shuts 50 websites and social media accounts

A picture illustration shows a WeChat app icon in Beijing, December 5, 2013. Credit: Reuters/Petar Kujundzic

A picture illustration shows a WeChat app icon in Beijing, December 5, 2013.
Credit: Reuters/Petar Kujundzic

China has closed 50 websites and social media accounts for violations ranging from pornography to “publishing political news without a permit”, Beijing’s cyberspace watchdog said on Tuesday.

The government is pursuing a crackdown on unwanted material online. Critics say the increasing restrictions further limit free speech in the one-party Communist state.

Authorities shut 17 public pages on the mobile social messaging app Weixin, also known as WeChat in English, as well as 24 websites and 9 channels or columns on websites, the Cyberspace Administration of China (CAC) said in a statement on its website (www.cac.gov.cn).

The Weixin accounts were shut down during the past two months, the state-run news agency Xinhua said.

Some of the other offences listed by CAC include publishing fake information under the guise of the government or media, and publishing information related to gambling or fraud.

Jiang Jun, a spokesman for the cyberspace watchdog, said the CAC would regularly publish a “black list” of violators, according to the statement.

Last fall, Xinhua said the cyberspace watchdog had closed nearly 1.8 million accounts on social networking and instant messaging services since launching an anti-pornography campaign earlier in the year.

In 2014, authorities received almost 11 million reports of what was described as harmful information online, Xinhua reported separately on Tuesday.

In November, Chinese officials called for controls on the Internet to preserve stability.

With a population of 1.4 billion and 632 million people online, China is a market no one wants to miss out on. But it also has the world’s most sophisticated online censorship system, known outside the country as the Great Firewall.

It blocks many social media services, such as Twitter, Facebook, YouTube, Instagram, Snapchat and Google, along with many rights groups sites and some foreign media agencies.

Source: Reuters

 

Banker Malware Targeting Malaysian Internet Banking User

MyCERT Alert

1.0 Introduction

MyCERT had received several reports regarding a malware that targets Malaysian Internet banking customers. Based on our initial analysis, we found this campaign uses the Zeus banking malware family as its Modus Operandi in this campaign.

Attacker will infect victim’s computers with Zeus banker malware which will inject modified fake contents or page while a user is browsing a legitimate online banking website.

2.0 Affected Systems

Based on our initial analysis of a sample incident, we found the below is the affected system:

2.1 Smartphone running on Android
2.2 Vulnerable and unpatched Windows Operating System

3.0 Impact

3.1 The malware will inject a modified fake contents that looks like a real online banking website when user is browsing a legitimate online banking website, in which the content will request victim’s smartphone operating system and mobile number.

3.2 The malware will SMS to the smartphone a malicious APK and infect the smart phone in order to establish callback with the attackers for further instructions.

4.0 Technical Details

Attacker will infect victim’s computers with Zeus banker malware which will inject modified contents when users is browsing a legitimate online banking website, as shown in the below sample image of the injected page.

mycert-636.jpg

The modified content will prompt user to choose their smartphone Operating System and provide their phone number as well. With the phone number information, attacker will send SMS containing link to a malicious APK known as Zitmo malware to the victim’s smartphone, purportedly to be a an online banking verification certificate.

Once the APK is installed in the smartphone, a popup message will appear and the Zitmo malware will attempt to make callback to attacker through SMS and wait for further instruction.

Few days later, attacker will login to victim’s online banking account using the stolen credentials and perform online transaction successfully by using intercepted TAC number.

The mobile malware has been discovered since late September 2010 but first time being used in malware campaign targeting Malaysian Online Banking users.

5.0 Recommendation

5.1 For laptop/PC User:

1) Install robust anti-virus, anti-spyware and firewall software on your computer and other devices and configure it to update regularly.

2) Perform regular scans of your systems for malware and other risks.

3) Operating system providers such as Microsoft, periodically releases updates and patches that improve the security of your operating system. You should periodically check for these updates and keep your system current or configure it to do so automatically.

4) When accessing to online banking, make sure there is no pop-up/window that requires personal info such as credit card number, smartphone platform(Android/iOS) etc. Do not enter those information if required.

5) Use only a dedicated computer or laptop to do online banking

6) If you suspect your bank account has been compromised or spot any activity you have not authorized, please notify your banking provider immediately.

7) Please ensure you logout properly at the end of each session by clicking log-out button. Do not exit by simply closing the browser window.

8) If you come across anything suspicious when you do banking online such as unusual web pages asking for banking information, notify your bank provider immediately.

9) Never respond to any email/advertisements requesting you to provide your login details or log in via a link sent in an email/applications. The bank will never send you a mail or provide links in any applications like that, and such a request is likely to be a phishing attempt.

5.2) For Smartphone Users:

1) Verify an app’s permission and the app’s author or publisher before installing it.

2) Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user’s information.

3) Since URL on mobile site appears differently from desktop browser, make sure to verify it first.

4) Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.

5) Don’t use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user’s smartphone/tablet.

6) Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.

7) Do not root or otherwise ‘Jailbreak’ your phone; avoid side loading
(installing from non-official sources) when you can. If you do install Android software from a source other than the Market, be sure that it is coming from a reputable source.

6.0 References

6.1. Kapersky report on Zitmo malware

6.2. ATSEngine

Source: CyberSecurity Malaysia

eBay Accounts Hacked, Users Encouraged To Change Passwords Right NOW!

ebay Hacked!Internet auction site eBay has left users of its services, including PayPal, with reason to be concerned after posting a message up on the community page urging users to change their passwords. Since the original message popped up a short while ago, the company has stepped out and clarified the situation, noting that a hacker may have “compromised a database containing encrypted passwords,” although was also keen to stipulate that only “non-financial data” had been affected.

It’s always concerning when a major company with hundreds of millions of accounts – particularly one with links to finances – reveals that it may have been hacked, and the way eBay dealt with a potential breach today leaves much to be desired. Instead of being clear from the onset, an empty message popped up on its community page insisting that users should change passwords, although the actual body of the post was non-existent.

Panic naturally ensued, with users worried that their PayPal accounts could have been cleaned out, but in actual fact, it does appear that the issue is relatively low-key. Nevertheless, there has been a breach, and so if you’re an eBay user, it’s definitely worth changing your password if only for peace of mind.

Thankfully, large-scale security issues seem to be getting fewer and farther between as companies look to beef up on security, but even with the robust measures in place, human-made software will always inherently be imperfect. But while eBay and its own PayPal service can probably sweep this one under the rug, let’s hope that any future outbreaks or security lapses are dealt with in a more efficient manner than we’ve seen today.

After all, having users panicking about their personal info and financial data is something that, you hope, a company like eBay would want to avoid at all costs, and even though we’re very much relieved that accounts haven’t been hacked en masse, the company will probably want to have a quiet word with its PR team.

So, to sum up, if you’re an eBay or PayPal user, go ahead and change your password as soon as you can. The likelihood of you being hacked seems mightily slim anyway, but just to be on the safe side, don’t make it easy for a chancing hacker.

Source: Redmond Pie

It is illegal to ride on another’s WiFi connection: MCMC

wifi-security

PETALING JAYA: It is illegal to hack to hitch a ride on another person’s WiFi connection, said the Malaysian Communications and Multimedia Commission.

Both the person using a WiFi hacking device and the supplier of such a device are liable under Sections 236 and 239 of the Malaysian Communication and Multimedia Commission Act 1998.

Section 236 states that a person who commits “fraud and related activity in connection with access devices” can upon conviction be liable to a fine not exceeding RM500,000 or to imprisonment for a term not exceeding five years or to both.

It also states that a person who produces, assembles, uses, imports, sells, supplies or lets for hire any hardware or software used to obtain unauthorised access to any network service, applications services or content applications service is committing an offence.

Source: The Star