China shuts 50 websites and social media accounts

A picture illustration shows a WeChat app icon in Beijing, December 5, 2013. Credit: Reuters/Petar Kujundzic

A picture illustration shows a WeChat app icon in Beijing, December 5, 2013.
Credit: Reuters/Petar Kujundzic

China has closed 50 websites and social media accounts for violations ranging from pornography to “publishing political news without a permit”, Beijing’s cyberspace watchdog said on Tuesday.

The government is pursuing a crackdown on unwanted material online. Critics say the increasing restrictions further limit free speech in the one-party Communist state.

Authorities shut 17 public pages on the mobile social messaging app Weixin, also known as WeChat in English, as well as 24 websites and 9 channels or columns on websites, the Cyberspace Administration of China (CAC) said in a statement on its website (www.cac.gov.cn).

The Weixin accounts were shut down during the past two months, the state-run news agency Xinhua said.

Some of the other offences listed by CAC include publishing fake information under the guise of the government or media, and publishing information related to gambling or fraud.

Jiang Jun, a spokesman for the cyberspace watchdog, said the CAC would regularly publish a “black list” of violators, according to the statement.

Last fall, Xinhua said the cyberspace watchdog had closed nearly 1.8 million accounts on social networking and instant messaging services since launching an anti-pornography campaign earlier in the year.

In 2014, authorities received almost 11 million reports of what was described as harmful information online, Xinhua reported separately on Tuesday.

In November, Chinese officials called for controls on the Internet to preserve stability.

With a population of 1.4 billion and 632 million people online, China is a market no one wants to miss out on. But it also has the world’s most sophisticated online censorship system, known outside the country as the Great Firewall.

It blocks many social media services, such as Twitter, Facebook, YouTube, Instagram, Snapchat and Google, along with many rights groups sites and some foreign media agencies.

Source: Reuters

 

Banker Malware Targeting Malaysian Internet Banking User

MyCERT Alert

1.0 Introduction

MyCERT had received several reports regarding a malware that targets Malaysian Internet banking customers. Based on our initial analysis, we found this campaign uses the Zeus banking malware family as its Modus Operandi in this campaign.

Attacker will infect victim’s computers with Zeus banker malware which will inject modified fake contents or page while a user is browsing a legitimate online banking website.

2.0 Affected Systems

Based on our initial analysis of a sample incident, we found the below is the affected system:

2.1 Smartphone running on Android
2.2 Vulnerable and unpatched Windows Operating System

3.0 Impact

3.1 The malware will inject a modified fake contents that looks like a real online banking website when user is browsing a legitimate online banking website, in which the content will request victim’s smartphone operating system and mobile number.

3.2 The malware will SMS to the smartphone a malicious APK and infect the smart phone in order to establish callback with the attackers for further instructions.

4.0 Technical Details

Attacker will infect victim’s computers with Zeus banker malware which will inject modified contents when users is browsing a legitimate online banking website, as shown in the below sample image of the injected page.

mycert-636.jpg

The modified content will prompt user to choose their smartphone Operating System and provide their phone number as well. With the phone number information, attacker will send SMS containing link to a malicious APK known as Zitmo malware to the victim’s smartphone, purportedly to be a an online banking verification certificate.

Once the APK is installed in the smartphone, a popup message will appear and the Zitmo malware will attempt to make callback to attacker through SMS and wait for further instruction.

Few days later, attacker will login to victim’s online banking account using the stolen credentials and perform online transaction successfully by using intercepted TAC number.

The mobile malware has been discovered since late September 2010 but first time being used in malware campaign targeting Malaysian Online Banking users.

5.0 Recommendation

5.1 For laptop/PC User:

1) Install robust anti-virus, anti-spyware and firewall software on your computer and other devices and configure it to update regularly.

2) Perform regular scans of your systems for malware and other risks.

3) Operating system providers such as Microsoft, periodically releases updates and patches that improve the security of your operating system. You should periodically check for these updates and keep your system current or configure it to do so automatically.

4) When accessing to online banking, make sure there is no pop-up/window that requires personal info such as credit card number, smartphone platform(Android/iOS) etc. Do not enter those information if required.

5) Use only a dedicated computer or laptop to do online banking

6) If you suspect your bank account has been compromised or spot any activity you have not authorized, please notify your banking provider immediately.

7) Please ensure you logout properly at the end of each session by clicking log-out button. Do not exit by simply closing the browser window.

8) If you come across anything suspicious when you do banking online such as unusual web pages asking for banking information, notify your bank provider immediately.

9) Never respond to any email/advertisements requesting you to provide your login details or log in via a link sent in an email/applications. The bank will never send you a mail or provide links in any applications like that, and such a request is likely to be a phishing attempt.

5.2) For Smartphone Users:

1) Verify an app’s permission and the app’s author or publisher before installing it.

2) Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user’s information.

3) Since URL on mobile site appears differently from desktop browser, make sure to verify it first.

4) Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.

5) Don’t use public Wi-Fi networks for bank transactions and turn off Bluetooth connection when not in use. These can be open windows for eavesdroppers intercepting the transaction or installing spyware and other malware on user’s smartphone/tablet.

6) Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.

7) Do not root or otherwise ‘Jailbreak’ your phone; avoid side loading
(installing from non-official sources) when you can. If you do install Android software from a source other than the Market, be sure that it is coming from a reputable source.

6.0 References

6.1. Kapersky report on Zitmo malware

6.2. ATSEngine

Source: CyberSecurity Malaysia

eBay Accounts Hacked, Users Encouraged To Change Passwords Right NOW!

ebay Hacked!Internet auction site eBay has left users of its services, including PayPal, with reason to be concerned after posting a message up on the community page urging users to change their passwords. Since the original message popped up a short while ago, the company has stepped out and clarified the situation, noting that a hacker may have “compromised a database containing encrypted passwords,” although was also keen to stipulate that only “non-financial data” had been affected.

It’s always concerning when a major company with hundreds of millions of accounts – particularly one with links to finances – reveals that it may have been hacked, and the way eBay dealt with a potential breach today leaves much to be desired. Instead of being clear from the onset, an empty message popped up on its community page insisting that users should change passwords, although the actual body of the post was non-existent.

Panic naturally ensued, with users worried that their PayPal accounts could have been cleaned out, but in actual fact, it does appear that the issue is relatively low-key. Nevertheless, there has been a breach, and so if you’re an eBay user, it’s definitely worth changing your password if only for peace of mind.

Thankfully, large-scale security issues seem to be getting fewer and farther between as companies look to beef up on security, but even with the robust measures in place, human-made software will always inherently be imperfect. But while eBay and its own PayPal service can probably sweep this one under the rug, let’s hope that any future outbreaks or security lapses are dealt with in a more efficient manner than we’ve seen today.

After all, having users panicking about their personal info and financial data is something that, you hope, a company like eBay would want to avoid at all costs, and even though we’re very much relieved that accounts haven’t been hacked en masse, the company will probably want to have a quiet word with its PR team.

So, to sum up, if you’re an eBay or PayPal user, go ahead and change your password as soon as you can. The likelihood of you being hacked seems mightily slim anyway, but just to be on the safe side, don’t make it easy for a chancing hacker.

Source: Redmond Pie

It is illegal to ride on another’s WiFi connection: MCMC

wifi-security

PETALING JAYA: It is illegal to hack to hitch a ride on another person’s WiFi connection, said the Malaysian Communications and Multimedia Commission.

Both the person using a WiFi hacking device and the supplier of such a device are liable under Sections 236 and 239 of the Malaysian Communication and Multimedia Commission Act 1998.

Section 236 states that a person who commits “fraud and related activity in connection with access devices” can upon conviction be liable to a fine not exceeding RM500,000 or to imprisonment for a term not exceeding five years or to both.

It also states that a person who produces, assembles, uses, imports, sells, supplies or lets for hire any hardware or software used to obtain unauthorised access to any network service, applications services or content applications service is committing an offence.

Source: The Star

More Than 1,000 Malicious Android Apps Were Published On Play Store In August: Symantec

The month of August is often the time when families come together to go on a relaxing summer holiday. The kids are off school. The students are usually on an extended break from college or university making it the perfect time for relaxation and vacation. However, it seems that not everyone favors this relaxing mentality, with Internet security company Symantec stating that in August alone more than 1,000 fraudulent and potentially malicious apps were uploaded into the Android ecosystem via the Google Play Store.

android-logoGoogle’s policy of operating an open app marketplace for Android device owners is one that has been largely praised, but also one that offers significant repercussions for users who don’t exercise extreme caution with the apps that they download and use. The recent Symantec report states that more than 1,000 fraudulent apps were uploaded to the Play Store during the month of August, the majority of which were distributed by one single Japanese development company. As you might expect, the apps are nothing more than redirects to adult content and malicious websites.

There has been a growing trend recently on Android of apps of this nature that are nothing more than shells containing advertisements or links to external sites. It’s been estimated that the total downloads of these specific apps in August exceeded more than 10,000, and although Google was quick to act on the situation and delete the offending apps from their servers, the reality is that the developers would have made significant financial gain from the whole process.
android-chart
The detailed investigation of the one-click scammer apps also goes on to suggest that developers are using evolving tactics in an attempt to get their malicious apps onto the store for as long as possible. This latest attempt hasn’t proved overly successful in terms of longevity, but one of the more interesting points is that an estimated 97% of the apps in question were actually developed and uploaded by the same person / company.

The Play Store model of being entirely open is one that has come in for as much praise as it has criticism in the past, but it remains something that is unlikely to be changed. The advice to users is to only download and execute apps that they know and trust in order to have as few problems as possible.

Sim Card vulnerability exposes millions of phones worldwide

(Credit: Amanda Kooser/CNET)

A vulnerability on SIM cards used in some mobile phones could allow malware infection and surveillance, a security researcher warns.

Karsten Nohl, founder of Security Research Labs in Berlin, told The New York Times that he has identified a flaw in SIM encryption technology that could allow an attacker to obtain a SIM card’s digital key, the 56-digit sequence that allows modification of the card. The flaw, which may affect as many as 750 million mobile phones, could allow eavesdropping on phone conversations, fraudulent purchases, or impersonation of the handset’s owner, Nohl warned.

“We can remotely install software on a handset that operates completely independently from your phone,” warned Nohl, who said he managed the entire operation in less than two minutes using a standard PC. “We can spy on you. We know your encryption keys for calls. We can read your SMSs. More than just spying, we can steal data from the SIM card, your mobile identity, and charge to your account.”

The vulnerability was found in the Digital Encryption Standard, a cryptographic method developed by IBM in the 1970s that is used on about 3 billion cell phones every day. While the encryption method has been beefed up in the past decade, many handsets still use the older standard.

Tests showed that 1,000 cards in Europe and North America exhibited signs of the flaw. Nohl, who plans to detail the flaw at the Black Hat security conference in Las Vegas next month, said he has already shared the results of his two-year study with GSM Association, a trade group representing the cell phone industry.

GSM Association spokeswoman Claire Cranton told the Times that her organization had already passed the results on members of its group that still rely on the older standard.

“We have been able to consider the implications and provide guidance to those network operators and SIM vendors that may be impacted,” Cranton said in a statement.

Nohl, who has a doctorate in computer engineering from the University of Virginia, made headlines in 2008 by publicizing weaknesses in wireless smart card chips used in transit systems around the globe. A year later, he cracked the algorithm used on GSM (Global System for Mobile Communications) cell phones, which is designed to prevent attackers from eavesdropping on calls.

Via CNET