Malware

Since at least the time of the iPhone’s introduction in 2007, mobile phones have been moving toward their inevitable evolutionary destiny of becoming full-on handheld computers, complete with complex operating systems, the ability to run multiple applications and store large amounts of data. And for just as long, researchers have said that the attackers would begin focusing on mobile platforms as soon as they could figure out a way to make money on it. That time appears to be now.

Hacked smartphones could endanger troops by sending location data to the enemy using mechanisms similar to those employed by recently discovered Android malware, experts say. Read the full article. [Network World]

A hack attack that can expose users to malware exploits has infected
more than 1 million webpages, at least two of which belong to Apple. The SQL injection attacks bombard the websites of legitimate
companies with database commands that attempt to add hidden links that
lead to malware exploits. Read the full article. [The Register]

It’s possible to craft a malicious website so that a user’s clicks are
secretly redirected to a legitimate site in a way that steals a user’s
passwords and other data. Many Web developers have added protections to
block the tactic on standard websites, but Stanford University
researchers warn that there are not nearly enough defenses against the
technique on mobile websites. Read the full article. [Technology Review]

The drumbeat for more secure application development picked up pace on Tuesday, with news that software giant HP had acquired privately funded Fortify Software, a maker of static code analysis tools, for an undisclosed amount.

usan Wade, Dir. of PR for Network Solutions, Herndon, Virginia. 703.668.5057 ||Web hosting firm NetworkSolutions confirmed on Monday that it had unwittingly served up a malicious Web site widget on customers’ inactive  or “parked” Web domains, but the company said that it still didn’t know how many domains had been infected. In a blog post (http://blog.networksolutions.com/2010/security-alert-malware-found-on-widget/), the Herndon, Virginia Web site hosting firm The company acknowledged published reports (http://threatpost.com/en_us/blogs/network-solutions-hacked-widget-081610) on Monday that it allowed a third party widget that was part of a widely installed Web site package to be compromised. A company spokeswoman declined to put a number to how many Web sites may have been serving malicious content. Security experts have estimated that anywhere between 500,000 and five million Web sites may have hosted the malicious widget at one time. The mass infections first came to light after researchers at Web security firm Armorize Technologies analyzed a third party widget (http://blog.armorize.com/2010/08/more-than-500000-network-solutions.html) dubbed the Small Business Success Index that was offered by Network Solutions. Researchers realized that the widget, in addition to being downloadable from Network Solutions, was distributed with a standard package of Web pages that Network Solutions offered to customers who wished to “park” Web domains they had registered using a basic place holder Web site – greatly increasing its prevalence. The Armorize analysis revealed that the widget was similar to one that they had first spotted in May on the Web site of boingboing.com, a high traffic parked domain that is hosted on Network Solutions and that benefits from its similarity to the popular boingboing.net Web site (http://blog.armorize.com/2010/05/beware-of-boingboingcom-malware.html). The malicious widget targets visitors with vulnerable installations of the Internet Explorer Web browser, serving malicious links that exploit known vulnerabilities in IE as well as Adobe’s Acrobat and Reader applications.  Once it has compromised user systems, the browsers push remote monitoring software, dubbed lsass.exe, to the infected systems. That software monitors user browsing activity, looking for certain search keywords and redirecting users to pay per click advertising sites. It also looks for file shares and peer to peer networking software, copying and renaming the malicious program to those directories to spread said Caleb Sima, CEO of Armorize. It is not known how long the malicious widget has been part of the default domain package, but infections linked to Network Solutions domains can be traced back to January, 2010 when the company reported large scale compromises and defacement of Websites hosted on Network Solutions Unix servers (http://blog.networksolutions.com/2010/update-web-site-defacement-issue). Sima said his researchers identified accounts on free Web site traffic monitoring sites that were linked to the malicious software programs and that date to early February, 2010. That date conincides with the earlier compromises at Network Solutions, he said. “If you look at the number of page views, it matches up with the Wordpress infections.” That implies that the malicious Widget could have been active for the last year without being noticed. “This (widget) is using the same code base and is from the same attackers,” Sima said. He said the exact number of infected sites isn’t known, but believes it is in the neighborhood of 5 million sites, based on Web searches targeted at code used by the malicious widget.Wade of Network Solutions disputes that number and says the actual number of infected sites is “much lower,” but acknowledged that the company doesn’t have a firm number, and is unlikely to make public a number when it does know. Network Solutions has disabed the offending code she said, adding that since the affected domains were not actively managed, the impact on customers will be minimal. Sima, whose company offers a service dubbed “HackAlert” that monitors Web sites for infections, said the exploit points to a glaring hole in the protections that both companies and third party providers such as Network Solutions rely on. Web -based malware can be updated and modified on the fly. Only half of the anti malware engines that Armorize ran against the malware served by the infected Network SOlutions sites identified it as malicious. MOreover, companies lack the ability to spot malicious links into or out of sites that they manage. <object width=”480″ height=”385″><param name=”movie” value=”http://www.youtube.com/v/qWLX0a3FS_Y?fs=1&amp;hl=en_US”></param><param name=”allowFullScreen” value=”true”></param><param name=”allowscriptaccess” value=”always”></param><embed src=”http://www.youtube.com/v/qWLX0a3FS_Y?fs=1&amp;hl=en_US” type=”application/x-shockwave-flash” allowscriptaccess=”always” allowfullscreen=”true” width=”480″ height=”385″></embed></object>Web hosting firm NetworkSolutions confirmed on Monday that it had unwittingly served up a malicious Web site widget on customers’ inactive  or “parked” Web domains, but the company said that it still didn’t know how many domains had been infected. 

A recently patched vulnerability in Adobe’s ColdFusion application
server may be more serious than previously thought following the public
release of exploit code and blog posts claiming it can be used to take
full control of systems running the software. Read the full article. [The Register]