Engadget http://www.engadget.com Engadget http://www.blogsmithmedia.com/www.engadget.com/media/feedlogo.gif Engadget http://www.engadget.com en-us Copyright 2012 Weblogs, Inc. The contents of this feed are available for non-commercial use only. Blogsmith http://www.blogsmith.com/<![CDATA[Stuxnet pinned on US and Israel as an out-of-control creation]]>http://www.engadget.com/2012/06/01/stuxnet-pinned-on-us-and-israel-as-an-out-of-control-creation/http://www.engadget.com/2012/06/01/stuxnet-pinned-on-us-and-israel-as-an-out-of-control-creation/http://www.engadget.com/2012/06/01/stuxnet-pinned-on-us-and-israel-as-an-out-of-control-creation/#comments Stuxnet pinned on US and Israel as an outofcontrol creation

Ever since Stuxnet was discovered, most of the accusing fingers have been pointed at the US, Israel or both, whether or not there was any evidence; it was hard to ignore malware that seemed tailor-made for wrecking Iranian centrifuges and slowing down the country's nuclear development. As it turns out, Occam's Razor is in full effect. An exposé from the New York Times matter-of-factly claims that the US and Israel coded Stuxnet as part of a cyberwar op, Olympic Games, and snuck it on to a USB thumb drive that infected computers at the Natanz nuclear facility. The reason we know about the infection at all, insiders say, is that it got out of control: someone modified the code or otherwise got it to spread through an infected PC carried outside, pushing Obama to either double down (which he did) or back off. Despite all its connections, the newspaper couldn't confirm whether or not the new Flame malware attack is another US creation. Tipsters did, however, deny that Flame is part of the Olympic Games push -- raising the possibility that there are other agencies at work.

[Image credit: David Holt, Flickr]

Stuxnet pinned on US and Israel as an out-of-control creation originally appeared on Engadget on Fri, 01 Jun 2012 14:48:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>cyber warCyberWarflameflash driveFlashDriveinfectioninternetiranisraelmalwarenatanznuclear powernuclear power plantnuclear weaponsnuclear weapons programNuclearPowerNuclearPowerPlantNuclearWeaponsNuclearWeaponsProgramoccams razorOccamsRazorolympic gamesOlympicGamespresident bushpresident obamaPresidentBushPresidentObamastuxnetthumb driveThumbDriveunited statesUnitedStatesususavirusFri, 01 Jun 2012 14:48:00 EST<![CDATA[Flame malware snoops on PCs across the Middle East, makes Stuxnet look small-time]]>http://www.engadget.com/2012/05/28/flame-malware-snoops-on-pcs-across-the-middle-east/http://www.engadget.com/2012/05/28/flame-malware-snoops-on-pcs-across-the-middle-east/http://www.engadget.com/2012/05/28/flame-malware-snoops-on-pcs-across-the-middle-east/#comments Image

Much ado was made when security experts found Stuxnet wreaking havoc, but it's looking as though the malware was just a prelude to a much more elaborate attack that's plaguing the Middle East. Flame, a backdoor Windows trojan, doesn't just sniff and steal nearby network traffic info -- it uses your computer's hardware against you. The rogue code nabs phone data over Bluetooth, spreads over USB drives and records conversations from the PC's microphone. If that isn't enough to set even the slightly paranoid on edge, it's also so complex that it has to infect a PC in stages; Flame may have been attacking computers since 2010 without being spotted, and researchers at Kaspersky think it may be a decade before they know just how much damage the code can wreak.

No culprit has been pinpointed yet, but a link to the same printer spool vulnerability used by Stuxnet has led researchers to suspect that it may be another instance of a targeted cyberwar attack given that Iran, Syria and a handful of other countries in the region are almost exclusively marked as targets. Even if you live in a 'safe' region, we'd keep an eye out for any suspicious activity knowing that even a fully updated Windows 7 PC can be compromised.

Flame malware snoops on PCs across the Middle East, makes Stuxnet look small-time originally appeared on Engadget on Mon, 28 May 2012 17:07:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>back doorBackDoorbluetoothcyber securitycyber warCyberSecuritycyberwarduquegyptflameinfectioninternetiranisraelkasperskyKaspersky LabsKasperskyLabsmalwaremicrosoftmicrosoft windows 7MicrosoftWindows7palestinesaudi arabiaSaudiArabiasecuritystuxnetsyriatrojanwindows 7Windows7zero dayzero day attackzero-dayZeroDayZeroDayAttackMon, 28 May 2012 17:07:00 EST<![CDATA[Mobile security researchers present Android Malware Genome Project at IEEE]]>http://www.engadget.com/2012/05/22/android-malware-genome-proje/http://www.engadget.com/2012/05/22/android-malware-genome-proje/http://www.engadget.com/2012/05/22/android-malware-genome-proje/#comments Mobile security researchers announce Android Malware Genome Project at IEEEAndroid's openness, combined with its popularity, has lead a few of the developer faithful astray -- with malware being a legitimate concern for the mobile operating system. To help combat the issue, Xuxian Jiang, an NC State researcher, has created the Android Malware Genome Project, which was presented at the IEEE Symposium on Security this week. The aim is to collect and analyse all the known malicious software, and share the findings so that more effective and preventative measures to be taken by the community. Jiang claims that the main drawback has been understanding the malware, and getting access to examples, something the project aims to solve. More than 1,200 malware samples have been collected so far, and if you're curious, the dataset is available for download via the source.

Mobile security researchers present Android Malware Genome Project at IEEE originally appeared on Engadget on Tue, 22 May 2012 22:13:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidandroid malwareAndroid Malware Genome ProjectAndroidMalwareAndroidMalwareGenomeProjectappappsIEEE Symposium on SecurityIeeeSymposiumOnSecuritymalwaremobilepostminiNC StateNcStateNCSUresearchsecurityTue, 22 May 2012 22:13:00 EST<![CDATA[Exploit uses firewalls to hijack smartphones, turns friends into foes]]>http://www.engadget.com/2012/05/22/exploit-uses-firewalls-to-hijack-smartphones/http://www.engadget.com/2012/05/22/exploit-uses-firewalls-to-hijack-smartphones/http://www.engadget.com/2012/05/22/exploit-uses-firewalls-to-hijack-smartphones/#comments Image

Normally, firewalls at cellular carriers are your best friends, screening out malware before it ever touches your phone. University of Michigan computer science researchers have found that those first lines of defense could be your enemy through a new exploit. As long as a small piece of malware sits on a device, that handset can infer TCP data packet sequence numbers coming from the firewall and hijack a phone's internet traffic with phishing sites, fake messages or other rogue code. The trick works on at least 48 carriers that use firewalls from Check Point, Cisco, Juniper and other networking heavy hitters -- AT&T being one of those providers. Carriers can turn the sequences off, although there are consequences to that as well. The only surefire solution is to either run antivirus apps if you're on a mobile OS like Android or else to run a platform that doesn't allow running unsigned apps at all, like iOS or Windows Phone. Whether or not the exploit is a serious threat is still far from certain, but we'll get a better sense of the risk on May 22nd, when Z. Morley Mao and Zhiyun Qian step up to the podium at an IEEE security symposium and deliver their findings.

Exploit uses firewalls to hijack smartphones, turns friends into foes originally appeared on Engadget on Tue, 22 May 2012 03:18:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidATTcellphonecellphonescheck pointCheckPointCiscoCisco SystemsCiscoSystemsexploitfirewallfirewallsgooglegoogle androidGoogleAndroidieeeJuniperjuniper networksJuniperNetworksmalwaremobilepostcrossnetwork firewallnetwork routingNetworkFirewallnetworkingNetworkRoutingpacketpacketsPhishphishingresearchresearchersrouterTCPTCP IPTcpIpuniversity of michiganUniversityOfMichiganvirusvirusesTue, 22 May 2012 03:18:00 EST<![CDATA[Apple issues Leopard update with Flashback removal tool]]>http://www.engadget.com/2012/05/15/apple-issues-leopard-update-with-flashback-removal-tool/http://www.engadget.com/2012/05/15/apple-issues-leopard-update-with-flashback-removal-tool/http://www.engadget.com/2012/05/15/apple-issues-leopard-update-with-flashback-removal-tool/#comments Apple issues Leopard update with Flashback removal tool

Folks still rocking Apple's Leopard may have been feeling left out after Lion and Snow Leopard both got an update for addressing that Flashback malware. If you're one of them, you'll be glad to know that Apple has finally issued a Leopard fix that comes with a removal tool for the vulnerability afflicting its big cats. In addition to a 1.23MB Flashback update, Apple also released a second 1.11MB fix for Leopard that disables versions of Adobe Flash Player that don't have the requisite security updates. Both should further whittle down the number of Apple computers affected by the Flashback trojan. For the actual updates, feel free to pounce on the source links below.

Apple issues Leopard update with Flashback removal tool originally appeared on Engadget on Tue, 15 May 2012 04:01:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>10.510.610.7adobe flashAdobeFlashapplebotnetdr. webDr.WebflashbackflashfakejavaJava Virtual MachineJavaVirtualMachineleopardlionmalwareos xOsXpatchsecuritysnow leopardSnowLeopardtrojanupdatevirusTue, 15 May 2012 04:01:00 EST<![CDATA[Kaspersky exec calls Mac OS 'really vulnerable' (update: clarification from Kaspersky)]]>http://www.engadget.com/2012/05/14/kaspersky-exec-calls-mac-os-really-vulnerable/http://www.engadget.com/2012/05/14/kaspersky-exec-calls-mac-os-really-vulnerable/http://www.engadget.com/2012/05/14/kaspersky-exec-calls-mac-os-really-vulnerable/#comments Image

The Macintosh is an impenetrable fortress of malware-free computing, right? In recent years, we've certainly seen that image eroded a bit, thanks to a number of nasty outbreaks. And if you listen to Nikolay Grebennikov, the CTO of security software maker Kaspersky, things have the potential to be much worse. The executive told British site Computing that the company was invited to improve Cupertino's security, only to discover that, "Mac OS is really vulnerable." Grebennikov also had some rather unfortunate news for all the iPad and iPhone owners out there, telling the site, "Our experience tells us that in the near future, perhaps in a year or so, we will see the first malware targeting iOS."

Update: So, this is turning into a whole "he said, they pubbed" situation. We reached out to Kaspersky earlier and just received a comment from the security company, which claims that the whole thing was simply taken out of context. Here's the statement. It's a doozy.

On Monday, April 14, computing.co.uk published an article titled "Apple OS 'really vulnerable' claims Kaspersky Lab CTO" that includes an inaccurate quote regarding Apple and Kaspersky Lab. The article reports that Kaspersky Lab had "begun the process of analyzing the Mac OS platform at Apple's request" to identify vulnerabilities. This statement was taken out of context by the magazine - Apple did not invite or solicit Kaspersky Lab's assistance in analyzing the Mac OS X platform. Kaspersky Lab has contacted computing.co.uk to correct its article.

Please refer to the statement below from Nikolay Grebennikov, Chief Technology Officer, Kaspersky Lab, which clarifies this misrepresentation:

"As Mac OS X market share continues to increase, we expect cyber-criminals to continue to develop new types of malware and attack methods. In order to meet these new threats, Kaspersky Lab has been conducting an in-depth analysis of Mac OS X vulnerabilities and new forms of malware.

This security analysis of Mac OS X was conducted independently of Apple; however, Apple is open to collaborating with us regarding new Mac OS X vulnerabilities and malware that we identify during our analysis. Kaspersky Lab is committed to providing the highest level of security for all of our customers, including Mac OS X, and we will continue to enhance our technologies in order to meet the ever-changing threat landscape. "

Kaspersky exec calls Mac OS 'really vulnerable' (update: clarification from Kaspersky) originally appeared on Engadget on Mon, 14 May 2012 11:39:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>appleapple osAppleOsioskasperskymac osMacOsmalwareNikolay GrebennikovNikolayGrebennikovsecurityMon, 14 May 2012 11:39:00 EST<![CDATA[Adobe changes tune on CS5 updates, won't seek paid CS6 upgrade to patch vulnerabilities]]>http://www.engadget.com/2012/05/12/adobe-cs-vulnerabilities-patch/http://www.engadget.com/2012/05/12/adobe-cs-vulnerabilities-patch/http://www.engadget.com/2012/05/12/adobe-cs-vulnerabilities-patch/#comments Adobe reportedly asking some CS users to upgrade if they want a patch for certain vulnerabilities

Things have gotten interesting in the world of CS updates. Recently, Computerworld reported that Adobe had informed folks using an older version of its famed Creative Suite -- CS5 and CS5.5, to be exact -- they'd have to shell out the CS6 upgrade fee in order to get a fix for some recently discovered bugs. Apparently, Adobe took notice to its customers' dissatisfaction and updated its initial blog post with a changed tune, stating, "We are in the process of resolving these vulnerabilities in Adobe Photoshop CS5.x, and will update this Security Bulletin once the patch is available." The same is true for both Illustrator and Flash. This kerfuffle started after Adobe handed out warnings for eight "critical" vulnerabilities found in certain versions of the three applications -- some of which are said to be exploitable and could potentially be used to "take control of the affected system." We'll see how it all plays out over the upcoming days, but in the meantime hit the links below to see if you need to take any action.

James Trew and Joe Pollicino contributed to this post.

Adobe changes tune on CS5 updates, won't seek paid CS6 upgrade to patch vulnerabilities originally appeared on Engadget on Sat, 12 May 2012 23:59:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>adobeadobe creative suiteadobe csadobe cs 5.5adobe cs5adobe cs6adobe photoshopAdobeCreativeSuiteAdobeCsAdobeCs5AdobeCs5.5AdobeCs6AdobePhotoshopbugbugscreative suiteCreative Suite 3Creative Suite 5creative suite 5.5Creative Suite 6CreativeSuiteCreativeSuite3CreativeSuite5CreativeSuite5.5CreativeSuite6cs6malwareminipostpatchpatchessoftware patchSoftwarePatchvulnerabilitiesvulnerabilitySat, 12 May 2012 23:59:00 EST<![CDATA[Around 140,000 Apple machines still infected with Flashback malware, says Symantec]]>http://www.engadget.com/2012/04/18/apple-flashback-virus-infections-update/http://www.engadget.com/2012/04/18/apple-flashback-virus-infections-update/http://www.engadget.com/2012/04/18/apple-flashback-virus-infections-update/#comments Around 140,000 Apple machines still infected with Flashback malware, says Symantec

By now, we're all quite familiar with the Java-driven trojan that's affected thousands of Apple's rigs, and while the numbers seem to have drastically dropped since the first Cupertino fix, there's still a plethora of machines carrying the bug. According to Symantec, the number of infected computers is now at around 140,000, seeing a decline of over 460,000 since April 9th. Still, the security outfit remains puzzled by the fact, as it expected the digits to be somewhere near the 99,000 mark by now. Perhaps this is due to some folks not even being aware of Flashback's existence, or maybe not checking for software updates as often as most of us. Either way, we hope you've already used one of the tools Apple handed you.

Around 140,000 Apple machines still infected with Flashback malware, says Symantec originally appeared on Engadget on Wed, 18 Apr 2012 07:21:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>applebugbugsflashbackflashback malwareFlashbackMalwarejavamalwareos xos x lionOsXOsXLionsecurityvirusWed, 18 Apr 2012 07:21:00 EST<![CDATA[Apple issues Flashback removal tool for 10.7 Lion systems not running Java]]>http://www.engadget.com/2012/04/14/apple-issues-flashback-removal-tool-for-10-7-lion/http://www.engadget.com/2012/04/14/apple-issues-flashback-removal-tool-for-10-7-lion/http://www.engadget.com/2012/04/14/apple-issues-flashback-removal-tool-for-10-7-lion/#comments Apple issues Flashback removal tool for 10.7 Lion systems not running JavaThe Flashback OS X trojan continues to cast a rainy shadow over Mac owners' sense of security, and even though a fix has been released, this was only for what Apple considered "the most common variants." Users of Lion, who don't have Java installed, weren't included in that initial run, but there is a new removal tool just for them. So, if you're running 10.7 and never installed Oracle's virtual machine, make sure you point your browser at the source link below.

Apple issues Flashback removal tool for 10.7 Lion systems not running Java originally appeared on Engadget on Sat, 14 Apr 2012 09:53:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>10.7appleflashbackjavalionmalwareos xOsXosx 10.7osx lionOsx10.7OsxLionsecurityupdateSat, 14 Apr 2012 09:53:00 EST<![CDATA[Apple releases fix for Flashback malware]]>http://www.engadget.com/2012/04/12/apple-releases-fix-for-flashback-malware/http://www.engadget.com/2012/04/12/apple-releases-fix-for-flashback-malware/http://www.engadget.com/2012/04/12/apple-releases-fix-for-flashback-malware/#comments It promised earlier this week that a fix was coming, and Apple has now delivered a Java security update that is says removes "the most common variants of the Flashback malware." That update also reconfigures the Java web plug-in to disable the automatic execution of Java applets by default (in Lion, at least -- those still on Snow Leopard are advised to do that themselves), although folks can re-enable that functionality if they choose. As usual, OS X users can download the update through the Software Update application.

Apple releases fix for Flashback malware originally appeared on Engadget on Thu, 12 Apr 2012 17:08:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>appleflashbackjavamalwareos xOsXsecurityupdateThu, 12 Apr 2012 17:08:00 EST<![CDATA[Apple publishes support page for Flashback malware, is working on a fix]]>http://www.engadget.com/2012/04/10/apple-publishes-support-page-for-flashback-malware-is-working-o/http://www.engadget.com/2012/04/10/apple-publishes-support-page-for-flashback-malware-is-working-o/http://www.engadget.com/2012/04/10/apple-publishes-support-page-for-flashback-malware-is-working-o/#comments Apple publishes support page for Flashback malware, is working on a fixAfter the Flashback / Flashfake Mac trojan was exposed by Russian site Dr. Web, Apple has finally responded by publishing a support page about the issue and promising a fix. If you haven't heard by now, the malware exploits a flaw in the Java Virtual Machine, which Oracle pushed a fix for back in February, but Apple didn't patch until a botnet consisting of as many as 650,000 Macs was identified on March 4th. Antivirus maker Kaspersky has confirmed the earlier findings, and released a free tool affected users can run to remove the trojan from their computers. Other than the update already delivered for computers running OS 10.6 and 10.7 Apple recommends users on 10.5 and earlier disable Java in their browser preferences. What isn't mentioned however, is when its fix is incoming or any timetable on its efforts with international ISPs to cut off the IP addresses used by the network. This is not the first time Macs have fallen prey to malware and as their market share grows will likely not be the last, so don't think just opting for OS X is automatically keeping you a step ahead security-wise. Check the links below for more information about what the malware does, and how to get rid of it.

Apple publishes support page for Flashback malware, is working on a fix originally appeared on Engadget on Tue, 10 Apr 2012 21:50:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>10.610.7applebotnetdr. webDr.WebflashbackflashfakejavaJava Virtual MachineJavaVirtualMachinekasperskylionmalwareos xOsXpatchsecuritysnow leopardSnowLeopardtrojanupdatevirusTue, 10 Apr 2012 21:50:00 EST<![CDATA[OS X malware used to spy on pro-Tibetan charities, reminds us all to keep updated]]>http://www.engadget.com/2012/03/30/os-x-malware-tibet/http://www.engadget.com/2012/03/30/os-x-malware-tibet/http://www.engadget.com/2012/03/30/os-x-malware-tibet/#comments ImagePro-Tibetan organizations that use Macs have discovered that their data has been accessed thanks to malware-based siphoning more commonly associated with Windows machines. Security expert Jamie Blasco revealed that two separate backdoor trojans can breach OS X if infected Word documents (yes, we know) or emails are opened. However, those who regularly keep up with security updates shouldn't be too concerned: both holes were patched before the end of last year, although that's scant relief for those whose privacy has already been infringed.

[Thanks, Charles]

OS X malware used to spy on pro-Tibetan charities, reminds us all to keep updated originally appeared on Engadget on Fri, 30 Mar 2012 17:26:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>Alien VaultAlienVaultJamie BlascoJamieBlascoMac MalwareMacMalwareMalwareminipostSecurityTibetWordFri, 30 Mar 2012 17:26:00 EST<![CDATA[U.S. Department of Defense preps cyber rules of engagement, plans to work more closely with ISPs]]>http://www.engadget.com/2012/03/22/u-s-department-of-defense-preps-cyber-rules-of-engagement-plan/http://www.engadget.com/2012/03/22/u-s-department-of-defense-preps-cyber-rules-of-engagement-plan/http://www.engadget.com/2012/03/22/u-s-department-of-defense-preps-cyber-rules-of-engagement-plan/#comments The Pentagon left no room for argument last year when it declared cyber attacks a potential act of war. "If you shut down our power grid, maybe we will put a missile down one of your smokestacks," a military official reportedly remarked. Yikes. Before we start bombing chimneys, however, the Department of Defense plans to draft up some relevant guidelines, noting in a recent House Armed Services Committee hearing that it will be delivering a set of cyberspace-specific rules of engagement in the coming months. "We are working closely with the joint staff on the implementation of a transitional command and control model for cyberspace operations," said Madelyn Creedon, assistant secretary of defense for Global Strategic Affairs. In addition to setting ground rules for cyber-engagements, the DOD also plans to expand efforts to share classified information on possible threats with internet service providers and defense contractors.

U.S. Department of Defense preps cyber rules of engagement, plans to work more closely with ISPs originally appeared on Engadget on Thu, 22 Mar 2012 08:44:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>cyber attackcyber commandcyber securityCyberAttackCyberCommandCyberSecuritydefenseDepartment of DefenseDepartmentOfDefensemalwaresecurityunited states cyber commandUnitedStatesCyberCommandUS governmentus militaryUsGovernmentUsMilitarywarThu, 22 Mar 2012 08:44:00 EST<![CDATA[Switched On: Mountain Lion brings iOS apps, malware traps]]>http://www.engadget.com/2012/02/26/switched-on-mountain-lion-brings-ios-apps-malware-traps/http://www.engadget.com/2012/02/26/switched-on-mountain-lion-brings-ios-apps-malware-traps/http://www.engadget.com/2012/02/26/switched-on-mountain-lion-brings-ios-apps-malware-traps/#commentsEach week Ross Rubin contributes Switched On, a column about consumer technology.

According to Wikipedia, the mountain lion, also known as the cougar, is distinguished by having the greatest range of any large wild terrestrial animal in the Western Hemisphere. Indeed, from what we've seen so far of Apple's forthcoming Mac operating system, its new features will likely find favor with a broader range of Apple users than Lion.

Continue reading Switched On: Mountain Lion brings iOS apps, malware traps

Switched On: Mountain Lion brings iOS apps, malware traps originally appeared on Engadget on Sun, 26 Feb 2012 18:00:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>applecolumnfeaturesgatekeeperiCloudiOSiPadLionMacMac os xMacOsXmalwaremirroringmountain lionMountainLionnewNotificationsos xOsXRemindersSwitched OnswitchedonSun, 26 Feb 2012 18:00:00 EST<![CDATA[Google Chrome update brings speedier browsing, enhanced security, joy]]>http://www.engadget.com/2012/02/09/google-chrome-update-speed-security/http://www.engadget.com/2012/02/09/google-chrome-update-speed-security/http://www.engadget.com/2012/02/09/google-chrome-update-speed-security/#comments
The week isn't quite over yet, but it's already shaping up to be a busy one for Google Chrome. After finally bringing its browser to Android on Tuesday, Google yesterday announced an update for the original desktop version, promising faster browsing and enhanced security. More specifically, this new Stable release features a revamped omnibox that will now pre-render pages as a user types in a URL or search query, allowing for faster load times. Google has also tweaked its Safe Browsing feature, which will now automatically scan downloaded files for malware, with an especially sharp focus on any ".exe." or ".msi" files. To determine the safety of a given file, the browser will compare it against a list of publishers and files known to be safe. If it doesn't show up there, Chrome will then consult Google for more information. If the file proves suspicious, it'll warn the user and recommend deleting it. Google added that it's working on an update for its Chrome OS, as well, promising a new image editor and Verizon 3G activation portal, though there's no word yet on when that might roll out. For more details, see the source link below.

Google Chrome update brings speedier browsing, enhanced security, joy originally appeared on Engadget on Thu, 09 Feb 2012 03:22:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>browserchrome OSchromebookChromeOsgooglegoogle chromeGoogleChromeinternetmalwareomniboxpre renderPreRendersafetysecuritysoftwarespeedstable releaseStableReleaseupdateverizon 3gVerizon3gwebThu, 09 Feb 2012 03:22:00 EST<![CDATA[Google's 'Bouncer' service scans the Android Market for malware, will judge you at the door]]>http://www.engadget.com/2012/02/02/googles-bouncer-service-scans-the-android-market-for-malware/http://www.engadget.com/2012/02/02/googles-bouncer-service-scans-the-android-market-for-malware/http://www.engadget.com/2012/02/02/googles-bouncer-service-scans-the-android-market-for-malware/#comments Google has had its fair share of malware-related problems in the Android Market, but that's hopefully about to change, now that the company has announced a new security-enhancing service. Codenamed "Bouncer," Mountain View's new program sounds pretty simple, in principle: it just automatically scans the Market for malware, without altering the Android user experience, or requiring devs to run through an app approval process. According to Hiroshi Lockheimer, Android's VP of Engineering, Bouncer does this by scanning recently uploaded apps for spyware, trojans or any other lethal components, while looking out for any suspicious behavior that may raise a red flag. The service also runs a simulation of each app using Google's cloud-based infrastructure, and regularly checks up on developer accounts to keep repeat offenders out of the Android Market. Existing apps, it's worth noting, will be subject to the same treatment as their more freshly uploaded counterparts. Lockheimer went on to point out that malware is on the decline in the Market, citing a 40 percent drop between the first and second halves of 2011, and explained some of Android's fundamental security features, including its sandboxing and permission-based systems. Head for the source link below to read the post in full.

Google's 'Bouncer' service scans the Android Market for malware, will judge you at the door originally appeared on Engadget on Thu, 02 Feb 2012 15:30:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidandroid marketAndroidMarketappbouncerdevdeveloperdownloadgooglemaliciousmalwaremobilepostcrossmountain viewMountainViewpermissionsSandboxsandboxingsecurityservicevirusThu, 02 Feb 2012 15:30:00 EST<![CDATA[Google pulls Android Market malware that exploits SMS hole]]>http://www.engadget.com/2011/12/14/google-pulls-android-market-malware-that-exploits-sms-hole/http://www.engadget.com/2011/12/14/google-pulls-android-market-malware-that-exploits-sms-hole/http://www.engadget.com/2011/12/14/google-pulls-android-market-malware-that-exploits-sms-hole/#comments
Google's reportedly pulled 22 malicious apps after two security firms tipped them off that the malware was tricking users into sending SMS messages to premium-rate phone lines. Android.RuFraud poses as popular games like Angry Birds, Assassins Creed or Tetris and can affect users across Europe and Russia. Fortunately the apps are easily spotted and deleted, but were downloaded 14,000 times before being pulled -- so if you see anyone experiencing similar issues, you can let 'em know how to solve it.

Google pulls Android Market malware that exploits SMS hole originally appeared on Engadget on Wed, 14 Dec 2011 09:33:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>AndroidAndroid MalwareAndroid MarketAndroidMalwareAndroidMarketAssassin's CreedCrimeEuropeFraudGoogleGoogle IncMalwaremobilepostcrossRussiaSci/TechSecuritySMSTetrisWed, 14 Dec 2011 09:33:00 EST<![CDATA[Windows Defender beta gains 'offline' functionality, can run sans-OS]]>http://www.engadget.com/2011/12/09/windows-defender-beta-gains-offline-functionality-can-run-san/http://www.engadget.com/2011/12/09/windows-defender-beta-gains-offline-functionality-can-run-san/http://www.engadget.com/2011/12/09/windows-defender-beta-gains-offline-functionality-can-run-san/#comments PC users have been using Windows Defender to free themselves from the bane of viruses, malware and spyware for quite a while, but until now, you've needed Microsoft's OS running for it to do its work. That changes with a new beta, which creates bootable CDs or USB sticks that can run the utility. Those interested can begin by downloading the Windows Defender Offline Tool, which'll prompt you for either of those mediums and then install around 300MB of virus hating bits. And remember, because you're statically downloading an almanac of today's viruses, doesn't mean you'll be ready for those tomorrow, so those taking the plunge better remember to stay up to date.

Windows Defender beta gains 'offline' functionality, can run sans-OS originally appeared on Engadget on Fri, 09 Dec 2011 13:56:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>antivirusbetacdflash driveFlashDrivemalwaremicrosoftmicrosoft windowsmicrosoft windows defenderMicrosoftWindowsMicrosoftWindowsDefenderminipostsecuritytrojanusb flash driveUsbFlashDrivewindowswindows defenderwindows defender offlineWindowsDefenderWindowsDefenderOfflineFri, 09 Dec 2011 13:56:00 EST<![CDATA[US Cyber Command completes major cyber attack simulation, seems pleased with the results]]>http://www.engadget.com/2011/12/02/us-cyber-command-completes-major-cyber-attack-simulation-seems/http://www.engadget.com/2011/12/02/us-cyber-command-completes-major-cyber-attack-simulation-seems/http://www.engadget.com/2011/12/02/us-cyber-command-completes-major-cyber-attack-simulation-seems/#comments
The US Cyber Command is barely out of its infancy, but it's already crossed one milestone off its to-do list, with the successful completion of its first major test run. The exercise, known as Cyber Flag, was carried out over the course of a single week at Nellis Air Force Base in Nevada, where some 300 experts put their defense skills to the test. According to Col. Rivers J. Johnson, the participants were divided into two teams: "good guys," and "bad guys." The latter were delegated with the task of infiltrating the Cyber Command's networks, while the former were charged with defending the mock cyberattack and keeping the government's VPN free of malware. The idea, according to the agency, was to simulate a real-world attack on the Department of Defense, in order to better evaluate the Command's acumen. "There were a variety of scenarios based on what we think an adversary would do in real world events and real world time," Johnson explained. "It was a great exercise." The Colonel acknowledged that the good guys weren't able to defend against all of the attacks, but pointed out that the vast majority were recognized and mitigated "in a timely manner." All told, Cyber Flag was deemed a success, with NSA Director and Cyber Command chief Gen. Keith Alexander adding that it "exceeded" his own expectations.

US Cyber Command completes major cyber attack simulation, seems pleased with the results originally appeared on Engadget on Fri, 02 Dec 2011 17:34:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>cyber attackCyber Flagcyber securitycyberattackCyberFlagCyberSecuritydefensedepartment of defenseDepartmentOfDefenseDODgovernmentmalwaremilitarymocknational securitynational security agencyNationalSecurityNationalSecurityAgencyNellis Air Force BaseNellisAirForceBaseNSAsecuritytestUS Cyber CommandUS governmentUsCyberCommandUsGovernmentVPNFri, 02 Dec 2011 17:34:00 EST<![CDATA[WikiLeaks' Spy Files shed light on the corporate side of government surveillance]]>http://www.engadget.com/2011/12/02/wikileaks-spy-files-provide-glimpse-into-the-world-of-governmen/http://www.engadget.com/2011/12/02/wikileaks-spy-files-provide-glimpse-into-the-world-of-governmen/http://www.engadget.com/2011/12/02/wikileaks-spy-files-provide-glimpse-into-the-world-of-governmen/#comments
WikiLeaks' latest batch of documents hit the web this week, providing the world with a scarily thorough breakdown of a thoroughly scary industry -- government surveillance. The organization's trove, known as the Spy Files, includes a total of 287 files on surveillance products from 160 companies, as well as secret brochures and presentations that these firms use to market their technologies to government agencies. As Ars Technica reports, many of these products are designed to get around standard privacy guards installed in consumer devices, while some even act like malware. DigiTask, for example, is a German company that produces and markets software capable of circumventing a device's SSL encryption and transmitting all instant messages, emails and recorded web activity to clients (i.e., law enforcement agencies). This "remote forensic software" also sports keystroke logging capabilities, and can capture screenshots, as well. Included among DigiTask's other products is the WifiCatcher -- a portable device capable of culling data from users linked up to a public WiFi network. US-based SS8, Italy's Hacking Team and France's Vupen produce similar Trojan-like malware capable of documenting a phone or computer's "every use, movement, and even the sights and sounds of the room it is in," according to the publication.

Speaking at City University in London yesterday, WikiLeaks founder Julian Assange said his organization decided to unleash the Spy Files as "a mass attack on the mass surveillance industry," adding that the technologies described could easily transform participating governments into a "totalitarian surveillance state." The documents, released on the heels of the Wall Street Journal's corroborative "Surveillance Catalog" report, were published alongside a preface from WikiLeaks, justifying its imperative to excavate such an "unregulated" industry. "Intelligence agencies, military forces, and police authorities are able to silently, and on mass, and [sic] secretly intercept calls and take over computers without the help or knowledge of the telecommunication providers," wrote Wikileaks in its report. "In the last ten years systems for indiscriminate, mass surveillance have become the norm." The organization says this initial document dump is only the first in a larger series of related files, scheduled for future release. You can comb through them for yourself, at the source link below.

WikiLeaks' Spy Files shed light on the corporate side of government surveillance originally appeared on Engadget on Fri, 02 Dec 2011 09:35:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>brochurebusinesscomputerconfidentialcybersecuritydataDigiTaskdocumentdocument dumpDocumentDumpespionagefilesfrancegermanygovernmentindustryJulian AssangeJulianAssangelawlaw enforcementLawEnforcementleaklegalmalwaremarketingmonitoringpersonal dataPersonalDatapoliticspresentationssecuritysmartphonespySpy FilesSpyFilesspywaresurveillancetransparencytrojanwebwhistleblowerWiFiwikileaksFri, 02 Dec 2011 09:35:00 EST<![CDATA[Windows 8 gets automatic updates, enforced restarts after 72 hours of polite harassment]]>http://www.engadget.com/2011/11/15/windows-8-gets-automatic-updates-enforced-restarts-after-72-hou/http://www.engadget.com/2011/11/15/windows-8-gets-automatic-updates-enforced-restarts-after-72-hou/http://www.engadget.com/2011/11/15/windows-8-gets-automatic-updates-enforced-restarts-after-72-hou/#comments
Windows 8 is renaming the second week of every month. After "Patch Tuesday" comes "Gentle reminder Wednesday," "Polite yet firm suggestion Thursday" and "Automatic restart Friday". In order to keep everyone's system secure, Windows Update will download patches in the background before adding a notification on your lock screen that you're due a restart. If you haven't managed it within 72 hours, you'll be given a 15 minute warning to save your work and close up before it forces the shutdown -- unless you're watching a movie or conducting a presentation, it'll lie in wait for your next idle period to do it. With this system, you'll only have to complete the procedure once a month and can plan your schedule accordingly. The only time the system will deviate is when a security threat like a blaster worm appears, at which point Microsoft will ensure you're restarting as soon as a fix is available. What, you didn't know that "keeping end-users on their toes" was a feature?

Windows 8 gets automatic updates, enforced restarts after 72 hours of polite harassment originally appeared on Engadget on Tue, 15 Nov 2011 11:33:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>Automatic RestartAutomatic UpdatesAutomaticRestartAutomaticUpdatesBlaster WormBlasterWormBug FixesBugFixesMalwareMetroMetro UIMetroUiPatch TuesdayPatchTuesdaySecurityVirusVirus ProtectionVirusProtectionWin 8Win8WindowsWindows 8Windows 8 UpdateWindows UpdateWindows UpdatesWindows8Windows8UpdateWindowsUpdateWindowsUpdatesWUTue, 15 Nov 2011 11:33:00 EST<![CDATA[Georgia Tech spies on nearby keyboards with iPhone 4 accelerometer, creates spiPhone]]>http://www.engadget.com/2011/10/21/georgia-tech-spies-on-nearby-keyboards-with-iphone-4-acceleromet/http://www.engadget.com/2011/10/21/georgia-tech-spies-on-nearby-keyboards-with-iphone-4-acceleromet/http://www.engadget.com/2011/10/21/georgia-tech-spies-on-nearby-keyboards-with-iphone-4-acceleromet/#comments Ever plopped your cellular down next to your laptop? According Georgia Tech researchers, that common scenario could let hackers record almost every sentence you type, all thanks to your smartphone's accelerometer. They've achieved the feat with an impressive 80 percent accuracy using an iPhone 4, and are dubbing the program they've developed, spiPhone. (Although the group initially had fledgling trials with an iPhone 3GS, they discovered the 4's gyroscope aided in data reading.) If the software gets installed onto a mobile device it can use the accelerometer to sense vibrations within three-inches, in degrees of "near or far and left or right," allowing it to statistically guess the words being written -- so long as they have three or more letters. It does this by recording pairs of keystrokes, putting them against dictionaries with nearly 58,000 words to come up with the most likely results.

The group has also done the same with the phone's mics (which they say samples data at a whopping 44,000 times per second vs. the accelerometer's 100), but note that it's a less likely option given the usual need for some form of user permission. Furthermore, they explained that the accelerometer data rate is already mighty slow, and if phone makers reduced it a bit more, spiPhone would have a hard time doin' its thing. The good news? Considering the strict circumstances needed, these researchers think there's a slim chance that this kind of malware could go into action easily. Looks like our iPhone and MacBook can still be close friends... For now. You'll find more details at the links below.

Georgia Tech spies on nearby keyboards with iPhone 4 accelerometer, creates spiPhone originally appeared on Engadget on Fri, 21 Oct 2011 11:47:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>accelerometerArunabh VermaArunabhVermaGeorgia TechGeorgiaTechhackingHenry CarterHenryCarteriphone 3gsiphone 4Iphone3gsIphone4keyboardmalwarePatrick TraynorPatrickTraynorPhilip MarquardtPhilipMarquardtspiphonespyspyingFri, 21 Oct 2011 11:47:00 EST<![CDATA[US government to beat back botnets with a cybersecurity code of conduct]]>http://www.engadget.com/2011/09/23/us-government-to-beat-back-botnets-with-a-cybersecurity-code-of/http://www.engadget.com/2011/09/23/us-government-to-beat-back-botnets-with-a-cybersecurity-code-of/http://www.engadget.com/2011/09/23/us-government-to-beat-back-botnets-with-a-cybersecurity-code-of/#comments Old Uncle Sam seems determined to crack down on botnets, but he still needs a little help figuring out how to do so. On Wednesday, the Department of Homeland Security and National Institute of Standards and Technology (NIST) published a request for information, inviting companies from internet and IT companies to contribute their ideas to a voluntary "code of conduct" for ISPs to follow when facing a botnet infestation. The move comes as an apparent response to a June "Green Paper" on cybersecurity, in which the Department of Commerce's Internet Policy Task Force called for a unified code of best practices to help ISPs navigate through particularly treacherous waters. At this point, the NIST is still open to suggestions from the public, though Ars Technica reports that it's giving special consideration to two models adopted overseas. Australia's iCode program, for example, calls for providers to reroute requests from shady-looking systems to a site devoted to malware removal. The agency is also taking a hard look at an initiative (diagrammed above) from Japan's Cyber Clean Center, which has installed so-called "honeypot" devices at various ISPs, allowing them to easily detect and source any attacks, while automatically notifying their customers via e-mail. There are, however, some lingering concerns, as the NIST would need to find funding for its forthcoming initiative, whether it comes from the public sector, corporations or some sort of public-private partnership. Plus, some are worried that anti-botnet programs may inadvertently reveal consumers' personal information, while others are openly wondering whether OS-makers should be involved, as well. The code's public comment period will end on November 4th, but you can find more information at the source link, below.

US government to beat back botnets with a cybersecurity code of conduct originally appeared on Engadget on Fri, 23 Sep 2011 14:34:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>attackaustraliabotnetcode of conductCodeOfConductcyber attackcyber clean centerCyberAttackCyberCleanCenterddosdepartment of homeland securityDepartmentOfHomelandSecuritydistributed denial of serviceDistributedDenialOfServicegovernmentinternet service providerInternetServiceProviderISPjapanmalwarenational institute of standards and technologyNationalInstituteOfStandardsAndTechnologyNISTpersonal informationPersonalInformationsecurityspamspambotUS governmentUsGovernmentvirusvoluntaryvoluntary codeVoluntaryCodeFri, 23 Sep 2011 14:34:00 EST<![CDATA[Looking back at a year of Android Malware]]>http://www.engadget.com/2011/08/12/looking-back-at-a-year-of-android-malware/http://www.engadget.com/2011/08/12/looking-back-at-a-year-of-android-malware/http://www.engadget.com/2011/08/12/looking-back-at-a-year-of-android-malware/#comments Wow, has it really been a year a year since we first witnessed the arrival of SMS.AndroidOS.FakePlayer.a? It seems like only yesterday when everyone was first scrambling to describe the text message manipulating bit of Android malware. We've come along way and seen plenty of malicious bits of software since August 2010. Remember the porn-bundled SMS.AndroidOS.FakePlayer.b trojan from October? Or how about the bible-packing Android.Smspacem? Relive all of the handset hijacking memories in the source link below.

Continue reading Looking back at a year of Android Malware

Looking back at a year of Android Malware originally appeared on Engadget on Fri, 12 Aug 2011 16:11:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidandroid malwareAndroidMalwaremalwaremobile malwareMobileMalwaresmsSymantec CorporationSymantecCorporationtext messagesText messaging ratesTextMessagesTextMessagingRatesFri, 12 Aug 2011 16:11:00 EST<![CDATA[New Android trojan can record phone calls, expose your embarrassing fantasy baseball talk]]>http://www.engadget.com/2011/08/02/new-android-trojan-can-record-phone-calls-expose-your-embarrass/http://www.engadget.com/2011/08/02/new-android-trojan-can-record-phone-calls-expose-your-embarrass/http://www.engadget.com/2011/08/02/new-android-trojan-can-record-phone-calls-expose-your-embarrass/#commentsMalware PermissionsMobile malware is nothing new, especially for Android users who have trained themselves to navigate the sometimes shady back alleys of the Market. The fine folks at CA Technologies came across an interesting new trojan though, that does something slightly more unnerving than max out your credit cards -- it records your conversations. There's no evidence that this has actually found its way into the wild yet, but it's entirely possible that some nefarious developer could capture your calls and upload them to a remote server. Obviously, this wouldn't hold much interest for your traditional cyber crook, but suspicious significant others and corporate spies could have a field day with such capabilities. All we can do is suggest you remain vigilant and maintain a healthy dose of paranoia about any apps on your phone.

New Android trojan can record phone calls, expose your embarrassing fantasy baseball talk originally appeared on Engadget on Tue, 02 Aug 2011 11:41:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidconversationseavesdropeavesdroppinggooglemalwarephone callsPhoneCallsrecordsecuritytrojanTue, 02 Aug 2011 11:41:00 EST<![CDATA[Google pulls co.cc subdomains from search, brings our global malware nightmare to an end]]>http://www.engadget.com/2011/07/10/google-pulls-co-cc-subdomains-from-search-brings-our-global-mal/http://www.engadget.com/2011/07/10/google-pulls-co-cc-subdomains-from-search-brings-our-global-mal/http://www.engadget.com/2011/07/10/google-pulls-co-cc-subdomains-from-search-brings-our-global-mal/#comments
Google's been on a creative tear lately, rolling out new products and revamping older ones. But there's a reason the phrase "search giant" is synonymous with Big G, and it's always working to return better results. Sometimes that means tweaking its algorithm to prevent SEO-gaming; other times it means dropping over 11 million sites from search results, as the company just did in blocking the .co.cc subdomain. Google classifies it as a "freehost" -- it belongs to a Korean company that provides free or cheap domains, often bulk-registered -- and after automated scanning revealed a high percentage of malware-hosting sites, decided to scrub the entire lot from its results. Of course, this is something like using a nuclear weapon against cockroaches: it causes a lot of collateral damage, while your real target scurries to its next hideout. Still, we wish Google well in its bravely quixotic mission.

Google pulls co.cc subdomains from search, brings our global malware nightmare to an end originally appeared on Engadget on Sun, 10 Jul 2011 14:17:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>googlegoogle searchGoogleSearchmalwaresearchsearch resultsSearchResultssubdomainSun, 10 Jul 2011 14:17:00 EST<![CDATA[Microsoft to malware: your AutoRunning days on Windows are numbered]]>http://www.engadget.com/2011/06/18/microsoft-to-malware-your-autorunning-days-on-windows-are-numbe/http://www.engadget.com/2011/06/18/microsoft-to-malware-your-autorunning-days-on-windows-are-numbe/http://www.engadget.com/2011/06/18/microsoft-to-malware-your-autorunning-days-on-windows-are-numbe/#comments Beware, malware. The Windows AutoRun updates for Vista and XP SP3 that Microsoft released in February have so far proven successful in thwarting your file corrupting ways. Although Windows 7 was updated to disable AutoPlay within AutoRun for USB drives -- freezing the ability for a virus to exploit it -- the aforementioned versions had remained vulnerable up until right after January. Fast-forward to the period between February and May of this year, and the updates have reduced the number of incidents by 1.3 million compared to the three months prior for the supported Vista and XP builds. Amazingly, when stacked against May of last year, there was also a 68 percent decline in the amount of incidents reported across all builds of Windows using Microsoft's Malicious Software Remove Tool. There's another fancy graph after the break to help illustrate, and you'll find two more along with a full breakdown by hitting the source link down under.

Continue reading Microsoft to malware: your AutoRunning days on Windows are numbered

Microsoft to malware: your AutoRunning days on Windows are numbered originally appeared on Engadget on Sat, 18 Jun 2011 21:17:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>auto runautoplayAutoRuncomputer securityComputerSecurityconfickerexploitflash driveFlashDrivemalwaremicrosoftmsrtsecuritythumbdriveupdateusbusb driveUsbDrivevirusvistavunerabilitywindowswindows updatewindows vistawindows xpWindowsUpdateWindowsVistaWindowsXpxpxp sp3XpSp3Sat, 18 Jun 2011 21:17:00 EST<![CDATA[Don't bring your computer viruses to Japan, because they're illegal now]]>http://www.engadget.com/2011/06/17/dont-bring-your-computer-viruses-to-japan-because-theyre-ille/http://www.engadget.com/2011/06/17/dont-bring-your-computer-viruses-to-japan-because-theyre-ille/http://www.engadget.com/2011/06/17/dont-bring-your-computer-viruses-to-japan-because-theyre-ille/#comments Tired of getting swamped with spam and malware? Just pack your things and catch the next flight to Japan, where computer viruses are now considered illegal. Under the country's new legislation, anyone convicted of creating or distributing viruses could face up to three years in prison, or a maximum fine of ¥500,000 (about $6,200). It's all part of Japan's efforts to comply with the Convention on Cybercrime -- an international treaty that requires member governments to criminalize hacking, child pornography, and other terrible things. Privacy advocates, however, have already raised concerns over some stipulations that would allow investigators to seize data from PCs hooked up to allegedly criminal networks, and to retain any suspicious e-mail logs for up to 60 days. In an attempt to quell these fears, the Judicial Affairs Committee tacked a resolution on to the bill calling for police to exercise these powers only when they really, really need to.

Don't bring your computer viruses to Japan, because they're illegal now originally appeared on Engadget on Fri, 17 Jun 2011 13:33:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>computer virusComputerVirusconvention on cybercrimeConventionOnCybercrimecourtcrimecybercrimehackillegaljapanjapaneselawmalwareparliamentpolicepoliticsprivacysecurityspamtreatyvirusFri, 17 Jun 2011 13:33:00 EST<![CDATA[More malware in the Android Market: Google removes 26 deleterious app doppelgangers]]>http://www.engadget.com/2011/06/01/more-malware-in-the-android-market-google-removes-26-deleteriou/http://www.engadget.com/2011/06/01/more-malware-in-the-android-market-google-removes-26-deleteriou/http://www.engadget.com/2011/06/01/more-malware-in-the-android-market-google-removes-26-deleteriou/#commentsIdeally, we'd do our smartphone software shopping free from the specter of malicious apps masquerading as useful ones. This past weekend, however, 26 apps in the Android Market were discovered to be packing pernicious code called Droid Dream Light. Apparently, the dastardly devs who made the malware took existing apps and modified them to send details (including IMEI and IMSI info) about the infected handset to a remote server upon receiving a call. The code can also download and cue new package installations, but it needs user approval to do so. Google promptly pulled the offending apps, but their appearance serves as another reminder to be careful when downloading software on your smartphone -- prudence demands minding your app permissions, lest your little green bot start stealing your personal info.

More malware in the Android Market: Google removes 26 deleterious app doppelgangers originally appeared on Engadget on Wed, 01 Jun 2011 18:19:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidandroid marketAndroidMarketappappsdroid dreamdroid dream lightDroidDreamDroidDreamLightgooglemaliciousmalwaremarketsoftwaretrojan horseTrojanHorseWed, 01 Jun 2011 18:19:00 EST<![CDATA[Apple cracks down on MacDefender, prevents malware downloads with daily quarantine list]]>http://www.engadget.com/2011/06/01/apple-cracks-down-on-macdefender-prevents-malware-downloads-wit/http://www.engadget.com/2011/06/01/apple-cracks-down-on-macdefender-prevents-malware-downloads-wit/http://www.engadget.com/2011/06/01/apple-cracks-down-on-macdefender-prevents-malware-downloads-wit/#comments Preconceptions aside, Apple products do occasionally spread viruses, and not just the biological kind, which is why Cupertino saw fit to equip Mac OS X 10.6 Snow Leopard with a quarantine function to safely set malware aside. This week, however, Apple's kicking those digital white blood cells into high gear, updating that quarantine list daily with a new background process. The company's primarily got its crosshairs on the recent MacDefender scare, of course, but on the off-chance malware starts coming out of the woodwork, it sounds like you won't have to wait for a formal security update to be forewarned of the dangers. If privacy's your primary concern, however, you can also opt-out -- take a gander at our source links to see how it's done.

[Thanks, Jake]

Apple cracks down on MacDefender, prevents malware downloads with daily quarantine list originally appeared on Engadget on Wed, 01 Jun 2011 08:22:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>antivirusAppledailyMacmalwareOS XOsXquarantinesecuritySnow LeopardSnowLeopardupdateupdatesvirusvirusesWed, 01 Jun 2011 08:22:00 EST<![CDATA[Skype taken to task by angry users over claimed crapware payload (update: disabled for now)]]>http://www.engadget.com/2011/05/29/skype-taken-to-task-by-angry-users-over-claimed-crapware-payload/http://www.engadget.com/2011/05/29/skype-taken-to-task-by-angry-users-over-claimed-crapware-payload/http://www.engadget.com/2011/05/29/skype-taken-to-task-by-angry-users-over-claimed-crapware-payload/#comments EasyBits GO The Skype forums are a hive of panic and abuzz with accusations that either the company is bundling crapware with its VoIP app or has a serious security problem. Users are reporting that a strange, new, and difficult to uninstall program is finding its way on to their PCs called EasyBits GO. EasyBits is the company that has powered Skype's games channel since 2006, but at least until now its wares have not been standalone software. One moderator has declared EasyBits Go is not part of Skype and suggested customers immediately run a malware scan, but mods are volunteers and not official representatives of the company, so we're taking it with a grain of salt. Another (later) post from a forum admin simply states that Skype is looking into the issue and will release an official statement, though we have no idea when that might actually happen and we're awaiting reply to our own request for comment.

It appears that a rep from EasyBits Media has taken to the forums to quell some of the outrage, but to no avail. Posts from the team are painfully vague, saying that it was part of an update to the gaming platform and apologizing for the misunderstanding, before linking directly to an .exe that it claims will remove the offending software. To say that forum users are wary of the executable would be an understatement (most responses have involved torrents of profanity). Reports are that the suspicious app is installing itself without any approval from users, but we can't confirm this since any attempts to install in our lab of doom resulted only in errors while downloading. For now, we'll just have to wait for word from Skype, and the company better move quick -- the pain of the recent outage is still fresh in many customers' minds.

Update: Skype has officially confirmed that EasyBits GO was erroneously added to its installer, and says that the buggy update has been disabled for now. Strangely, the official blog suggests that disabling the software is a temporary measure, and that it might reappear soon, as Skype will "work with them to correct the problems and user experience" that led to user qualms.

[Thanks to everyone who sent this in]

Skype taken to task by angry users over claimed crapware payload (update: disabled for now) originally appeared on Engadget on Sun, 29 May 2011 19:37:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>bundlebundledcrapwareEasyBitsEasyBits GoEasyBits MediaEasybitsGoEasybitsMediamalwaresecuritySkypeskype games channelskype pluginskype pluginsSkypeGamesChannelSkypePluginSkypePluginsupdateVoIPSun, 29 May 2011 19:37:00 EST<![CDATA[Samsung reportedly installing keylogger software on laptops (update: it's a false-positive)]]>http://www.engadget.com/2011/03/31/samsung-reportedly-installing-keylogger-software-on-r525-privac/http://www.engadget.com/2011/03/31/samsung-reportedly-installing-keylogger-software-on-r525-privac/http://www.engadget.com/2011/03/31/samsung-reportedly-installing-keylogger-software-on-r525-privac/#comments We'll start by saying that we've reached out to Samsung for a response here, but as of now, no reply has been given -- neither a confirmation nor a refusal of truth. Why bother mentioning that? If this here story proves true, Sammy could have a serious problem on its hands -- a problem that'll definitely start with a rash of negative PR, and a quandary that could very well end the outfit up in the courtroom. According to a report by Mohamed Hassan over at Network World, Samsung allegedly took the initiative to install a keylogger into his recently purchased R525 and R540 laptops. The app was noticed right away after a security scan on both systems, with StarLogger popping up with the c:\windows\SL directory. Where things really get strange is on the support line; reportedly, a supervisor informed Mr. Hassan (after an earlier denial) that the company did indeed install the software at the factory in order to "monitor the performance of the machine and to find out how it is being used." Unfortunately, it's difficult to say if this is a widespread issue, or if the tale is entirely correct, but we get the feeling that Samsung will have little choice but to respond in some form or fashion here shortly. Naturally, we'll keep you abreast of the situation -- meanwhile, you may want to reconsider that hate-filled comment you're about to bang out on your Samsung laptop, and instead, feast your eyes on the video just past the break.

Update: Kudos to Samsung for hitting this head-on. An hour after we inquired for comment, a company spokesperson tossed over this official quote: "Samsung takes Mr. Hassan's claims very seriously. After learning of the original post this morning on NetworkWorld.com, we launched an internal investigation into this issue. We will provide further information as soon as it is available."

Update 2: Samsung's official Korean language blog, Samsung Tomorrow, has a posted an update calling the findings false. According to Samsung, the confusion arose when the VIPRE security software mistakenly identified Microsoft's Slovene language folder ("SL") as Starlogger, which Sammy was able to recreate from an empty c:\windows\SL folder (see image above). So yeah, move along, it's much ado about nothing -- the R525 and R540 laptops are perfectly safe.

Update 3: Even GFI Software has stepped up and confirmed the good news; furthermore, it'll be changing the way it structures things so as not to set off any more false-positives.

Samsung reportedly installing keylogger software on laptops (update: it's a false-positive) originally appeared on Engadget on Thu, 31 Mar 2011 06:07:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>issuekeyloggerlaptopmalwarenotebookprivacyproblemR525samsungsoftwarespywarestarloggertroublevideovipreThu, 31 Mar 2011 06:07:00 EST<![CDATA[Visualized: preconceived notions about personal computer security]]>http://www.engadget.com/2011/03/24/visualized-preconceived-notions-about-personal-computer-securit/http://www.engadget.com/2011/03/24/visualized-preconceived-notions-about-personal-computer-securit/http://www.engadget.com/2011/03/24/visualized-preconceived-notions-about-personal-computer-securit/#comments See that chart up there? That's a beautiful visualization of a dozen folk models surrounding the idea of home computer security, devised by Michigan State's own Rick Wash. To construct it (as well pen the textual explanations to back it), he interviewed a number of computer users with varying levels of sophistication, with the goal being to find out how normal Earthlings interpreted potential threats to their PC. His findings? A vast amount of home PCs are frequently insecure because "they are administered by untrained, unskilled users." He also found that PCs remain largely at risk despite a blossoming network of preventative software and advice, and almost certainly received an A for his efforts. Hit the source link for more, but only after you've spiffed up, thrown on a pair of spectacles and kicked one foot up on the coffee table that sits in front of you.

Visualized: preconceived notions about personal computer security originally appeared on Engadget on Thu, 24 Mar 2011 13:23:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>artbotnethackhackerhackingmaliciousmalwareMichigan StateMichiganStatemodelmodelssecurityspywaretrojanuniversityvirusvisualizedwormThu, 24 Mar 2011 13:23:00 EST<![CDATA[Google spikes 21 malicious apps with big download counts from the Market (update: Android 2.2.2 and up are immune)]]>http://www.engadget.com/2011/03/02/google-spikes-21-malicious-apps-from-the-market-with-big-downloa/http://www.engadget.com/2011/03/02/google-spikes-21-malicious-apps-from-the-market-with-big-downloa/http://www.engadget.com/2011/03/02/google-spikes-21-malicious-apps-from-the-market-with-big-downloa/#commentsWe're sure that the debate of a carefully controlled and curated environment like Apple's App Store versus a free-for-all like the Android Market will rage on for years to come, but here's something to chew on: Google just removed some 21 apps from the Market in the last day from a publisher going by Myournet for doing all sorts of naughty things to your device. Offenses include attempting to root your phone, uploading phone information (including IMEI) to who-knows-where, and -- most egregiously -- adding a backdoor that allows additional code to be pulled down and executed.

At least some of the apps are pirated versions of existing apps that have been re-uploaded at zero cost to the user, which makes them appealing... and the trick apparently works quite well, because the 21 managed to clock over 50,000 downloads before getting taken down. This isn't the first time malicious apps have shown up on smartphones -- far from it -- but it's probably the highest-profile case of a first-party app store being infiltrated by really bad stuff. If there's a silver lining, it's that Google was extraordinarily quick to respond once Android Police reported the situation -- the site says it took less than five minutes from the time they reached out to the time the apps actually went offline. Still, that's little consolation if you've already installed your "free" copy of Super History Eraser. Hit the source links for the full list of pulled apps.

Update: Android Central points out that the type of root exploit used in these apps was patched in Android 2.2.2 and up, so Nexus One and Nexus S owners should be fine; everyone else is left out in the cold, though, thanks to the vexing third-party update lag. Thanks, Z!

Google spikes 21 malicious apps with big download counts from the Market (update: Android 2.2.2 and up are immune) originally appeared on Engadget on Wed, 02 Mar 2011 06:48:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidandroid marketAndroidMarketgooglemaliciousmalwaremarketrootsoftwaretrojan horseTrojanHorseWed, 02 Mar 2011 06:48:00 EST<![CDATA[Microsoft rolls out long, long-awaited Windows update to disable AutoRun for USB drives]]>http://www.engadget.com/2011/02/12/microsoft-rolls-out-long-long-awaited-windows-update-to-disable/http://www.engadget.com/2011/02/12/microsoft-rolls-out-long-long-awaited-windows-update-to-disable/http://www.engadget.com/2011/02/12/microsoft-rolls-out-long-long-awaited-windows-update-to-disable/#commentsIt's already changed the behavior in Windows 7, and Microsoft has now finally rolled out an update for earlier versions of Windows that prevents a program from executing automatically when a USB drive is plugged into a PC. That behavior has been blamed for the spread of malware in recent years -- including the infamous Conficker worm -- and Microsoft had actually already made it possible to disable the functionality back in November of 2009, albeit only through an update available from its Download Center website. It's now finally pushed the update out through the Windows Update channel, though, which should cause it to be much more broadly deployed (particularly in large organizations). As explained in a rather lengthy blog post, however, Microsoft has decided to simply make it an "important, non-security update" rather than a mandatory update, as it doesn't technically see AutoRun as a "vulnerability" -- it was by design, after all. That means you'll have to look for the option in Windows Update and check it off to install it -- if you choose, you can also re-enable it at anytime with a patch.

Microsoft rolls out long, long-awaited Windows update to disable AutoRun for USB drives originally appeared on Engadget on Sat, 12 Feb 2011 23:44:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>autorunmalwaremicrosoftsecuritysoftware updateSoftwareUpdateupdateusbusb driveusb drivesUsbDriveUsbDrivesvistavulnerabilitywindowswindows updatewindows vistawindows xpWindowsUpdateWindowsVistaWindowsXpxpSat, 12 Feb 2011 23:44:00 EST<![CDATA[AT&T, Verizon, RIM get serious about security for mobile devices]]>http://www.engadget.com/2010/12/23/atandt-verizon-rim-get-serious-about-security-for-mobile-devices/http://www.engadget.com/2010/12/23/atandt-verizon-rim-get-serious-about-security-for-mobile-devices/http://www.engadget.com/2010/12/23/atandt-verizon-rim-get-serious-about-security-for-mobile-devices/#comments As commonplace as smartphones have become, it's about time that carriers and manufacturers start getting serious about mobile security (and no, we don't mean iPhone tethers). According to a recent Wall Street Journal article, Verizon is currently working with Lookout, a San Francisco-based company known for remote backup and geolocation apps for BlackBerry, Android, and Windows Mobile devices, while RIM has recently announced a little something called BlackBerry Protect, which promises to lock or even wipe a misplaced phone, pinpoint the thing on a map, and make regularly-scheduled wireless backups. By far the most ambitious plans in the article, however, belong to AT&T, which -- aside from recent deals with MobileIron and McAfee -- is currently opening a new mobile security lab in New York City. From here, the company will research malware, worms, viruses, and other threats as they develop in the mobile sphere. "Everyone is realizing that this is an uncontrolled environment," said AT&T chief security officer Edward G. Amoroso. "We don't want to have the same problems that we had with PCs."

AT&T, Verizon, RIM get serious about security for mobile devices originally appeared on Engadget on Thu, 23 Dec 2010 13:22:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>androidattblackberryblackberry protectBlackberryProtectcellphoneslookoutmalwaremcafeemobilemobileironrimsecuritysoftwareverizonvirusvzwwindows mobileWindowsMobilewormThu, 23 Dec 2010 13:22:00 EST<![CDATA[Google hacked site notification notifies you if your site is hacked (repeat this five times fast)]]>http://www.engadget.com/2010/12/19/google-hacked-site-notification-notifies-you-if-your-site-is-hac/http://www.engadget.com/2010/12/19/google-hacked-site-notification-notifies-you-if-your-site-is-hac/http://www.engadget.com/2010/12/19/google-hacked-site-notification-notifies-you-if-your-site-is-hac/#comments
Those crazy cats at Google have been tinkerin' with the search results quite a bit lately: in addition to the old standbys (malware notifications, updated image search), the company has recently rolled out Instant Search, Instant Preview... and now? That's right: hacked site notifications in the search results. According to the Webmaster Central blog, the company uses "a variety of automated tools to detect common signs of a hacked site," and if you have a Webmaster Tools account you'll even be notified of the breach. Hit the source link for more info.

Google hacked site notification notifies you if your site is hacked (repeat this five times fast) originally appeared on Engadget on Sun, 19 Dec 2010 09:06:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>googlegoogle webmaster centralgoogle webmaster toolsGoogleWebmasterCentralGoogleWebmasterToolshackhackedhacked site notificationHackedSiteNotificationinternetmalwaresearch resultsSearchResultswebmaster centralwebmaster toolsWebmasterCentralWebmasterToolsSun, 19 Dec 2010 09:06:00 EST<![CDATA[Chrome sandboxes Flash Player in latest Dev channel release for Windows]]>http://www.engadget.com/2010/12/02/chrome-sandboxes-flash-player-in-latest-dev-channel-release-for/http://www.engadget.com/2010/12/02/chrome-sandboxes-flash-player-in-latest-dev-channel-release-for/http://www.engadget.com/2010/12/02/chrome-sandboxes-flash-player-in-latest-dev-channel-release-for/#comments Hey, Adobe's finally figured out how to make Flash secure -- have Google do it! The guys behind your favorite search engine have updated their latest Dev channel release of Chrome to include a new sandboxing facility for Flash Player content. It'll serve to limit access to sensitive system resources and make Flash's operation a generally less threatening proposition than it currently is. This also marks the fulfillment of a longstanding promise from Google to give Flash the same treatment it's afforded to JavaScript and HTML rendering for a while, and should be welcome news to Windows users eager to minimize "the potential attack surface" of their browser. Sorry, Mac fans, you're out in the unsecured cold for now. Of course, the Dev channel itself is one step less refined than beta software, so even if you're on Windows it might be advisable to wait it out a little bit.

Chrome sandboxes Flash Player in latest Dev channel release for Windows originally appeared on Engadget on Thu, 02 Dec 2010 05:50:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>adobebrowserbrowser securityBrowserSecuritychromechromiumcontentdev channelDevChannelflashflash playerFlashPlayerinternetmalwarerich mediaRichMediasandboxsecuritywebwindowsThu, 02 Dec 2010 05:50:00 EST<![CDATA[Mac malware survey finds mostly incompatible nasties]]>http://www.engadget.com/2010/11/24/mac-malware-survey-finds-mostly-incompatible-nasties/http://www.engadget.com/2010/11/24/mac-malware-survey-finds-mostly-incompatible-nasties/http://www.engadget.com/2010/11/24/mac-malware-survey-finds-mostly-incompatible-nasties/#comments See that chart there? That's a lovely graphic conjured up by Sophos, a company that makes ends meet by offering anti-virus software. The company just so happens to also have a flavor for OS X, and based on data culled from 150,000 users, it looks as if 50,000 machines had at least one piece of malware onboard. 'Course, a sizable chunk of these listed (Mal/ASFDldr-A and Mal/Conficker-A, for example) won't even run on OS X, so having them on one's HDD does little more than take up a section of space that could otherwise be used to archive a digital image of Aunt Mary. Graham Cluley, senior technology consultant at Sophos, even stated that Sophos doesn't "see as much Mac malware as Windows malware... by a long shot," but given that its Mac edition software is totally free, you might as well give it a look if you're suddenly stricken with paranoia.

Mac malware survey finds mostly incompatible nasties originally appeared on Engadget on Wed, 24 Nov 2010 16:33:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>applemacmalwareos xOsXsecuritysoftwaresophossurveyvirusWed, 24 Nov 2010 16:33:00 EST<![CDATA[Report warns of the increased use of SEO Poisoning to spread malware]]>http://www.engadget.com/2010/11/10/report-warns-of-the-increased-use-of-seo-poisoning-to-spread-mal/http://www.engadget.com/2010/11/10/report-warns-of-the-increased-use-of-seo-poisoning-to-spread-mal/http://www.engadget.com/2010/11/10/report-warns-of-the-increased-use-of-seo-poisoning-to-spread-mal/#comments
You'll undoubtedly be excited to know that the Internet security firm Websense has recently released its annual Threat Report. Other than trying to scare you into buying every single product the company has ever released, the paper highlights the growing problem of Black Hat SEO, or SEO Poisoning, which (if done right) sends malware-ridden links closer to the top of your Google search results. According to Network World, some 22.4 percent of Google searches performed since June produced malicious URLs (such as fake antivirus sites or malware downloads) as part of the top 100 search results, as opposed to 13.7 percent in the second half of 2009. It seems that the old model of cyber-attacks, involving peer-to-peer virus infection, is becoming increasingly ineffective as anti-virus companies step up their game, causing nogoodniks to rely on search results, websites, and zero-day attacks. That said, there is a silver lining: as Network World goes on to explain, these days you are actually less likely to get malware from "adult content" sites than in previous years. Or should we say, that's good news for your "friend" or "co-worker."

Report warns of the increased use of SEO Poisoning to spread malware originally appeared on Engadget on Wed, 10 Nov 2010 16:34:00 EST. Please see our terms for use of feeds.

Permalink | Email this | Comments]]>black hat seoBlackHatSeointernetmalwarenetworkingsecurityseoseo poisoningSeoPoisoningtrojanvirusWed, 10 Nov 2010 16:34:00 EST