Monday

Cryptowall is infecting through .chm file attachments

A new variant of Cryptowall (advanced version of Cryptolocker) is now infecting systems through a malicious .chm file. CHM is a fileformat that contains compressed html, including javascript. If the user access the .chm file the content is executed and download an malicious .exe file from the attackers domain.

The problem is that .chm files are often overlooked when mailservers scans attachments, leaving the endpoins AV as the one and only protection mechanism.

http://www.net-security.org/malware_news.php?id=2981&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+HelpNetSecurity+%28Help+Net+Security%29

Skype worm reloaded

A new Skype worm called W32/Skyper.A.Worm is now spreading through the popular Voice / Messenger client. If you get a popup in your Skype that want you to go look at some funny video or picture of yourself, dont click the link!

This is one of the oldest trick in the book, but it seems that it still works.

http://www.pandasecurity.com/mediacenter/malware/skype-worm-reloaded/

uTorrent installs litecoin miner

It seems that the latest version of uTorrent is bundled with unwanted software. In this case it is the Epicscale litecoin miner which use spare CPU to mine for litecoins in the background. The problem with this bundle is that is has been installed without notifying the user, and the uninstaller does not remove the software.

http://forum.utorrent.com/topic/95041-warning-epicscale-riskware-installed-with-latest-utorrent/

Tuesday

Apple security updates

Apple released security updates to iOS, Apple TV, Xcode and 10.8/10.9/10.10. One of the most important is probably patching for the Freak SSL vulnerability which means that some of the previously used ciphers are disabled. The iCloud keychain is also patched for a vulnerability that allowed remote code execution due to an buffer overflow.

https://support.apple.com/en-us/HT1222

Google exploit the DRAM rowhammer bug to gain kernel priviliges

http://googleprojectzero.blogspot.no/2015/03/exploiting-dram-rowhammer-bug-to-gain.html

Seagate with advice on how to secure your NAS

Seagate confirms NAS code execution flaw in ther Seagate Business Storage NAS. It will probably take some week before an patch is ready, so while waiting you should take countermeasures to protect your storage device.

http://knowledge.seagate.com/articles/en_US/FAQ/006133en?language=en_US

Wednesday

Microsoft patch tuesday

This month there is a total of 14 bulletins, patching 46 vulnerabilites. I will list the bulletins that are rated as critical.

• MS15-18 is the Internet Explorer patch which fix several vulnerabilities, one of them already publicly disclosed (but no exploits seen yet).
• MS15-19 is remote code execution in VBScript.
• MS15-20 is remote code execution via unsecure DLL files, which is an old vulnerability used by the Stuxnet worm.
• MS15-21 is remote code execution via Adobe Font Drivers.
• MS15-22 is remote code exectuion in Office.

And there is also an patch for the Freak vulnerability in SChannel (MS15-31) that means that you will get some old ciphers disabled.

https://isc.sans.edu/forums/diary/Microsoft+March+Patch+Tuesday/19445/

Threatglass offers pcap files with exploit kit activity

If you need examples of exploit kit activity you can try search the Threatglass website.

Threatglass by Barracuda (NYSE: CUDA) is an online tool for sharing, browsing and analyzing web-based malware. Threatglass allows users to graphically browse website infections by viewing screenshots of the stages of infection, as well as by analyzing network characteristics such as host relationships and packet captures.

http://threatglass.com

Thursday

GnuPG project is hiring a second developer

Due to a fundraising project the GnuPG project now has enough money to run the development of the project the next 2-3 years. The inital goal was reached but donations is still flowing so a second developer is now hired to work on the project.

https://www.gnupg.org/blog/20150310-gnupg-in-february.html

Remotely exploitable vulnerability in the Android Dropbox SDK

Researchers at IBM's application security team discovered a vulnerability that allows an attacker to connect applications on mobile devices to a Dropbox account controlled by the attacker without the victim’s knowledge or authorization.

The vulnerability can be exploited in two ways, using a malicious app installed on the user’s device or remotely using drive-by techniques. It cannot, however, be exploited if the Dropbox app is installed on the device.

http://securityintelligence.com/droppedin-remotely-exploitable-vulnerability-in-the-dropbox-sdk-for-android#.VQX88jiFfLL

Friday

Adobe Flash Player update

Update your Flash Player as soon as possible. This one is rated as 1 for Mac and Windows, which means there are targeted attacks already.

https://helpx.adobe.com/security/products/flash-player/apsb15-05.html

Mozilla introduce memory scanning utility for server security

A tool developed internally at mozilla to help protect their servers. The tool is scanning the serversmemory for vulnerable libraries and malicious code. An example scenario that the tool will help detect is where servers are patched, but the old vulnerable libararies are still present in memory if due to lack of reload / reboot.

This tool is part of a bigger project called Mozilla Investigator, a security suite aimed at servers and big server farms.

https://blog.mozilla.org/security/2015/03/12/introducing-masche-memory-scanning-for-server-security/