Last week, we’ve seen quite a number of in-the-wild exploits that affect systems installed with unpatched Adobe Flash Player—one via direct exploitation and another via malicious advertisements—and Internet Explorer (IE). Users of Malwarebytes Anti-Exploit are protected from these particular attacks, which we have detailed in the following blog posts by Senior Security Researcher Jérôme Segura:
- ‘Flash EK’ skips landing page, goes Flash all the way
- Fileless Infections from Exploit Kit: An Overview
- Yet another case of malvertising on The Pirate Bay – file downloaded by the exploit is detected as Trojan.Ransom.ED, a ransomware binary
Segura has commented on the recently found Bash or Shellshock vulnerability that is found in Linux and OSX systems as well. Some say it’s as bad as the Heartbleed flaw found in April 2014.
Viator, a service that aims at travellers who want to know local and overseas tours, has been breached, affecting approximately 1.4 million of its users. Malware Intelligence Analyst Christopher Boyd reports about this plus some tips for potential victims on what to do following the compromise. Below are other notable posts by Boyd:
Speaking of Facebook, Senior Security Researcher Nathan Collier took a stab on Facebook Messenger‘s permissions for mobile devices. There have been talks of users in the social network to bin off the said app because of its invasiveness; however, Collier has set the record straight.
Finally, we have updated our big blog about Steam last week to discuss one of the malicious files we were able to retrieve and analyze. We have also found and wrote about a new Steam scam that entices users to give out personal information in exchange for credits for their Steam account wallet.
Notable news stories:
- eBay under pressure as hacks continue. “Leading security researchers have called on eBay to take immediate action over dangerous listings, as the problem continues to put users at risk.” (Source: BBC)
- Productivity Gains Trumping Security as BYOD Grows. “Organizations surveyed said they believe that in the next 12 months as many as 48 percent of employees will work exclusively from personal tablets and smartphones. Some 60 percent of those surveyed think that employees are becoming less diligent about practising good security on mobile devices.” (Source: Threatpost)
- How surveillance cameras will soon be reading your lips. “A security specialist Ahmad Hassanat from the University of Jordan, has developed an exclusive automated lip-reading system which will be able to record your lip movements and read what you are saying.” (Source: HackRead)
- Hacking the Hackers: The Legal Risks of Taking Matters Into Private Hands. “Private groups are beginning to fight back against foreign sources of malware and credit fraud, but methodologies put these digital crusaders and their employers at serious legal risk.” (Source: Information Week)
- Disgruntled employees are increasingly e-sabotaging businesses, FBI says. “Employees with an axe to grind are increasingly sticking it to their current or former employers using e-tools such as cloud storage sites or remote access to a company’s computer network, the US Federal Bureau of Investigation and Homeland Security Department said on Tuesday.” (Source: Sophos’ Naked Security Blog)
- Banks get cyber attack early warning system. “The British Bankers’ Association (BBA) has commissioned BAE Systems Applied Intelligence to create a system that will give banks early warning of cyber threats.” (Source: Computer Weekly)
- Fitness App Patches Privacy Vulnerability. “MyFitnessPal deployed a fix on June 26 for a privacy flaw in an undocumented API that was reported two days earlier by Randy Westergren Jr., a software developer at XDA Developers. Bigger picture, this is more evidence of mobile applications extending their reach when it comes to consuming a user’s personal and device information.” (Source: Threatpost)
- More enterprises are using selective wiping to protect corporate data, employee privacy. “More enterprises are using selecting wiping of mobile devices as a way to protect corporate data while safeguarding employee privacy, according to a study by Fiberlink, IBM’s mobile device management (MDM) unit.” (Source: FierceMobileIT)
Stay safe, everyone!
The Malwarebytes Labs Team
