Security Through Obscurity

UBIC Launches Global Forensics Team

2013-11-08T23:48:00.001+04:00

UBIC, a provider of strategic international litigation support through CJK TAR™(Technology Assisted Review) and forensic solutions, announced today the launch of Global Forensics Services, a globally deployed team of highly experienced, certified investigators supported with dedicated facilities in Asia and North America.

In support of its Global Forensics Services team, UBIC recently opened a state-of-the-art forensics laboratory in Silicon Valley, Calif., which complements its facility in Asia.

A global provider of eDiscovery services and solutions, UBIC built and maintained a formidable forensics capability over the past ten years to meet the needs of its global corporate and international law firm clients. Now, as evidence discovery pushes beyond a corporation’s own data network into an ever-expanding digital landscape that includes third-party enterprise networks, social media and personal digital devices, UBIC has focused its industry-leading computer forensics experience and capabilities into a dedicated, highly experienced team of consultants and examiners, most drawn from existing functions within UBIC’s world-leading eDiscovery business.

“We are taking this step to provide our clients a dedicated, strategic ally in managing the formidable, complex challenges related to large-scale, global investigations,” UBIC Chairman and Chief Executive Officer Masahiro Morimoto stated.

Combined with similar facilities and experts in Asia and the company’s recently released Xaminer™ forensics software, UBIC has materially expanded its capacity to meet fast-growing demand for sophisticated forensic investigation services.

Corporate Forensics Services, a Growth Industry

Business news reports over the past 12 months establish a trend of increased attention by governments to cross-border business practices and transactions, a result of rigorous and far-reaching laws and regulations put in place by individual nations and multinational regulatory organizations to govern the activities of corporations and the behaviors their employees.

UBIC’s Global Forensic Team consults with international corporations efficiently and strategically to manage the intensive, high-stakes demands of internal as well as government-initiated investigations, in addition to preparing for the litigation of multi-million dollar lawsuits.

“Whether to conduct investigations, evaluate data or provide expert testimony, UBIC can deploy its forensics team representatives in a matter of hours to jurisdictions virtually anywhere in the world,” stated Mr. Naritomo Ikeue, President and COO, UBIC North America, Inc. “The manner in which such investigations are conducted, can have enormous impact on a particular business as well as the reputation and valuation of an entire corporation.”

Specialized Expertise & Experience Defines UBIC Services and Solutions
The new unit offers a host of specialized competencies including the ability to conduct a thorough incident response investigation involving the identification and collection of evidence from multiple and far-flung corporate information networks as well as individual employees’ personal digital devices including smartphones.

UBIC’s Global Forensic Services team is supported with state-of-the-art analytical software, including UBIC’s own Xaminer™ forensics suite and its Lit i View™ data processing, search and review platform.

With these tools UBIC’s Global Forensics Services team can identify and manage vast volumes of data in multiple languages to quickly categorize, evaluate and rank the relevance of information and communications relative to a particular investigative focus, issue or concern.

About UBIC

UBIC, Inc. (TSE: 2158; NASDAQ: UBIC) is a leading provider of Asian-language eDiscovery, forensic solutions and services. UBIC has extensive eDiscovery and forensic experience and expertise with information documented in Japanese, Korean, Chinese as well as English languages, and applies its expertise in connection with cross-border litigation, administrative proceedings and internal investigations, including those related to anti-trust investigations, intellectual property (IP) litigation, the Foreign Corrupt Practices Act (FCPA) and product liability (PL) investigations. UBIC serves its clients from offices in Japan, the United States, South Korea, Taiwan, Hong Kong and the United Kingdom.

UBIC’s proprietary technology platform, Lit i View™, version 6.7, is an innovative eDiscovery solution that accurately handles Asian-language characters, encoding schemes and native file systems. UBIC also recently launched its flexible and customizable Legal Cloud™ service to address the problem of rising costs associated with the growth and dispersion of data volumes across the globe, along with prolonged investigations and litigations.

With flexible, customizable end-to-end solutions and services covering the entire electronic discovery reference model (EDRM) life-cycle for corporate litigation strategy and crisis management, UBIC has assisted clients in more than 310 administrative and legal proceedings in the United States, including Department of Justice (DOJ), International Trade Commission (ITC) and Securities and Exchange Commission (SEC) investigations and more than 700 corporate investigations in Japan, South Korea, China, Taiwan and Singapore. Assisted by highly experienced litigation attorneys, UBIC provides a range of services facilitating fact discovery, patent management, security, internal audit and regulatory compliance that can provide a significant cost savings to its clients.

Source: http://www.prweb.com/releases/2013/11/prweb11311200.htm

Secret Files Expose Offshore’s Global Impact

2013-04-04T19:59:00.001+04:00

Dozens of journalists sifted through millions of leaked records and thousands of names to produce ICIJ’s investigation into offshore secrecy 

A cache of 2.5 million files has cracked open the secrets of more than 120,000 offshore companies and trusts, exposing hidden dealings of politicians, con men and the mega-rich the world over.

The secret records obtained by the International Consortium of Investigative Journalists lay bare the names behind covert companies and private trusts in the British Virgin Islands, the Cook Islands and other offshore hideaways.

They include American doctors and dentists and middle-class Greek villagers as well as families and associates of long-time despots, Wall Street swindlers, Eastern European and Indonesian billionaires, Russian corporate executives, international arms dealers and a sham-director-fronted company that the European Union has labeled as a cog in Iran’s nuclear-development program.

The leaked files provide facts and figures — cash transfers, incorporation dates, links between companies and individuals — that illustrate how offshore financial secrecy has spread aggressively around the globe, allowing the wealthy and the well-connected to dodge taxes and fueling corruption and economic woes in rich and poor nations alike.

The records detail the offshore holdings of people and companies in more than 170 countries and territories.

The hoard of documents represents the biggest stockpile of inside information about the offshore system ever obtained by a media organization. The total size of the files, measured in gigabytes, is more than 160 times larger than the leak of U.S. State Department documents by Wikileaks in 2010.

To analyze the documents, ICIJ collaborated with reporters from The Guardian and the BBC in the U.K., Le Monde in France, Süddeutsche Zeitung and Norddeutscher Rundfunk in Germany, The Washington Post, the Canadian Broadcasting Corporation (CBC) and 31 other media partners around the world.

Eighty-six journalists from 46 countries used high-tech data crunching and shoe-leather reporting to sift through emails, account ledgers and other files covering nearly 30 years.

“I’ve never seen anything like this. This secret world has finally been revealed,” said Arthur Cockfield, a law professor and tax expert at Queen’s University in Canada, who reviewed some of the documents during an interview with the CBC. He said the documents remind him of the scene in the movie classic The Wizard of Oz in which “they pull back the curtain and you see the wizard operating this secret machine.”

Mobsters and Oligarchs

The vast flow of offshore money — legal and illegal, personal and corporate — can roil economies and pit nations against each other. Europe’s continuing financial crisis has been fueled by a Greek fiscal disaster exacerbated by offshore tax cheating and by a banking meltdown in the tiny tax haven of Cyprus, where local banks’ assets have been inflated by waves of cash from Russia.

Anti-corruption campaigners argue that offshore secrecy undermines law and order and forces average citizens to pay higher taxes to make up for revenues that vanish offshore. Studies have estimated that cross-border flows of global proceeds of financial crimes total between $1 trillion and $1.6 trillion a year.

ICIJ’s 15-month investigation found that, alongside perfectly legal transactions, the secrecy and lax oversight offered by the offshore world allows fraud, tax dodging and political corruption to thrive.

Offshore patrons identified in the documents include:

Individuals and companies linked to Russia’s Magnitsky Affair, a tax fraud scandal that has strained U.S.-Russia relations and led to a ban on Americans adopting Russian orphans.
A Venezuelan deal maker accused of using offshore entities to bankroll a U.S.-based Ponzi scheme and funneling millions of dollars in bribes to a Venezuelan government official.
A corporate mogul who won billions of dollars in contracts amid Azerbaijani President Ilham Aliyev’s massive construction boom even as he served as a director of secrecy-shrouded offshore companies owned by the president’s daughters.
Indonesian billionaires with ties to the late dictator Suharto, who enriched a circle of elites during his decades in power.

The documents also provide possible new clues to crimes and money trails that have gone cold.

After learning ICIJ had identified the eldest daughter of the late dictator Ferdinand Marcos, Maria Imelda Marcos Manotoc, as a beneficiary of a British Virgin Islands (BVI) trust, Philippine officials said they were eager to find out whether any assets in the trust are part of the estimated $5 billion her father amassed through corruption.

Manotoc, a provincial governor in the Philippines, declined to answer a series of questions about the trust.

Politically connected wealth

Maria Imelda Marcos Manotoc

The files obtained by ICIJ shine a light on the day-to-day tactics that offshore services firms and their clients use to keep offshore companies, trusts and their owners under cover.

Tony Merchant, one of Canada’s top class-action lawyers, took extra steps to maintain the privacy of a Cook Islands trust that he’d stocked with more than $1 million in 1998, the documents show.

In a filing to Canadian tax authorities, Merchant checked “no” when asked if he had foreign assets of more than $100,000 in 1999, court records show.

Between 2002 and 2009, he often paid his fees to maintain the trust by sending thousands of dollars in cash and traveler’s checks stuffed into envelopes rather than using easier-to-trace bank checks or wire transfers, according to documents from the offshore services firm that oversaw the trust for him.

One file note warned the firm’s staffers that Merchant would “have a st[r]oke” if they tried to communicate with him by fax.

Tony Merchant.

It is unclear whether his wife, Pana Merchant, a Canadian senator, declared her personal interest in the trust on annual financial disclosure forms.

Under legislative rules, she had to disclose every year to the Senate’s ethics commissioner that she was a beneficiary of the trust, but the information was confidential.

The Merchants declined requests for comment.

Other high profile names identified in the offshore data include the wife of Russia’s deputy prime minister, Igor Shuvalov, and two top executives with Gazprom, the Russian government-owned corporate behemoth that is the world’s largest extractor of natural gas.

Shuvalov’s wife and the Gazprom officials had stakes in BVI companies, documents show. All three declined comment.

In a neighboring land, the deputy speaker of Mongolia’s Parliament said he was considering resigning from office after ICIJ questioned him about records showing he has an offshore company and a secret Swiss bank account.

“I shouldn’t have opened that account,” Bayartsogt Sangajav, who has also served as his country’s finance minister, said. “I probably should consider resigning from my position.”

Bayartsogt said his Swiss account at one point contained more than $1 million, but most of the money belonged to what he described as “business friends” he had joined in investing in international stocks.

He acknowledged that he hasn’t officially declared his BVI company or the Swiss account in Mongolia, but he said he didn’t avoid taxes because the investments didn’t produce income.

“I should have included the company in my declarations,” he said.

Wealthy Clients

The documents also show how the mega-rich use complex offshore structures to own mansions, art and other assets, gaining tax advantages and anonymity not available to average people.

Baroness Carmen Thyssen-Bornemisza.

Spanish names include a baroness and famed art patron, Carmen Thyssen-Bornemisza, who is identified in the documents using a company in the Cook Islands to buy artwork through auction houses such as Sotheby’s and Christie’s, including Van Gogh’s Water Mill at Gennep.

Her attorney acknowledged that she gains tax benefits by holding ownership of her art offshore, but stressed that she uses tax havens primarily because they give her “maximum flexibility” when she moves art from country to country.

Among nearly 4,000 American names is Denise Rich, a Grammy-nominated songwriter whose ex-husband was at the center of an American pardon scandal that erupted as President Bill Clinton left office.

A Congressional investigation found that Rich, who raised millions of dollars for Democratic politicians, played a key role in the campaign that persuaded Clinton to pardon her ex-spouse, Marc Rich, an oil trader who had been wanted in the U.S. on tax evasion and racketeering charges.

Denise Rich.

Records obtained by ICIJ show she had $144 million in April 2006 in a trust in the Cook Islands, a chain of coral atolls and volcanic outcroppings nearly 7,000 miles from her home at the time in Manhattan.

The trust’s holdings included a yacht called the Lady Joy, where Rich often entertained celebrities and raised money for charity.

Rich, who gave up her U.S. citizenship in 2011 and now maintains citizenship in Austria, did not reply to questions about her offshore trust.

Another prominent American in the files who gave up his citizenship is a member of the Mellon dynasty, which started landmark companies such as Gulf Oil and Mellon Bank. James R. Mellon – an author of books about Abraham Lincoln and his family’s founding patriarch, Thomas Mellon – used four companies in the BVI and Lichtenstein to trade securities and transfer tens of millions of dollars among offshore bank accounts he controlled.

Like many offshore players, Mellon appears to have taken steps to distance himself from his offshore interests, the documents show. He often used third parties’ names as directors and shareholders of his companies rather than his own, a legal tool that owners of offshore entities often use to preserve anonymity.

James R. Mellon.

Reached in Italy where lives part of the year, Mellon told ICIJ that, in fact, he used to own “a whole bunch” of offshore companies but has disposed of all of them. He said he set up the firms for “tax advantage” and liability reasons, as advised by his lawyer. “But I have never broken the tax law.”

Of the use of nominees, Mellon said that “that’s the way these firms are set up,” and added that it’s useful for people like him who travel a lot to have somebody else in charge of his businesses. “I just heard of a presidential candidate who had a lot of money in the Cayman Islands,” Mellon, now a British national, said, alluding to former U.S. presidential candidate Mitt Romney.

“Not everyone who owns offshores is a crook.”

Offshore growth

The anonymity of the offshore world makes it difficult to track the flow of money. A study by James S. Henry, former chief economist at McKinsey & Company, estimates that wealthy individuals have $21 trillion to $32 trillion in private financial wealth tucked away in offshore havens — roughly equivalent to the size of the U.S. and Japanese economies combined.

Even as the world economy has stumbled, the offshore world has continued to grow, said Henry, who is a board member of the Tax Justice Network, an international research and advocacy group that is critical of offshore havens. His research shows, for example, that assets managed by the world’s 50 largest “private banks” — which often use offshore havens to serve their “high net worth” customers — grew from $5.4 trillion in 2005 to more than $12 trillion in 2010.

Henry and other critics argue that offshore secrecy has a corrosive effect on governments and legal systems, allowing crooked officials to loot national treasuries and providing cover to human smugglers, mobsters, animal poachers and other exploiters.

Offshore’s defenders counter that most offshore patrons are engaged in legitimate transactions. Offshore centers, they say, allow companies and individuals to diversify their investments, forge commercial alliances across national borders and do business in entrepreneur-friendly zones that eschew the heavy rules and red tape of the onshore world.

“Everything is much more geared toward business,” David Marchant, publisher of OffshoreAlert, an online news journal, said. “If you’re dishonest you can take advantage of that in a bad way. But if you’re honest you can take advantage of that in a good way.”

Much of ICIJ’s reporting focused on the work of two offshore firms, Singapore-based Portcullis TrustNet and BVI-based Commonwealth Trust Limited (CTL), which have helped tens of thousands of people set up offshore companies and trusts and hard-to-trace bank accounts.

Regulators in the BVI found that CTL repeatedly violated the islands’ anti-money-laundering laws between 2003 and 2008 by failing to verify and record its clients’ identities and backgrounds. “This particular firm had systemic money laundering issues within their organization,” an official with the BVI’s Financial Services Commission said last year.

The documents show, for example, that CTL set up 31 companies in 2006 and 2007 for an individual later identified in U.K. court claims as a front man for Mukhtar Ablyazov, a Kazakh banking tycoon who has been accused of stealing $5 billion from one of the former Russian republic’s largest banks. Ablyazov denies wrongdoing.

Thomas Ward, a Canadian who co-founded CTL in 1994 and continues to work as a consultant to the firm, said CTL’s client-vetting procedures have been consistent with industry standards in the BVI, but that no amount of screening can ensure that firms such as CTL won’t be “duped by dishonest clients” or sign on “someone who appears, to all historical examination, to be honest” but “later turns to something dishonest.”

“It is wrong, though perhaps convenient, to demonize CTL as by far the major problem area,” Ward said in a written response to questions. “Rather I believe that CTL’s problems were, by and large, directly proportional to its market share.”

ICIJ’s review of TrustNet documents identified 30 American clients accused in lawsuits or criminal cases of fraud, money laundering or other serious financial misconduct. They include ex-Wall Street titans Paul Bilzerian, a corporate raider who was convicted of tax fraud and securities violations in 1989, and Raj Rajaratnam, a billionaire hedge fund manager who was sent to prison in 2011 in one of the biggest insider trading scandals in U.S. history.

TrustNet declined to answer a series of questions for this article.

Blacklisted

The records obtained by ICIJ expose how offshore operatives help their customers weave elaborate financial structures that span countries, continents and hemispheres.

A Thai government official with links to an infamous African dictator used Singapore-based TrustNet to set up a secret company for herself in the BVI, the records show.

Nalinee Taveesin.The Thai official, Nalinee “Joy” Taveesin, is currently Thailand’s international trade representative. She served as a cabinet minister for Prime Minister Yingluck Shinawatra before stepping down last year.

Taveesin acquired her BVI company in August 2008. That was seven months after she’d been appointed an advisor to Thailand’s commerce minister — and three months before the U.S. Department of Treasury blacklisted her as a “crony” of Zimbabwean dictator Robert Mugabe.

The Treasury Department froze her U.S. assets, accusing her of “secretly supporting the kleptocratic practices of one of Africa’s most corrupt regimes” through gem trafficking and other deals made on behalf of Mugabe’s wife, Grace, and other powerful Zimbabweans.

Taveesin has said her relationship with the Mugabes is “strictly social” and that the U.S. blacklisting is a case of guilt by association. Through her secretary, Taveesin flatly denied that she owns the BVI company. ICIJ verified her ownership using TrustNet records that listed her and her brother as shareholders of the company and included the main address in Bangkok for her onshore business ventures.

Records obtained by ICIJ also reveal a secret company belonging to Muller Conrad “Billy” Rautenbach, a Zimbabwean businessman who was blacklisted by the U.S. for his ties to the Mugabe regime at the same time as Taveesin. The Treasury Department said Rautenbach has helped organize huge mining projects in Zimbabwe that “benefit a small number of corrupt senior officials.”

When CTL set Rautenbach up with a BVI company in 2006 he was a fugitive, fleeing fraud allegations in South Africa. The charges lodged personally against him were dismissed, but a South African company he controlled pleaded guilty to criminal charges and paid a fine of roughly $4 million.

Rautenbach denies U.S. authorities’ allegations, contending that they made “significant factual and legal errors” in their blacklisting decision, his attorney, Ian Small Smith, said. Smith said Rautenbach’s BVI company was set up as “special purpose vehicle for investment in Moscow” and that it complied with all disclosure regulations. The company is no longer active.

‘One Stop Shop’

Offshore’s customers are served by a well-paid industry of middlemen, accountants, lawyers and banks that provide cover, set up financial structures and shuffle assets on their clients’ behalf.

Documents obtained by ICIJ show how two top Swiss banks, UBS and Clariden, worked with TrustNet to provide their customers with secrecy-shielded companies in the BVI and other offshore centers.

Clariden, owned by Credit Suisse, sought such high levels of confidentiality for some clients, the records show, that a TrustNet official described the bank’s request as “the Holy Grail” of offshore entities — a company so anonymous that police and regulators would be “met with a blank wall” if they tried to discover the owners’ identities.

Clariden declined to answer questions about its relationship with TrustNet.

“Because of Swiss banking secrecy laws, we are not allowed to provide any information about existing or supposed accountholders,” the bank said. “As a general rule, Credit Suisse and its related companies respect all the laws and regulations in the countries in which they are involved.”

A spokesperson for UBS said the bank applies “the highest international standards” to fight money laundering, and that TrustNet “is one of over 800 service providers globally which UBS clients choose to work with to provide for their wealth and succession planning needs. These service providers are also used by clients of other banks.”

TrustNet describes itself as a “one-stop shop” — its staff includes lawyers, accountants and other experts who can shape secrecy packages to fit the needs and net worths of its clients. These packages can be simple and cheap, such as a company chartered in the BVI. Or they can be sophisticated structures that weave together multiple layers of trusts, companies, foundations, insurance products and so-called “nominee” directors and shareholders.

When they create companies for their clients, offshore services firms often appoint faux directors and shareholders — proxies who serve as stand-ins when the real owners of companies don’t want their identities known. Thanks to the proliferation of proxy directors and shareholders, investigators tracking money laundering and other crimes often hit dead ends when they try to uncover who is really behind offshore companies.

An analysis by ICIJ, the BBC and The Guardian identified a cluster of 28 “sham directors” who served as the on-paper representatives of more than 21,000 companies between them, with individual directors representing as many 4,000 companies each.

Among the front men identified in the documents obtained by ICIJ is a U.K.-based operative who served as a director for a BVI company, Tamalaris Consolidated Limited, which the European Union has labeled as a front company for the Islamic Republic of Iran Shipping Line. The E.U., the U.N. and the U.S. have accused IRISL of aiding Iran’s nuclear-development program.

Thousands of offshore entities are headquartered on this building's third floor, which houses TrustNet's Cook Islands office. Photo: Alex Shprintsen

‘Zone of Impunity’

International groups have been working for decades to limit tax cheating and corruption in the offshore world.

In the 1990s, the Organization for Economic Cooperation and Development began pushing offshore centers to reduce secrecy and get tougher on money laundering, but the effort ebbed in the 2000s. Another push against tax havens began when U.S. authorities took on UBS, forcing the Swiss bank to pay $780 million in 2009 to settle allegations that it had helped Americans dodge taxes. U.S. and German authorities have pressured banks and governments to share information about offshore clients and accounts and UK Prime Minister David Cameron has vowed to use his leadership of the G8, a forum of the world’s richest nations, to help crack down on tax evasion and money laundering.

Promises like those have been met with skepticism, given the role played by key G8 members — the U.S., the U.K. and Russia — as sources and destinations of dirty money. Despite the new efforts, offshore remains a “zone of impunity” for anyone determined to commit financial crimes, said Jack Blum, a former U.S. Senate investigator who is now a lawyer specializing in money laundering and tax fraud cases.

“Periodically, the stench gets so bad somebody has to get out there and clap the lid on the garbage can and sit on it for a while,” Blum said. “There’s been some progress, but there’s a bloody long way to go.”

source

Android Trojan Found in Targeted Attack

2013-03-30T17:47:00.001+04:00

source

In the past, we've seen targeted attacks against Tibetan and Uyghur activists on Windows and Mac OS X platforms. We've documented several interesting attacks (A Gift for Dalai Lamas Birthday and Cyber Attacks Against Uyghur Mac OS X Users Intensify) which used ZIP files as well as DOC, XLS and PDF documents rigged with exploits.

Several days ago, the e-mail account of a high-profile Tibetan activist was hacked and used to send targeted attacks to other activists and human rights advocates. Perhaps the most interesting part is that the attack e-mails had an APK attachment - a malicious program for Android.

The attack

On March 24th, 2013, the e-mail account of a high-profile Tibetan activist was hacked and used to send spear phishing e-mails to their contact list. This is what the spear phishing e-mail looked like:

In regards to the message text above, multiple activist groups have recently organized a human rights conference event in Geneva. We've noticed an increase in the number of attacks using this event as a lure. Here's another example of such an attack hitting Windows users:

Going back to the Android Package (APK) file was attached to the e-mail, this is pushing an Android application named "WUC's Conference.apk".

This malicious APK is 334326 bytes file, MD5: 0b8806b38b52bebfe39ff585639e2ea2 and is detected by Kaspersky Lab products as "Backdoor.AndroidOS.Chuli.a".

After the installation, an application named "Conference" appears on the desktop:

If the victim launches this app, he will see text which "enlightens" the information about the upcoming event:

The full text reads follows. Notice notice the use of the mistaken "Word" instead of "World":

"On behalf of all at the Word Uyghur Congress (WUC), the Unrepresented Nations and Peoples Organization (UNPO) and the Society for Threatened Peoples (STP), Human Rights in China: Implications for East Turkestan, Tibet and Southern Mongolia

In what was an unprecedented coming-together of leading Uyghur, Mongolian, Tibetan and Chinese activists, as well as other leading international experts, we were greatly humbled by the great enthusiasm, contribution and desire from all in attendance to make this occasion something meaningful, the outcome of which produced some concrete, action-orientated solutions to our shared grievances. We are especially delighted about the platform and programme of work established in the declaration of the conference, upon which we sincerely hope will be built a strong and resolute working relationship on our shared goals for the future. With this in mind,we thoroughly look forward to working with you on these matters.

Dolkun lsa

Chairman of the Executive Committee

Word Uyghur Congress"

While the victim reads this fake message, the malware secretly reports the infection to a command-and-control server. After that, it begins to harvest information stored on the device. The stolen data includes:

Contacts (stored both on the phone and the SIM card).
Call logs.
SMS messages.
Geo-location.
Phone data (phone number, OS version, phone model, SDK version).

It is important to note that the data won't be uploaded to C&C server automatically. The Trojan waits for incoming SMS messages (the "alarmReceiver.class") and checks whether these messages contain one of the following commands: "sms", "contact", "location", "other". If one these commands is found, then the malware will encode the stolen data with Base64 and upload it to the command and control server. The C2 URL is:

hxxp://64.78.161.133/*victims's_cell_phone_number*/process.php

In addition to this, the malware also reports to another script, "hxxp://64.78.161.33/android.php". First, it will get the "nativenumber" variable from the "telmark" value of "AndroidManifest.xml". This is hardcoded and equals "phone". Then, it will add the result of the public method localDate.getTime(), which simply gets the current date. An example of the string which is sent to the command-and-control would be "phone 26.03.2013".

It is interesting that the attackers used Java Base64 library developed by Sauron Software. This software is free and distributed under LGPL license.

Also, command communications with the malware are parsed with a function named "chuli()" prior to POSTing stolen data to the command-and-control server. It appears that the attackers are somewhat familiar with the language and mountain-trekking culture of the targets - the meaning of "chuli" is "summit":

The command-and-control server and parameters can be easily seen in the decompiled source code:

Command and control server interaction code

Throughout the code, the attackers log all important actions, which include various messages in Chinese. This was probably done for debugging purposes, indicating the malware may be an early prototype version. Some actions include (with rough translations):

The command-and-control server

The command-and-control server is located at IP 64.78.161.133. This IP is located in Los Angeles, U.S.A., at a hosting company named "Emagine Concept Inc".

Interestingly, there is a domain which used to point there, "DlmDocumentsExchange.com". The domain was registered on March 8th, 2013:

Registration Service Provided By: SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD.

Domain Name: DLMDOCUMENTSEXCHANGE.COM

Registration Date: 08-Mar-2013

Expiration Date: 08-Mar-2014

Status:LOCKED

The domain registration data indicates the following owner:

Registrant Contact Details:

peng jia

peng jia (bdoufwke123010@gmail.com)

beijingshiahiidienquc.d

beijingshi

beijing,100000

CN

Tel. +86.01078456689

Fax. +86.01078456689

The command-and-control server is hosting an index page which also serves an APK file:

The referenced "Document.apk" is 333583 bytes in size, MD5: c4c4077e9449147d754afd972e247efc. It has the same functionality as the one described above but contains different text. The new text (in Chinese, about relations between China, Japan and the disputed "Senkaku Islands / Diaoyudao Islands / Diaoyutai Islands") is shown to the victims and reads as following:

When opened in a browser, this is what the command-and-control index page looks like:

The text on the top means "Title Title Title" in Chinese, while the other strings appear to be random characters typed from the keyboard.

Interestingly, the command and control server includes a publicly accessible interface to work with the victims:

Some of the commands with rough translations:

The command-and-control server is running Windows Server 2003 and has been configured for Chinese language:

This, together with the logs, is a strong indicator that the attackers are Chinese-speaking.

Conclusions

Every day, there are hundreds if not thousands of targeted attacks against Tibetan and Uyghur supporters. The vast majority of these target Windows machines through Word documents exploiting known vulnerabilities such as CVE-2012-0158, CVE-2010-3333 and CVE-2009-3129.

In this case, the attackers hacked a Tibetan activist's account and used it to attack Uyghur activists. It indicates perhaps an interesting trend which is exploiting the trust relationships between the two communities. This technique reminds us of a combination between ages old war strategies "Divide et impera" and "By way of deception".

Until now, we haven't seen targeted attacks against mobile phones in the wild, although we've seenindications that these were in development.

The current attack took advantage of the compromise of a high-profile Tibetan activist. It is perhaps the first in a new wave of targeted attacks aimed at Android users. So far, the attackers relied entirely on social engineering to infect the targets. History has shown us that, in time, these attacks will use zero-day vulnerabilities, exploits or a combination of techniques.

For now, the best protection is to avoid any APK attachments that arrive on mobile phones via e-mail.

We detect the malware used in this attack as "Backdoor.AndroidOS.Chuli.a".

MD5s:

c4c4077e9449147d754afd972e247efc Document.apk

0b8806b38b52bebfe39ff585639e2ea2 WUC's Conference.apk

When a Secretive Stingray Cell Phone Tracking "Warrant" Isn't a Warrant

2013-03-30T17:41:00.001+04:00

An Arizona federal court this afternoon will be the battleground over the government's use of a "Stingray" surveillance device in a closely watched criminal case, United States v. Rigmaiden. And in an important development, new documents revealed after an ACLU of Northern California Freedom of Information Act (FOIA) request should leave the government with some explaining to do.

"Stingray" is the brand name of an International Mobile Subscriber Identity locator, or “IMSI catcher.” A Stingray acts as a fake cell-phone tower, small enough to fit in a van, allowing the government to route all network traffic to the fake tower. We've warned that Stingrays are dangerous because they have the capability to obtain the contents of electronic and wire communications while necessarily sucking down data on scores of innocent people along the way.

The Fourth Amendment requires searches be "reasonable," generally meaning they must be accompanied by a warrant. To get a warrant, the government must show there is probable cause to believe the place they want to search will have evidence of a crime. And it means the judge must ensure the warrant is "particular," or limited to only allow searches into areas where the evidence is most likely to be found. The only way a judge can make these tough decisions is with the government being forthright about what it's doing.

But when it comes to Stingrays the government has been extremely secretive about its use, withholding documents in FOIA requests, failing to explain (or even understand) the technology to a Texas federal judge and in Rigmaiden, misleading the court about the fact it's even using one at all.

Daniel David Rigmaiden is charged with a variety of tax and wire fraud crimes. Hoping to pinpoint Rigmaiden's precise location within an apartment complex, federal agents applied for an order requesting the court to order Verizon to help the agents pinpoint the physical location of a wireless broadband access card and cell phone they believed Rigmaiden was using. The order is clearly directed towards Verizon:

The Court therefore ORDERS, pursuant to Federal Rule of Criminal Procedure 41(b); Title 18, United States Code, Sections 2703 and 3117; and Title 28, United States Code, Section 1651, that Verizon Wireless, within ten (10) days of the signing of this Order and for a period not to exceed 30 days, unless extended by the Court, shall provide to agents of the FBI data and information obtained from the monitoring of transmissions related to the location of the Target Broadband Access Card/Cellular Telephone...

Ultimately, it turns out the government did not just get Verizon to give it the data. It also used a Stingray device to find Rigmaiden, sucking up loads of other data from other electronic devices in the complex as well, which it deleted.

When Rigmaiden filed a motion to suppress the Stingray evidence as a warrantless search in violation of the Fourth Amendment, the government responded that this order was a search warrant that authorized the government to use the Stingray. Together with the ACLU of Northern California and the ACLU, we filed an amicus brief in support of Rigmaiden, noting that this "order" wasn't a search warrant because it was directed towards Verizon, made no mention of an IMSI catcher or Stingray and didn't authorize the government—rather than Verizon—to do anything. Plus to the extent it captured loads of information from other people not suspected of criminal activity it was a "general warrant," the precise evil the Fourth Amendment was designed to prevent.

The FOIA documents bolster our argument that this isn't a warrant. The documents are a series of internal emails from DOJ attorneys in the United States Attorney's Office for the Northern District of California, the district where the order in Rigmaiden's case was issued. Theemails make clear that U.S. Attorneys in the Northern California were using Stingrays but not informing magistrates of what exactly they were doing. And once the judges got wind of what was actually going on, they were none too pleased:

As some of you may be aware, our office has been working closely with the magistrate judges in an effort to address their collective concerns regarding whether a pen register is sufficient to authorize the use of law enforcement's WIT technology (a box that simulates a cell tower and can be placed inside a van to help pinpoint an individual's location with some specificity) to locate an individual. It has recently come to my attention that many agents are still using WIT technology in the field although the pen register application does not make that explicit.

While we continue work on a long term fix for this problem, it is important that we are consistent and forthright in our pen register requests to the magistrates…

These emails, combined with the text of the disputed order itself, suggest agents obtained authorization to use a pen register without indicating they also planned to use a Stingray. Either at the time of the application or after the fact, the government attempted to transform that order into a warrant that authorized the use of a Stingray.

Judicial superivison of searches is most needed when the government uses new technologies to embark into new and unknown privacy intrusions. But when the government hides what it's really doing, it removes this important check on government power. We hope the court sees its been duped, and makes clear to the government that honesty and a warrant are requirements to using a Stingray.

source

Multiplatform Wiper widespread in attacks against South Korea

2013-03-25T20:49:00.000+04:00

Recently South Korea has been hit by powerful cyber attack malware based, network provided by LG UPlus Corp was hacked by a group calling itself the “Whois Team”. The attack targeted also media and banking of the country, television networks YTN, MBC and KBS and Shinhan Bank and NongHyup Bank, two major banks of the country, suffered serious outage. Fortunately according South Korea’s representative none of critical infrastructures of the country was interested by the attacks.

All principal security firms are investigating on the event analyzing the malicious code used for the attacks that revealed the capability to erase data also on Linux machines. The source code of the Windows malware used by attackers presented an unexpected surprise, it was in fact equipped with a module able to work on Linux systems erasing the disks.

The malware include also a BASH shell script, attempts to erase partitions Unix systems, including Linux and HP-UX.

“The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions. It wipes out the /kernel, /usr, /etc, and /home directories.”

The discovery was announced by Symantec firms that dubbed it Jokra, following an extract from its blog post:

” The dropper for Trojan.Jokra contains a module for wiping remote Linux machines. We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat.”

The trojan Jokra runs on Windows XP and 7 invoking an open source remote access manager, named mRemote, that could be used to manage devices on different platforms.

The malware is able to overwrite the Master Boot Record of the infected machine making impossible the bootstrapping, according McAfee analysis the agent wiped out the MBR on the hard drives overwriting it with either one of these strings:

PRINCIPES
HASTATI
PR!NCPES
HASTATI and PR!NCPES in combination
PRINCPES

Malware analysts at McAfee explained in their post on the topic:

“The attack also overwrote random parts of the file system with the same strings, rendering several files unrecoverable,” “So even if the MBR is recovered, the files on disk will be compromised too.”

“Three wipers are packaged as a position-independent executable (PIE) and a fourth as a dynamic-link library (DLL) injection. There are also some differences in regard to the timing.”

Another interesting behavior observed by researchers is that the malware also try to kill processes related two South Korean antivirus products commercialized by the companies Ahnlab and Hauri.

Avast security firm discovered the alleged source of the attack against Korean banks, it seems started from website of the Korean Software Property Right Council compromised to serve up an iframe that delivered an attack hosted on a third website.

Officials confirmed that the analysis of IP addresses did not reveal the real responsible for the attacks, due this reason Government of Seoul hasn’t speculated about the event, neither it has blamed North Korea, the situation is very complex and cyber attacks observed on this day may have been triggered by independent groups of hackers or by other states interested in exacerbating tensions in the area.

source

CrySyS Lab revealed a decennial cyber espionage operation by TeamSpy

2013-03-25T20:44:00.002+04:00

Last week was monopolized by discussion on cyber attacks that hit North and South Korea, but was found a news equally stunning, researchers at Hungary-basedCrySyS Lab have discovered a decade-long cyber espionagecampaign that targeted high-level political and industrial entities in Eastern Europe.

The attackers, dubbed by security researchers TeamSpy, used the popular remote-access program TeamViewer and a specially crafted malware to steal secret documents and encryption keys from victims.

TeamSpy used various methods for cyber espionage including the use of a digitally signed malicious version of TeamViewer in which has been included “DLL hijacking” library to allow spying activities in real-time. Once installed the compromised program provides attackers with a backdoor to control victims.

Which are the targets of cyber espionage campaign?

The hackers hit a large variety of high-level subjects including Russia-based Embassy for a not reveled undisclosed country belonging to both NATO and the European Union, multiple research and educational organizations in France and Belgium, an electronics company located in Iran and an industrial manufacturer located in Russia. Following the list provided by the post in the correct timeline.

11/2012: Hungarian high profile governmental victim.
03/2013: Embassy of NATO/EU state in Russia
04/2010: Electronics company in Middle-East, Govt. background
03/2013: Multiple research/educational organizations in France and Belgium
03/2013: Industrial manufacturer in Russia

All started when Hungary’s National Security Authority revealed that an unnamed “Hungarian high-profile governmental victim” was hit by the TeamSpy.

What is really concerning is that the analysis of the malware dated the beginning of the cyber espionage operations to many years ago, and exactly as many other campaigns the attacks may have involved a great variety of countries all over the world.

The surprises do not end here, security researchers found that techniques adopted by TeamSpy are quite similar to methods implemented by the authors of an online banking fraud ring known as Sheldon, meanwhile researchers at Kaspersky Labfound similarities to the Red October cyber espionage campaign.

Both the TeamViewer technique and command servers used in the attack reminded to the researchers the modus operandi of Sheldon malware.

The Kaspersky security experts wrote in the report:

“For at least several years, a mysterious threat actor infiltrated and tracked, performed surveillance and stole data from governmental organisations, some private companies and human rights activists throughout the Commonwealth of Independent States (CIS) and Eastern European nations. Some parts of this operation extended into Western nations and the Middle East as well, with victims in sectors such as energy and heavy industry manufacturing. The attackers performed their intelligence gathering and surveillance partly using TeamViewer (http://www.teamviewer.com/en/index.aspx), a legitimate support software package commonly used for remote administration. In addition, they deployed custom written intelligence gathering components and lateral movement utilities.”

Colleagues at CrySyS Lab confirmed that the campaign could be started a decade ago:

“Most likely the same attackers are behind the attacks that span for the last 10 years, as there are clear connections between samples used in different years and campaigns,” “Interestingly, the attacks began to gain new momentum in the second half of 2012.” “The attackers surely aim for important targets. This conclusion comes from a number of different facts, including victim IPs, known activities on some targets, traceroute for probably high-profile targets, file names used in information stealing activities, strange paramilitary language of some structures, etc.”

The TeamSpy operation also relies on more traditional malware tools that were custom-built for the purpose of espionage or bank fraud.

Kaspersky team confirmed that attackers used various malware and exploit kitsinfecting victims using “watering hole” attacks, in this way the TeamSpy compromised websites frequented by the intended victims, in many cases the malicious code used to infect victims was spread by Eleonore exploit kit.

This discovery is just the last in order of time, in the last couple of years several cyber espionage campaigns have been discovered, from Duqu to Flame, arriving to recentMahdi and Red October, the complexity of the operations, the target chosen, the nature of information stolen and the capability of attacker to maintains low profile for a so long time led security expert to believe that behind the campaigns there are groups of state sponsored hackers that conduct intelligence for their governmets.

I wonder how many political decisions have already been influenced by knowledge of the information stolen during these campaigns …

source

Richard Stallman says Ubuntu Linux is 'spyware'

2013-03-25T20:19:00.002+04:00

FREE SOFTWARE PIONEER Richard Stallman has asked a South American free software association not to promote Ubuntu Linux at its events because it "spies on its users" by collecting its users' desktop search activity and selling the data to Amazon.

Canonical released Ubuntu 12.10 last October with Amazon search integrated into its Dash desktop search function.

Although Ubuntu users can opt out and Canonical claims it anonymises users' search information before sending it to Amazon, the change resulted in Ubuntu users being shown Amazon ads in response to desktop search queries.

The 'feature' has attracted a lot of criticism and might have led some users to defect to other Linux distributions.

When Stallman's request was denied by the FLISOL event organiser with the excuse that it would limit user freedom of choice, Stallman fired off a response to the organisation's entire mailing list on Sunday. Parts of his email are quoted below, as translated by Groklaw.

"The issue I raise is about what should happen at FLISOL events. Give away copies of Ubuntu or not? Promote Ubuntu or no? I asked the organisers of the event that they, as a policy, not distribute or promote Ubuntu.

"Freedom of users is something else, and there isn't a conflict between a user's freedom and my request. If someone decides to install Ubuntu, I would consider it a mistake, but it's his own choice to do it. What I ask is that you don't participate, help or suggest that he do it. I didn't request that you block him from doing so.

"As a matter of principle, I don't believe anyone has a right, morally, to distribute proprietary software, that is, software that deprives the users of freedom. When the user controls his own software, he can install what he wants and no one can stop him. But today's issue isn't about him, what he does, but rather what you do with him."

As Stallman sent his email only yesterday, it's not yet known whether FLISOL has reconsidered promoting Ubuntu at its free software events.

These points might seem like splitting hairs, but apparently Richard Stallman - the author of the GNU General Public Licence (GPL), as well as the founder and president of the Free Software Foundation - is serious about them.

Browser Security: Settings for Chrome, Firefox and Internet Explorer

2013-03-23T01:55:00.001+04:00

Optimizing your browser’s settings is a critical step in using the Internet securely and privately. Today’s popular browsers include built-in security features, but users often fail to optimize their browser’s security settings on installation. Failing to correctly set up your browser’s security features can put you at a higher risk for malwareinfections and malicious attacks. This installation of our “Cybersecurity 101” series provides our tips for securing several of today’s most popular browsers, including Google Chrome, Mozilla Firefox, and Microsoft Internet Explorer. While it is impossible to guarantee complete protection from cyber threats, following these tips will greatly increase the security of your web browser.

Tips for Secure Browsing with Google Chrome

These settings can be accessed through Chrome’s “Advanced Settings” menu or by navigating to “chrome://settings/.”

Enable phishing and malware protection: Make sure that Chrome’s phishing and malware protection feature is enabled under the “Privacy” section. This feature will warn you if a site you’re trying to visit may be phishing or contain malware.
Turn off instant search: The Instant search feature should be turned off for optimal security. While it offers some convenience in searching, having this feature enabled means that anything you type in the address bar is instantly sent to Google.
Don’t sync: Disconnect your email account from your browser under the “Personal Stuff” tab. Syncing your email account with your Chrome browser means that personal information such as passwords, autofill data, preferences, and more is stored on Google’s servers. If you must use sync, select the “Encrypt all synced data” option and create a unique passphrase for encryption.
Configure content settings: Click “Content settings” under the “Privacy” section and do the following:
- Cookies: Select “Keep local data only until I quit my browser” and “Block third-party cookies and site data.” These options ensure that your cookies will be deleted upon quitting Chrome and that advertisers will not be able to track you using third-party cookies.
- JavaScript: Select “Do not allow any site to run JavaScript.” It is widely recommended that JavaScript be disabled whenever possible to protect users from its security vulnerabilities.
- Pop-ups: Select “Do not allow any site to show pop-ups.
- Location: Select “Do not allow any site to track my physical location.”
Configure passwords and forms settings: Disable Autofill and deselect “Offer to save passwords I enter on the web” under the “Passwords and forms” section. Doing so will prevent Chrome from saving your logins, passwords, and other sensitive information that you enter into forms.

Tips for Secure Browsing with Mozilla Firefox

These settings can be accessed through the “Options” menu.

Configure privacy settings: Under the “Privacy” tab, complete the following steps. These measures ensure that Firefox is storing only as much of your information as it needs to function normally.
- Select “Use custom settings for history.”
- Deselect “Remember my browsing and download history.”
- Deselect “Remember search and form history.”
- Deselect “Accept third-party cookies.”
- Set cookie storage to “Keep until I close Firefox.”
- Select “Clear history when Firefox closes.”
Configure security settings: Under the “Security” tab, choose the following settings. These steps prevent Firefox from saving your passwords and keep you from visiting potentially harmful sites.
- Verify that “Warn me when sites try to install add-ons,” “Block reported attack sites,” and “Block reported web forgeries” are all selected.
- Deselect “Remember passwords for sites.”
Disable javaScript: Deselect “Enable JavaScript” under the “Content” tab. JavaScript is notorious for containing security vulnerabilities and it is recommended that users only enable it for trusted sites.
Enable pop-up blocking: Verify that “Block pop-up windows” is selected under the “Content” tab. This feature should be turned on by default as it protects users from unwarranted advertisements and windows.
Don’t sync: Avoid using Firefox Sync. By doing so you prevent Firefox from storing your logins, passwords, and other sensitive information.
Turn on automatic updates: Verify that “Automatically install updates” is selected in the “Update” tab under “Advanced.” Doing so will ensure that your browser receives critical security updates. Verify that “Automatically update Search Engines” is selected as well.
Use secure protocols: Verify that “Use SSL 3.0” and “Use TLS 1.0” are selected in the “Encryption” tab under “Advanced.”

Tips for Secure Browsing with Microsoft Internet Explorer 10

These settings can be accessed through the “Internet Options” menu.

Configure security settings: Under the “Security” tab, do the following:
- Set security zones: IE offers the option to configure different security settings for different “zones,” including the Internet, local intranet, trusted sites, and restricted sites. Set up the zones for Intranet, Trusted Sites, and Restricted sites to your desired security level.
- Set Internet zone security to “Medium High” or higher. This blocks certain cookie types, enables ActiveX filtering, and implements several other default settings for increased security.
- Disable javaScript: Click “Custom Level,” locate the “Active Scripting” setting, and select “Disable.” It is recommended that users disable JavaScript because of the high amount of vulnerabilities it contains.
Automatically clear history: Select “Delete browsing history on exit” under the “General” tab. Clearing your history at the end of each session helps to limit the amount of information IE saves when you browse.
Configure privacy settings: Under the “Privacy” tab, complete the following steps:
- Privacy setting: Set the Internet zone privacy to “Medium High” or higher. This blocks certain cookie types to prevent sites from tracking or contacting you without your consent.
- Location: Select “Never allow websites to request your physical location.”
- Pop-up Blocker: Double check that Pop-up Blocker is enabled.
Configure Advanced Security settings: Scroll down to the “Security” section under the “Advanced” tab and do the following:
- Ensure that all default settings are in place. If you aren’t sure, click “Restore advanced settings” before making any other changes.
- Select “Do not save encrypted pages to disk.” This will delete files cached from HTTPS pages when the browser is closed.
- Select “Empty Temporary Internet Files folder when browser is closed.” This prevents IE from storing your personal info (logins, passwords, activity, etc) beyond your browsing session.
- Turn off autoComplete: The AutoComplete feature should be turned off for forms and usernames/passwords. Keeping AutoComplete turned off ensures that your sensitive information isn’t being stored unnecessarily.
Tracking protection: IE’s Tracking Protection feature keeps your browsing private from specified third-party websites. This feature can be accessed through IE’s “Safety” menu. In order to use Tracking Protection you will need to provide a Tracking Protection List that names all of the sites you don’t want your information being sent to. You can create a list yourself or download lists online.

Which is the Most Secure Browser?

Nominating one browser as the most secure is difficult. Since each browser is regularly updated with security patches, the rankings for most secure browser could change at any time. As of today, Veracode recommends Google Chrome as the most secure browser.

Source: http://www.veracode.com/blog/2013/03/browser-security-settings-for-chrome-fire

BlackBerry software ruled not safe enough for essential government work

2013-03-23T01:34:00.000+04:00

this article was published Tuesday 19 March 2013 18.13 GMT but removed from original source as well as Google cache, but keeps translated and here and in exported to pdf from evernote

CESG rejects BB10 software in new Z10 handset, dealing blow to Canadian firm in key market

The BB10 software in the new BlackBerry Z10 handset has been rejected as not secure enough for essential government work. Photograph: Mast Irham/EPA

BlackBerry's new BB10 software has been rejected by the British government as not secure enough for essential work, the Guardian can reveal.
The news is a blow to hopes that the new operating system, released on the Z10 handset in January, would spark a rapid revival in the company's fortunes after a torrid year of losses.
The previous BlackBerry version, 7.1, was cleared by the UK's Communications-Electronics Security Group (CESG) in December 2012 for classifications up to "Restricted" – two levels below "Secret".
But the Guardian understands that tests on BB10 and the BlackBerry Balance software, intended to separate work and personal accounts and prevent any copying of data between them, have shown that it fails the same security requirements. BlackBerry has confirmed that BB10 has not been passed yet by CESG, but could not offer a date when revised software would be submitted.
That is a blow because the Z10 and its upcoming keyboard-based version, the Q10, are high-priced devices intended to win back corporate customers who have begun to migrate to Apple's iPhone or to Android devices, or to replace older BlackBerry 7 phones. Nor has the company offered a clear date when it will fix the weakness.
Missing out on government business could cost BlackBerry millions in lost revenues, even if rivals are unable to fill the same security space: the government and NHS are two of its biggest clients in the UK, with tens of thousands of users.
Analyst reports also suggest that sales in the UK of the touchscreen Z10 handset, the first to run BB10, are slowing after an initial spurt among consumers when they went on sale in January, leaving sellers with surplus stock.
The Z10 goes on sale in the US on Friday, with the company seeking to rebuild its share of the smartphone market there, which has plummeted from a high of 22% in September 2010 with 21m users to just 5.9% and 7.6m users in January according to ComScore.
But James Faucette at the stockbrokers Pacific Crest, who has a "sell" rating on BlackBerry, said in a research note looking at sales in the UK and Canada that "sell-through run-rates for the Z10 have declined meaningfully in the weeks following launch. We believe carriers and third-party retailers in the UK are well above typically targeted inventory levels" and that retailers Carphone Warhouse and Phones4U have begun discounting the handsets. "We are concerned that … may ultimately push the Z10 downmarket" and hit profit margins, he told clients.
He added that he thinks Canadian stores and carriers are also approaching the same point
BlackBerry said in a statement: "We have a long-established relationship with CESG and we remain the only mobile solution approved for use at 'Restricted' when configured in accordance with CESG guidelines. This level of approval only comes following a process which is rigorous and absolutely necessary given the highly confidential nature of the communications being transmitted.
"The current restructuring of this approval process, due to the Government Protective Marking Scheme review and the new CESG Commercial Product Assurance scheme has an impact on the timeline for BlackBerry 10 to receive a similar level of approval. The US government's FIPS 140-2 certification of BlackBerry 10 and the selection of BlackBerry 10 by the German Procurement Office and Federal Office for Information Security underline how our new platform continues to set the standard for government communications.
"We are continuing to work closely with CESG on the approval of BlackBerry 10 and we're confident that BlackBerry 10 will only strengthen our position as the mobile solution of choice for the UK government."
• Canada's industry minister has declined to say whether he would block any attempted takeover of BlackBerry by the Chinese PC and smartphone maker Lenovo. Christian Paradis told Reuters "I hope BlackBerry will continue to be a Canadian champion in the world, that it grows organically." But, he added, "we don't know what might happen. The market is very aggressive. When you talk about the telecoms sector … this is a very, very aggressive sector."
Asked whether he would block a bid from Lenovo, mooted last week in an interview with that company, Paradis said "As the industry minister, I don't want to send a signal and I don't want it to look like I prejudged a deal or not."
The Canadian government could block the deal on national security grounds. Last year, the Chinese state-owned oil company CNOOC bought Canadian energy firm Nexen, but it provoked a storm. Analysts believe the US and UK governments might block a similar Chinese bid for BlackBerry because of its importance to secure email.
Updated: corrected expansion of CESG.

1-15 March 2013 Cyber Attacks Timeline

2013-03-23T01:08:00.002+04:00

Other troubles for system administrators: March is confirming the 2013 dangerous trend with several high profile breaches against industrial, financial and governmental targets.

The first two weeks of March have begun with the breach to Evernote, and continued with (among the others) the third phase of the infamous Operation Ababil, targeting U.S. Banks and an alleged Chinese attack against the Reserve Bank of Australia.

Additional noticeable events include a wave of DDoS attacks against several Czech Republic’s targets (belonging to media, news and financial sector), a breach suffered by the NIST Vulnerability Database (unfortunately not an isolated example of the attacks against US governmental targets happened in these two weeks) and also the leak of 20,000 records from an Avast! German distributor.

Last but not least, the examined period has also confirmed the role of Twitter as the new mean to make resounding attacks against single individuals or organizations. Qatar Foundation, Saudi Aramco, and France 24 are only several of the organizations fallen victims of accounts hijacking.

Of course, these are only the main events, feel free to scroll down the list to analyze in detail what happened in these two weeks.

If you want to have an idea of how fragile our data are inside the cyberspace, have a look at the timelines of the main Cyber Attacks in 2011, 2012 and now 2013 (regularly updated). You may also want to have a look at the Cyber Attack Statistics, and follow @paulsparrows on Twitter for the latest updates.

Also, feel free to submit remarkable incidents that in your opinion deserve to be included in the timelines (and charts).

Once again, a special thanks to Kim Guldberg AKA @bufferzone for continuously advising me about significant cyber events through the Submit Form! Much Appreciated!

Jobs compilations

2013-03-23T00:51:00.002+04:00

Attacking XML Security

2013-03-23T00:23:00.003+04:00

Message Oriented Madness, XML Worms and Web Service Security Sanity

Attacking XML Security from yusufmotiwala

Security Vulnerability Notice SE-2012-01-PUBLIC [Security vulnerabilities in Java SE, Issue 54]

2013-03-20T18:36:00.001+04:00

Security Explorations decided to release technical details of Issue 54 that was reported to Oracle on Feb 25, 2013 and that was evaluated by the company as the "allowed behavior" [1].

As of Mar 18, 2013 no information was received from Oracle that would indicate that Issue 54 is treated by the company as a security vulnerability.

Security Explorations believes that 3 weeks (from Feb 25 to Mar 18) constitutes enough time for a major software vendor to deliver a final confirmation or denial of a reported issue. This especially concerns a vendor that has been a subject of a considerable criticism regarding competent and prompt handling of security vulnerabilities in its software.

Security Explorations decided to release technical details of Issue 54 that was reported to Oracle on Feb 25, 2013 and that was evaluated by the company as the "allowed behavior" [1].

As of Mar 18, 2013 no information was received from Oracle that would indicate that Issue 54 is treated by the company as a security vulnerability.

Security Explorations is publishing the following material in a hope that a wider public could conduct an independent evaluation of Issue 54 and deliver an unbiased judgment of both companies claims:

Short write-up presenting vulnerability details, its impact and a summary of vendor's response, PDF file, 300KB (download)
Proof of Concept code for Issue 54, ZIP file, 15KB (download)

se-2012-01-54 by Yury Chemerkin

You Only Click Twice: FinFisher’s Global Proliferation

2013-03-19T20:27:00.002+04:00

This post describes the results of a comprehensive global Internet scan for the command and control servers of FinFisher’s surveillance software. It also details the discovery of a campaign using FinFisher in Ethiopia used to target individuals linked to an opposition group. Additionally, it provides examination of a FinSpy Mobile sample found in the wild, which appears to have been used in Vietnam.

Summary of Key Findings

We have found command and control servers for FinSpy backdoors, part of Gamma International’s FinFisher “remote monitoring solution,” in a total of 25 countries: Australia, Bahrain, Bangladesh, Brunei, Canada, Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, United Arab Emirates, United Kingdom, United States, Vietnam.

A FinSpy campaign in Ethiopia uses pictures of Ginbot 7, an Ethiopian opposition group, as bait to infect users. This continues the theme of FinSpy deployments with strong indications of politically-motivated targeting.

There is strong evidence of a Vietnamese FinSpy Mobile Campaign. We found an Android FinSpy Mobile sample in the wild with a command & control server in Vietnam that also exfiltrates text messages to a local phone number.

These findings call into question claims by Gamma International that previously reported servers were not part of their product line, and that previously discovered copies of their software were either stolen or demo copies.

1. Background and Introduction

FinFisher is a line of remote intrusion and surveillance software developed by Munich-based Gamma International GmbH. FinFisher products are marketed and sold exclusively to law enforcement and intelligence agencies by the UK-based Gamma Group.¹ Although touted as a “lawful interception” suite for monitoring criminals, FinFisher has gained notoriety because it has been used in targeted attacks against human rights campaigners and opposition activists in countries with questionable human rights records.²
In late July 2012, we published the results of an investigation into a suspicious e-mail campaign targeting Bahraini activists.³ We analyzed the attachments and discovered that they contained the FinSpy spyware, FinFisher’s remote monitoring product. FinSpy captures information from an infected computer, such as passwords and Skype calls, and sends the information to a FinSpy command & control (C2) server. The attachments we analyzed sent data to a command & control server inside Bahrain.
This discovery motivated researchers to search for other command & control servers to understand how widely FinFisher might be used. Claudio Guarnieri at Rapid7 (one of the authors of this report) was the first to search for these servers. He fingerprinted the Bahrain server and looked at historical Internet scanning data to identify other servers around the world that responded to the same fingerprint. Rapid7 published this list of servers, and described their fingerprinting technique. Other groups, including CrowdStrike andSpiderLabs also analyzed and published reports on FinSpy.
Immediately after publication, the servers were apparently updated to evade detection by the Rapid7 fingerprint. We devised a different fingerprinting technique and scanned portions of the internet. We confirmed Rapid7’s results, and also found several new servers, including one inside Turkmenistan’s Ministry of Communications. We published our list of servers in late August 2012, in addition to an analysis of mobile phone versions of FinSpy. FinSpy servers were apparently updated again in October 2012 to disable this newer fingerprinting technique, although it was never publicly described.
Nevertheless, via analysis of existing samples and observation of command & control servers, we managed to enumerate yet more fingerprinting methods and continue our survey of the internet for this surveillance software. We describe the results in this post.
Civil society groups have found cause for concern in these findings, as they indicate the use of FinFisher products by countries like Turkmenistan and Bahrain with problematic records on human rights, transparency, and rule of law. In an August 2012 response to a letter from UK-based NGO Privacy International, the UK Government revealed that at some unspecified time in the past, it had examined a version of FinSpy, and communicated to Gamma that a license would be required to export that version outside of the EU. Gamma has repeatedly denied links to spyware and servers uncovered by our research, claiming that the servers detected by our scans are “not … from the FinFisher product line.”⁴ Gamma also claims that the spyware sent to activists in Bahrain was an “old” demonstration version of FinSpy, stolen during a product presentation.
In February 2013, Privacy International, the European Centre for Constitutional and Human Rights (ECCHR), the Bahrain Center for Human Rights, Bahrain Watch, and Reporters Without Borders filed a complaint with the Organization for Economic Cooperation and Development (OECD), requesting that this body investigate whether Gamma violated OECD Guidelines for Multinational Enterprises by exporting FinSpy to Bahrain. The complaint called previous Gamma statements into question, noting that at least two different versions (4.00 and 4.01) of FinSpy were found in Bahrain, and that Bahrain’s server was a FinFisher product and was likely receiving updates from Gamma. This complaint, as laid out by Privacy International states that Gamma:

failed to respect the internationally recognised human rights of those affected by [its] activities
caused and contributed to adverse human rights impacts in the course of [its] business activities
failed to prevent and mitigate adverse human rights impacts linked to [its] activities and products, and failed to address such impacts where they have occurred
failed to carry out adequate due diligence (including human rights due diligence); and
failed to implement a policy commitment to respect human rights.

According to recent reporting, German Federal Police appear to have plans to purchase and use the FinFisher suite of tools domestically within Germany.⁵ Meanwhile, findings by our group and others continue to illustrate the global proliferation of FinFisher’s products. Research continues to uncover troubling cases of FinSpy in countries with dismal human rights track records, and politically repressive regimes. Most recently, work by Bahrain Watch has confirmed the presence of a Bahraini FinFisher campaign, and further contradicted Gamma’s public statements. This post adds to the list by providing an updated list of FinSpy Command & Control servers, and describing the FinSpy malware samples in the wild which appear to have been used to target victims in Ethiopia and Vietnam.
We present these updated findings in the hopes that we will further encourage civil society groups and competent investigative bodies to continue their scrutiny of Gamma’s activities, relevant export control issues, and the issue of the global and unregulated proliferation of surveillance malware.

2. FinFisher: Updated Global Scan

(click image to enlarge)

Figure 1. Map of global FinFisher proliferation
Around October 2012, we observed that the behavior of FinSpy servers began to change. Servers stopped responding to our fingerprint, which had exploited a quirk in the distinctive FinSpy wire protocol. We believe that this indicates that Gamma either independently changed the FinSpy protocol, or was able to determine key elements of our fingerprint, although it has never been publicly revealed.
In the wake of this apparent update to FinSpy command & control servers, we devised a new fingerprint and conducted a scan of the internet for FinSpy command & control servers. This scan took roughly two months and involved sending more than 12 billion packets. Our new scan identified a total of 36 FinSpy servers, 30 of which were new and 6 of which we had found during previous scanning. The servers operated in 19 different countries. Among the FinSpy servers we found, 7 were in countries we hadn’t seen before.

New Countries
Canada, Bangladesh, India, Malaysia, Mexico, Serbia, Vietnam

In our most recent scan, 16 servers that we had previously found did not show up. We suspect that after our earlier scans were published the operators moved them. Many of these servers were shut down or relocated after the publication of previous results, but before the apparent October 2012 update. We no longer found FinSpy servers in 4 countries where previous scanning identified them (Brunei, UAE, Latvia, and Mongolia). Taken together, FinSpy servers are currently, or have been present, in 25 countries.

Australia, Bahrain, Bangladesh, Brunei, Canada, Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, United Arab Emirates, United Kingdom, United States, Vietnam.

Importantly, we believe that our list of servers is incomplete due to the large diversity of ports used by FinSpy servers, as well as other efforts at concealment. Moreover, discovery of a FinSpy command and control server in a given country is not a sufficient indicator to conclude the use of FinFisher by that country’s law enforcement or intelligence agencies. In some cases, servers were found running on facilities provided by commercial hosting providers that could have been purchased by actors from any country.
The table below shows the FinSpy servers detected in our latest scan. We list the full IP address of servers that have been previously publicly revealed. For active servers that have not been publicly revealed, we list the first two octets only. Releasing complete IP addresses in the past has not proved useful, as the servers are quickly shut down and relocated.*

IP	Operator	Routed to Country
117.121.xxx.xxx	GPLHost	Australia
77.69.181.162	Batelco ADSL Service	Bahrain
180.211.xxx.xxx	Telegraph & Telephone Board	Bangladesh
168.144.xxx.xxx	Softcom, Inc.	Canada
168.144.xxx.xxx	Softcom, Inc.	Canada
217.16.xxx.xxx	PIPNI VPS	Czech Republic
217.146.xxx.xxx	Zone Media UVS/Nodes	Estonia
213.55.99.74	Ethio Telecom	Ethiopia
80.156.xxx.xxx	Gamma International GmbH	Germany
37.200.xxx.xxx	JiffyBox Servers	Germany
178.77.xxx.xxx	HostEurope GmbH	Germany
119.18.xxx.xxx	HostGator	India
119.18.xxx.xxx	HostGator	India
118.97.xxx.xxx	PT Telkom	Indonesia
118.97.xxx.xxx	PT Telkom	Indonesia
103.28.xxx.xxx	PT Matrixnet Global	Indonesia
112.78.143.34	Biznet ISP	Indonesia
112.78.143.26	Biznet ISP	Indonesia
117.121.xxx.xxx	GPLHost	Malaysia
187.188.xxx.xxx	Iusacell PCS	Mexico
201.122.xxx.xxx	UniNet	Mexico
164.138.xxx.xxx	Tilaa	Netherlands
164.138.28.2	Tilaa	Netherlands
78.100.57.165	Qtel – Government Relations	Qatar
195.178.xxx.xxx	Tri.d.o.o / Telekom Srbija	Serbia
117.121.xxx.xxx	GPLHost	Singapore
217.174.229.82	Ministry of Communications	Turkmenistan
72.22.xxx.xxx	iPower, Inc.	United States
166.143.xxx.xxx	Verizon Wireless	United States
117.121.xxx.xxx	GPLHost	United States
117.121.xxx.xxx	GPLHost	United States
117.121.xxx.xxx	GPLHost	United States
117.121.xxx.xxx	GPLHost	United States
183.91.xxx.xxx	CMC Telecom Infrastructure Company	Vietnam

Several of these findings are especially noteworthy:

Eight servers are hosted by provider GPLHost in various countries (Singapore, Malaysia, Australia, US). However, we observed only six of these servers active at any given time, suggesting that some IP addresses may have changed during our scans.
A server identified in Germany has the registrant “Gamma International GmbH,” and the contact person is listed as “Martin Muench.”
There is a FinSpy server in an IP range registered to “Verizon Wireless.” Verizon Wireless sells ranges of IP addresses to corporate customers, so this is not necessarily an indication that Verizon Wireless itself is operating the server, or that Verizon Wireless customers are being spied on.
A server in Qatar that was previously detected by Rapid7 seems to be back online after being unresponsive during the last round of our scanning. The server is located in a range of 16 addresses registered to “Qtel – Corporate accounts – Government Relations.” The same block of 16 addresses also contains the websitehttp://qhotels.gov.qa/.

3. Ethiopia and Vietnam: In-depth Discussion of New Samples

3.1 FinSpy in Ethiopia

We analyzed a recently acquired malware sample and identified it as FinSpy. The malware uses images of members of the Ethiopian opposition group, Ginbot 7, as bait. The malware communicates with a FinSpy Command & Control server in Ethiopia, which was first identified by Rapid7 in August 2012. The server has been detected in every round of scanning, and remains operational at the time of this writing. It can be found in the following address block run by Ethio Telecom, Ethiopia’s state-owned telecommunications provider:

IP: 213.55.99.74
route: 213.55.99.0/24
descr: Ethio Telecom
origin: AS24757
mnt-by: ETC-MNT
member-of: rs-ethiotelecom
source: RIPE # Filtered

The server appears to be updated in a manner consistent with other servers, including servers in Bahrain and Turkmenistan.

MD5	8ae2febe04102450fdbc26a38037c82b
SHA-1	1fd0a268086f8d13c6a3262d41cce13470886b09
SHA-256	ff6f0bcdb02a9a1c10da14a0844ed6ec6a68c13c04b4c122afc559d606762fa

The sample is similar to a previously analyzed sample of FinSpy malware sent to activists in Bahrain in 2012. Just like Bahraini samples, the malware relocates itself and drops a JPG image with the same filename as the sample when executed by an unsuspecting user. This appears to be an attempt to trick the victim into believing the opened file is not malicious. Here are a few key similarities between the samples:

The PE timestamp “2011-07-05 08:25:31” of the packer is exactly the same as the Bahraini sample.
The following string (found in a process infected with the malware), self-identifies the malware and is similar to strings found in the Bahraini samples:
The samples share the same Bootkit, SHA-256: ba21e452ee5ff3478f21b293a134b30ebf6b7f4ec03f8c8153202a740d7978b2.
The samples share the same driverw.sys file, SHA-256: 62bde3bac3782d36f9f2e56db097a4672e70463e11971fad5de060b191efb196.

Figure 2. The image shown to the victim contains pictures of members of the Ginbot 7 Ethiopian opposition group
In this case the picture contains photos of members of the Ethiopian opposition group, Ginbot 7. Controversially, Ginbot 7 was designated a terrorist group by the Ethiopian Government in 2011. The Committee to Protect Journalists (CPJ) and Human Rights Watch have both criticized this action, CPJ has pointed out that it is having a chilling effect on legitimate political reporting about the group and its leadership.
The existence of a FinSpy sample that contains Ethiopia-specific imagery, and that communicates with a still-active command & control server in Ethiopia strongly suggests that the Ethiopian Government is using FinSpy.

3.2 FinSpy Mobile in Vietnam

We recently obtained and analyzed a malware sample⁶ and identified it as FinSpy Mobile for Android. The sample communicates with a command & control server in Vietnam, and exfiltrates text messages to a Vietnamese telephone number.
The FinFisher suite includes mobile phone versions of FinSpy for all major platforms including iOS, Android, Windows Mobile, Symbian and Blackberry. Its features are broadly similar to the PC version of FinSpy identified in Bahrain, but it also contains mobile-specific features such as GPS tracking and functionality for silent ‘spy’ calls to snoop on conversations near the phone. An in-depth analysis of the FinSpy Mobile suite of backdoors was provided in an earlier blog post: The Smartphone Who Loved Me: FinFisher Goes Mobile?

MD5	573ef0b7ff1dab2c3f785ee46c51a54f
SHA-1	d58d4f6ad3235610bafba677b762f3872b0f67cb
SHA-256	363172a2f2b228c7b00b614178e4ffa00a3a124200ceef4e6d7edb25a4696345

The sample included a configuration file⁷ that indicates available functionality, and the options that have been enabled by those deploying it:

Figure 3. Image of a section of a configuration file for the FinSpy Mobile sample
Interestingly, the configuration file also specifies a Vietnamese phone number used for SMS based command and control:

Section Type: TlvTypeConfigSMSPhoneNumber
Section Data: “+841257725403″

The command and control server is in a range provided by the CMC Telecom Infrastructure Company in Hanoi:

IP Address: 183.91.2.199
inetnum: 183.91.0.0 – 183.91.9.255
netname: FTTX-NET
country: Vietnam
address: CMC Telecom Infrastructure Company
address: Tang 3, 16 Lieu Giai str, Ba Dinh, Ha Noi

This server was active until very recently and matched our signatures for a FinSpy command and control server. Both the command & control server IP and the phone number used for text-message exfiltration are in Vietnam which indicates a domestic campaign.
This apparent FinSpy deployment in Vietnam is troubling in the context of recent threats against online free expression and activism. In 2012, Vietnam introduced new censorship laws amidst an ongoing harassment, intimidation, and detention campaign against of bloggers who spoke out against the regime. This culminated in the trial of 17 bloggers, 14 of whom were recently convicted and sentenced to terms ranging from 3 to 13 years.⁸

4. Brief Discussion of Findings

Companies selling surveillance and intrusion software commonly claim that their tools are only used to track criminals and terrorists. FinFisher, VUPEN and Hacking Team have all used similar language.⁹ Yet a growing body of evidence suggests that these tools are regularly obtained by countries where dissenting political activity and speech is criminalized. Our findings highlight the increasing dissonance between Gamma’s public claims that FinSpy is used exclusively to track “bad guys” and the growing body of evidence suggesting that the tool has and continues to be used against opposition groups and human rights activists.

While our work highlights the human rights ramifications of the mis-use of this technology, it is clear that there are broader concerns. A global and unregulated market for offensive digital tools potentially presents a novel risk to both national and corporate cyber-security. On March 12th, US Director of National Intelligence James Clapper stated in his yearly congressional report on security threats:

“…companies develop and sell professional-quality technologies to support cyberoperations–often branding these tools as lawful-intercept or defensive security research products. Foreign governments already use some of these tools to target U.S. systems.”

The unchecked global proliferation of products like FinFisher makes a strong case for policy debate about surveillance software and the commercialization of offensive cyber-capabilities.
Our latest findings give an updated look at the global proliferation of FinSpy. We identified 36 active FinSpy command & control servers, including 30 previously-unknown servers. Our list of servers is likely incomplete, as some FinSpy servers employ countermeasures to prevent detection. Including servers discovered last year, we now count FinSpy servers in 25 countries, including countries with troubling human rights records. This is indicative of a global trend towards the acquisition of offensive cyber-capabilities by non-democratic regimes from commercial Western companies.
The Vietnamese and Ethiopian FinSpy samples we identified warrant further investigation, especially given the poor human rights records of these countries. The fact that the Ethiopian version of FinSpy uses images of opposition members as bait suggests it may be used for politically influenced surveillance activities, rather than strictly law enforcement purposes.
The Ethiopian sample is the second FinSpy sample we have discovered that communicates with a server we identified by scanning as a FinSpy command & control server. This further validates our scanning results, and calls into question Gamma’s claim that such servers are “not … from the FinFisher product line.”¹⁰ Similarities between the Ethiopian sample and those used to target Bahraini activists also bring into question Gamma International’s earlier claims that the Bahrain samples were stolen demonstration copies.
While the sale of such intrusion and surveillance software is largely unregulated, the issue has drawn increased high-level scrutiny. In September of last year, the German foreign minister, Guido Westerwelle, called for an EU-wide ban on the export of such surveillance software to totalitarian states.¹¹ In a December 2012 interview, Marietje Schaake (MEP), currently the rapporteur for the first EU strategy on digital freedom in foreign policy, stated that it was “quite shocking” that Europe companies continue to export repressive technologies to countries where the rule of law is in question.¹²
We urge civil society groups and journalists to follow up on our findings within affected countries. We also hope that our findings will provide valuable information to the ongoing technology and policy debate about surveillance software and the commercialisation of offensive cyber-capabilities.
Corrections (15 March 2013):
* The table of FinFisher server IP addresses has been revised since the original publication. Due to an issue during formatting, Ethio Telecom was incorrectly identified as being in Estonia rather than in Ethiopia and Iusacell PCS was incorrectly identified as being in Malaysia rather than in Mexico. The IP range 117.121.xxx.xxx corresponds with GPLHost, which is located in Malaysia. Iusacell PCS corresponds with 187.188.xxx.xxx and is located in Mexico.

Acknowledgements

We’d like to thank Eva Galperin and the Electronic Frontier Foundation (EFF), Privacy International, Bahrain Watch, and Drew Hintz.

Media Coverage

Media coverage of the report includes HuffingtonPost Canada, Salon, The Verge,Bloomberg Business Week, TheYoungTurks.

Footnotes

¹https://www.gammagroup.com/
²Software Meant to Fight Crime Is Used to Spy on Dissidents, http://goo.gl/GDRMe, New York Times, August 31, 2012, Page A1 Print edition.
³Cyber Attacks on Activists Traced to FinFisher Spyware of Gamma, http://goo.gl/nJH7o, Bloomberg, July 25, 2012
⁴http://bits.blogs.nytimes.com/2012/08/16/company-denies-role-in-recently-uncovered-spyware/
⁵http://www.sueddeutsche.de/digital/finfisher-entwickler-gamma-spam-vom-staat-1.1595253
⁶This sample has also been discussed by Denis Maslennikov from Kasperksy in his analyses of FinSpy Mobile –https://www.securelist.com/en/analysis/204792283/Mobile_Malware_Evolution_Part_6
⁷Configuration parsed with a tool written by Josh Grunzweig of Spider Labs –http://blog.spiderlabs.com/2012/09/finspy-mobile-configuration-and-insight.html
⁸https://www.eff.org/deeplinks/2013/01/bloggers-trial-vietnam-are-part-ongoing-crackdown-free-expression
⁹https://www.securityweek.com/podcast-vupen-ceo-chaouki-bekrar-addresses-zero-day-marketplace-controversy-cansecwest
¹⁰http://bits.blogs.nytimes.com/2012/08/16/company-denies-role-in-recently-uncovered-spyware/
¹¹http://www.guardian.co.uk/uk/2012/nov/28/offshore-company-directors-military-intelligence
¹²http://www.vieuws.eu/foreign-affairs/digital-freedoms-marietje-schaake-mep-alde/

Microsoft flaw allows USB loaded with payload to bypass security controls

2013-03-16T13:37:00.001+04:00

This flaw allows anyone with a USB thumb drive loaded with the payload to bypass security controls and access a vulnerable system even if AutoRun is disabled, and the screen is locked. Flaw exposes your Windows PCs to major risk. If you remember Stuxnet, worm was injected to Iran's nuclear program system using USB thumb drive.

Windows typically discovers USB devices when they are inserted or when they change power sources (if they switch from plugged-in power to being powered off of the USB connection itself).
Microsoft flaw allows USB loaded with payload to bypass security controls

Script Execution flaw in Google drive poses security threat

2013-03-16T13:36:00.001+04:00

Once again Google Security Team Shoot itself in the foot. Ansuman Samantaray, an Indian penetration tester discovered a small, but creative Security flaw in Google drive that poses phishing threat to million of Google users was ignored by Google Security team by replying that,"It is just a mare phishing attempt,not a bug in Google".

According to Ansuman, he reported a JavaScript Script Execution vulnerability in Google Drive Files on 20th December 2012 to Google Security Team and but Google rejected the report on 21st December.
Script Execution flaw in Google drive poses security threat

HP LaserJet Security flaw allows remote data access

2013-03-16T13:34:00.001+04:00

A critical vulnerability discovered in certain LaserJet Pro printers that could give remote attackers access to sensitive data. Homeland Security’s Computer Emergency Response Team recently issued a vulnerability note warning that HP LaserJet Professional printers contain a telnet debug shell which could allow a remote attacker to gain unauthorized access to data.

This flaw was discovered by a Germany security expert, Christoph von Wittich. He detected the vulnerability during a routine network scan of his company's corporate network.
HP LaserJet Security flaw allows remote data access

Critical iOS vulnerability in Configuration Profiles pose malware threat

2013-03-16T13:32:00.001+04:00

Israeli mobile security start-up Skycure has exposed a vulnerability that could allow hackers to control and spy on iPhones. A major security vulnerability for iOS configuration profiles pose malware threat.

The vulnerability affects a file known as mobileconf files, which are used by cell phone carriers to configure system-level settings. These can include Wi-Fi, VPN, email, and APN settings. Apple used to use them to deliver patches, and carriers sometimes use them to distribute updates.
Critical iOS vulnerability in Configuration Profiles pose malware threat

Android SwiftKey Keyboard turned into a Keylogger app

2013-03-16T13:26:00.001+04:00

One of the best 3rd party Android Mobile Keyboard called 'SwiftKey' turned into a Keylogger Trojan by an Android developer to show the possible security threat of using pirated cracked apps from from non-official App Stores, "anyone pirating Swiftkey is taking a serious risk" developer said to 'The Hacker News'.
Android SwiftKey Keyboard turned into a Keylogger app

All subdomains of Wordpress blocked in Russia

2013-03-16T12:30:00.000+04:00

Recently one of wordpress subdomain was blocked "by Russian Law" by Russian Telecom Operator known as Beeline/Vimpelkom, however it successfully works via MTS network provider, Yota (as a Russian mobile broadband services provider and smartphone manufacturer, or web-proxy.
read

Red October Detailed Malware Description (by Kaspersky)

2013-03-15T22:38:00.000+04:00

Red October. Detailed Malware Description by Yury Chemerkin

links:

Red October - Java Exploit Delivery Vector Analysis

“Red October”. Detailed Malware Description 1. First Stage of Attack

“Red October”. Detailed Malware Description 2. Second Stage of Attack

“Red October”. Detailed Malware Description 3. Second Stage of Attack

“Red October”. Detailed Malware Description 4. Second Stage of Attack

“Red October”. Detailed Malware Description 5. Second Stage of Attack

Statement for the Record Worldwide Threat Assessment of the US Intelligence Community Senate Select Committee on Intelligence

2013-03-15T21:15:00.001+04:00

2013 Ata Sfr for Ssci 12 Mar 2013 by Yury Chemerkin

WikiLeaks Will Be Nothing Compared to FinCENLeaks

2013-03-15T21:07:00.002+04:00

According to Reuters, the Treasury Department is planning on expanding access to FinCEN reports — which include Suspicious Activity Reports from over 25,000 financial institutions — to the intelligence community, including CIA.

The Treasury document outlines a proposal to link the FinCEN database with a computer network used by U.S. defense and law enforcement agencies to share classified information called the Joint Worldwide Intelligence Communications System.

More than 25,000 financial firms – including banks, securities dealers, casinos, and money and wire transfer agencies – routinely file “suspicious activity reports” to FinCEN. The requirements for filing are so strict that banks often over-report, so they cannot be accused of failing to disclose activity that later proves questionable. This over-reporting raises the possibility that the financial details of ordinary citizens could wind up in the hands of spy agencies.

source

ClipShare 4.1.4 - Multiple Vulnerabilities

2013-03-15T20:57:00.001+04:00

===================================================================== Vulnerable Software: ClipShare - Video Sharing Community Script 4.1.4 Official site: http://www.clip-share.com Software License: Commercial. Vulns: Blind SQl injection && Plaintext Password. ====================================================================== AFAIK all versions is vulnerable: Official Demo is also vulnerable: http://www.clipsharedemo.com/ugroup_videos.php?urlkey=%27%20and%203=%273 Last Checked: 13 March 2013 source

WordPress LeagueManager Plugin 3.8 - SQL Injection

2013-03-15T20:49:00.001+04:00

#!/usr/bin/ruby

# Exploit Title: WordPress LeagueManager Plugin v3.8 SQL Injection

# Google Dork: inurl:"/wp-content/plugins/leaguemanager/"

# Date: 13/03/13

# Exploit Author: Joshua Reynolds

# Vendor Homepage: http://wordpress.org/extend/plugins/leaguemanager/

# Software Link: http://downloads.wordpress.org/plugin/leaguemanager.3.8.zip

# Version: 3.8

# Tested on: BT5R1 - Ubuntu 10.04.2 LTS

# CVE: CVE-2013-1852

source