“The start of the year has seen some serious cyber-attacks, including the hacking of the Twitter accounts of major organizations such as the BBC or Burger King, and one of the biggest attacks ever, targeting some of the world’s leading technology companies: Apple, Facebook, Microsoft and Twitter. But there have been some victories for security forces as well, including the arrest of a group of hackers accused of extortion using the infamous ‘Police Virus’,” said Luis Corrons, technical director of PandaLabs.

Android, Top Target for Mobile Malware

Practically all news regarding malware attacks on mobile platforms involved the Android operating system, which has the largest share of this market. In addition to the usual attacks, this quarter saw new techniques that deserve mention. A strain of Android malware -hidden inside Google Play- not only infected cell phones but could also infect computers via smartphones and tablets.

According to Corrons, the area of cyber-war and espionage is becoming more and more interesting. “Many countries are looking suspiciously at China regarding its suspected involvement in attacks on large organizations and public institutions around the world, and this could lead to real world consequences. There are those who argue for international agreements, a type of Geneva Convention, to attempt to establish limits to these activities”, he said.

The Fight against Cyber-Crime

On January 11, the European Commission inaugurated the  in order to support member states in the fight against cyber-attacks. Also in January, the FBI published details of an investigation that began in 2010 and thwarted a gang of cyber-criminals who had infected more than a million computers since 2005. This operation stands out not least because of the coordination between security forces in different countries. The FBI had the support of police in Moldavia, Romania, Holland, Germany, Finland, Switzerland and the UK.

There are also many different aspects to the fight against cyber-crime. And one which is often ignored is the need to alert companies to the importance of dedicating resources to protecting customer data. As a timely reminder of this, the UK division of Sony Computer Entertainment was ordered to pay 250,000 pounds as a result of the theft of customer data in 2011. The sentence is the consequence of the lack of measures that the company had implemented to protect customer information.

Police Virus Scam

One of the most infamous cases of the last year or so has been the ‘Police Virus’. In February this virus once again hit the headlines, but this time for a very different reason. The Technological Investigation Brigade of Spain’s National Police, together with Europol and Interpol, dismantled the cyber-crime ring responsible for the Police Virus. “We noticed that the news mentioned the arrest of ‘the gang’ of cyber-criminals, yet the information we have at PandaLabs points to the existence of several gangs responsible for these attacks. We reached this conclusion after analyzing numerous variants of the malware over time, and observing significant differences between them. In short, we are afraid the Police Virus is not likely to go away anytime soon. Users shouldn’t lower their guard,” said Corrons.

Twitter, Facebook, Apple and Microsoft Victims of the Same Attack

On February 1, Twitter published an article on its blog (“Keeping our users secure“) detailing how the social network had fallen victim to an attack resulting in unauthorized access to the details of some 250,000 Twitter users. A couple of weeks later, Facebook also released an article on its blog, “Protecting People On Facebook”, acknowledging that their systems had been targeted by a sophisticated attack. According to sources from the social network, user data was not compromised in this attack. Just a few days after the Facebook announcement, spokesmen from Apple told Reuters that the company had also been targeted by the same attack. And finally, of no less importance, Microsoft admitted that it too had been targeted. All these attacks exploited a previously unknown security hole in Java for which no patch was available. This is known as a zero-day vulnerability. In any event, here it is critical to be able to identify an attack when it is occurring, and Twitter, Facebook, Apple and Microsoft were able to do this.

Java

Most infections today occur through ‘exploit kits’, infecting users’ computers through a vulnerability without their knowledge. More than 90 percent of these are through Java vulnerabilities in browsers. The attacks on Microsoft, Apple, Facebook and Twitter used Java. Most ‘Police Virus’ infections managed to reach victims’ computers thanks to outdated versions of Java. What is the best way to prevent these infections? Simple: Just remove Java from the browser. If for any reason you need Java on your browser to use an application, use it on another browser set up specifically for this task.

Cyber-Attacks 

The number and variety of attacks in this quarter have been significant to say the least. Evernote was the victim of an intrusion that prompted the firm to release a statement calling on more than 50 million users to change their passwords. According to a statement from the U.S. Federal Reserve, its website was also attacked, although it did not say whether any data was stolen. The incident coincided however with the publication, by Anonymous, of the personal information of 4,000 U.S. bank executives, suggesting that the attack on the Fed may have been carried out by this group. NASA was also the victim of an intrusion. Internal information including email addresses, real names and passwords, was published on the popular website Pastebin.

Social Media

During this quarter various Twitter accounts have been hacked, including those of celebrities and also those of companies. One of the most notable cases was that of Burger King, with attackers seemingly managing to work out the account password and take control of the account. They changed the background image to that of McDonalds and claimed that the company had been taken over by its main rival. 

The Twitter account of car company Jeep was also the victim of a similar attack, in this case stating that the company had been bought out by Cadillac. Other attacks on Twitter accounts had a more political slant. A group of cyber-crooks calling themselves the “Syrian Electronic Army” managed to hack accounts belonging to several organizations. Apparently, phishing attacks were first launched to get the passwords and then the accounts were hijacked. Their victims included Human Rights Watch, the French news channel France 24 and the BBC weather service.

Cyber-War       

China often gets a mention in this section, but in Q1, the Asian giant has earned all the headlines. On January 30, The New York Times ran a front-page article explaining how they had been victims of an attack that had allowed their computers to be accessed and spied on for months. Coincidentally, the attack came just after the paper released an article describing how Chinese PM, Wen Jiabao, and his family had amassed a billion-dollar fortune.

A day later, The Wall Street Journal declared that it had also been the victim of a similar attack by Chinese hackers. The Chinese government protested against these ‘unjustified attacks’ and Hong Lei –Chinese Foreign Minister– claimed it was “…unprofessional and groundless to accuse the Chinese military of launching cyber attacks without any conclusive evidence”.

Interestingly, in both incidents the attackers were able to access all types of data (customer details, etc.), yet only focused on information about journalists and employees, trying to find any reference to investigative journalism regarding China, and in particular, looking for the papers’ sources.

The day after the Wall Street Journal’s revelations, another US media giant, The Washington Post, announced they had suffered a similar attack in 2011, also originating in China.

Some weeks later, Mandiant published a damning 76-page report (APT1: Exposing One of China’s Cyber Espionage Units, http://intelreport.mandiant.com/) explaining how Unit 61398 of the Chinese army has specialized in cyber-espionage. The report revealed more than 3,000 pieces of evidence showing how this unit has been running since at least 2006, stealing information from no less than 141 organizations worldwide.

“We may not truly appreciate the importance of the Mandiant report and the impact it may have in the mid to long term. Proving who is behind any attack is highly complex, even in normal cyber-crime cases. When it comes to cyber-espionage things are further complicated by the simple fact that whoever is behind the operation is highly qualified and is adept at covering their tracks. For some years now, people have turned their gaze to China whenever this type of incident occurs, yet without any real evidence that the Chinese government is behind such attacks. Now, for the first time, it has been proven that the Chinese army is actively involved in espionage on a global scale, infiltrating companies across many sectors and stealing information”, explained Corrons.

The beta can be downloaded for free at http://www.pandasecurity.com/spain/promotions/betatest/

Along with the release of the beta, Panda also announced the launch of a beta testing competition. All users testing the solution will receive a 50 percent discount on the purchase of the final product, and the ten beta testers suggesting the most helpful improvements will each receive a $200 Amazon.com gift certificate.

Even More Security

Panda Global Protection 2014 is the most comprehensive solution in Panda Security’s new retail product lineup to be launched in the next few months. The product continues to improve upon previous versions, providing even better real-time protection against all kinds of threats. The product leverages Panda’s unique Collective Intelligence Technology to collect threat intelligence from millions of computer users and deliver automated, instantaneous protection against known and unknown malware from the cloud.

“The new version of Panda Global Protection 2014 is specifically designed for highly-active users with the most demanding protection needs in multi-platform, multi-device environments. The solution preserves user security and privacy on the Internet and specifically social networking sites. In addition, the Panda Global Protection 2014 Beta prevents identity theft as it lets users encrypt private files and folders with valuable information”, explained Hervé Lambert, Retail Product Marketing Manager at Panda Security.  

Panda Global Protection 2014 includes a new disinfection kit for infected computers that allows users to create a safe boot point on the computer to be able to boot it and disinfect it in emergency situations where it has become so infected that it won’t start. Users can also create a bootable USB drive they can share to boot and disinfect any computer, even without a Panda Security product installed.

Multi-Platform, Multi-Device Protection

Another major benefit of the Panda Global Protection 2014 Beta is its new multi-platform and multi-device protection that offers unified security for PCs, Mac, Android, smartphones and tablets.

In short, the new features and improvements of the Panda Global Protection 2014 Beta include:

• Multi-platform, multi-device protection.
• New user interface look and feel, making it easier than ever to use the tools included in the 2014 lineup.
• Improved antivirus engine with better detection and disinfection capabilities.
• New installer that makes installation easier and faster than ever.
• New disinfection kit that allows users to create a safe boot point on infected computers to boot and disinfect them.

To download the free beta and get more information about the contest, please visit: http://www.pandasecurity.com/spain/promotions/betatest/

The latest scam takes advantage of email. Criminals gain access to the victim’s email account and send a message to every person in their contact list to extort money from them.

The message subject is “Muy Urgente” (“Very Urgent”) and always comes from a sender who has the victim in their email contacts. The message text explains that the sender is on vacation and has had their purse stolen with their credit cards and airline ticket inside, and needs money to get home. However, if the recipient falls for the scam and transfers the money as indicated in the email they will be contributing to filling the cyber-crook’s bank account.

“There are many variations of this type of scam. In this particular case, the message has been circulating the Internet for months now and is beginning to fade away,” said Luis Corrons, Technical Director of PandaLabs.

These fraudulent messages allow cyber-criminals not only to profit from victims, but also harvest addresses from personal and organization email accounts.

“One of the major problems victims of this type of attack face is the fact that the first thing cyber-criminals do is change the account’s password, preventing its legitimate owner from accessing it”, explained Corrons. “The problem can get even worse as many users use the same password for their Facebook or Twitter accounts, allowing cyber-criminal to control them and impersonate the victim”.

Always Protected

PandaLabs advises users to always use their common sense to avoid falling victim to this type of attack. In addition, consumers should have an effective security solution installed, or make use of free malware scanners like “Be wary of messages with these characteristics. Should you receive one, contact the sender directly by telephone, for example, and make sure the message is genuine” , said Corrons. 

Trojans set a new record, causing nearly 80 percent of all computer infections worldwide. Despite their inability to replicate, Trojans are capable of triggering massive infections through compromised Web sites that exploit vulnerabilities in browser plug-ins like Java, Adobe Reader, etc. This attack method allows hackers to infect thousands of computers in just a few minutes with the same Trojan or different ones, as attackers have the ability to change the Trojan they use based on multiple parameters such as the victim’s location, the operating system used, etc.

“Trojans are cyber-crooks’ weapon of choice, which explains why they account for most new specimens in circulation and infections triggered in the first quarter of the year,” explained Luis Corrons, technical director of PandaLabs. 

NEW MALWARE DISTRIBUTION IN Q1 2013 (PandaLabs)

MALWARE INFECTIONS BY TYPE IN Q1 2013 (PandaLabs)

COUNTRIES WITH THE MOST INFECTED COMPUTERS

The average number of infected PCs across the globe stands at 31.13 percent. The countries leading the list of most infections are China (the only nation with more than 50 percent of computers infected), followed by Ecuador (41.01 percent of infected PCs) and Turkey (40.38 percent). The top ten list of malware-infected countries is completed with Argentina (37.77 percent), Peru (37.43 percent), Taiwan (36.48 percent), Russia (36.21 percent), Poland (33.79 percent), Spain (33.58 percent) and Brazil (33.45 percent). These are joined by another four countries with above-average infection rates: Chile (33.37 percent), Colombia (32.01 percent), Italy (31.97 percent) and Venezuela (31.45 percent).

 LEAST MALWARE-INFECTED COUNTRIES

The list of least infected countries is dominated by European nations. The country with the fewest infections is Finland (17 percent of infected PCs), followed by Sweden (20 percent), and Switzerland (20.99 percent). The other countries with the lowest infection rates are: United Kingdom (21.89 percent), Norway (22.57 percent), Japan (22.82 percent), Germany (22.94 percent), Belgium (23.89 percent), Holland (23.92 percent) and Australia (24.32 percent).

Finally, here is a list of countries that did not make the top ten list, but which had a malware infection rate below the worldwide average: Canada (24.89 percent), Denmark (25.72 percent), Portugal (26.91 percent), Costa Rica (27.22 percent), France (27.43 percent), United States (27.79 percent), Mexico (29.91 percent) and Hungary (30.69 percent).

Panda Cloud Office Protection 6.5 improves business productivity by adding Internet access control to its Advanced edition. Additionally, the solution enhances corporate security by detecting malware and phishing URLs before they can infect users’ computers. Also, and thanks to Panda Security’s cloud-based technologies, Panda Cloud Office Protection 6.5 can be managed remotely from anywhere in the world.

“We aim to help companies increase their productivity with a solution that allows businesses to monitor and control employees’ use of the Internet, while protecting them when they browse the Web or download contents,” said Manuel Santamaría, Global Product Manager at Panda Security. “Our new solution facilitates security management and provides an additional layer of protection against malicious Internet links and exploits that take advantage of system vulnerabilities.”

URL Filtering

Panda Cloud Office Protection 6.5 Advanced helps increase employee productivity by controlling Web access. It incorporates URL monitoring and filtering on workstations, and allows administrators to define profile-based whitelists and blacklists.

The solution’s URL filtering feature provides maximum protection for users against malware and phishing URLs over HTTP and HTTPS, adding an additional layer of security to their Web browsing. This way, if a URL is cataloged as malicious, any attempt to access it or download any content from it will be automatically blocked by the system.

Protection Against Unknown Attacks

The growing proliferation of malware threats has shown that traditional, signature-based protection is no longer enough. Panda Cloud Office Protection 6.5 leverages Panda Security’s Collective Intelligence system and incorporates new unmatched anti-exploit technologies which detect and neutralize malware that exploits zero-day vulnerabilities. 

More precisely, Panda Security’s new anti-exploit technologies are capable of detecting malware like Blackhole or Redkit that exploits zero-day vulnerabilities in Java, Adobe or Microsoft Office, among others, before it infects users’ computers. The solution’s major differentiating factor lies in its ability to identify new, unknown malware variants capable of infecting thousands of computers around the world, like the infamous “Police Virus”.

Other Major Improvements

The new Panda Cloud Office Protection 6.5 incorporates other significant improvements from the previous version. These include:

• Compatibility with Exchange 2013 and the most popular Linux distributions (SUSE, RedHat, Debian and Ubuntu), plus scheduled and on-deman scanning.
•  Scheduled updates for users of both Panda Cloud Office Protection and Panda Cloud Office Protection Advanced.
• Ability to schedule reports from the Panda Cloud Office Protection console. Up to now, scheduled reports were only available to partners using Panda Cloud Partner Center.

Panda Cloud Antivirus, which boasts the Windows 8 Compatible logo, is one of the best-rated free alternatives for the Microsoft operating system, according to AV-Test.org. Results from the latest comparative reviews by this prestigious laboratory rate Panda Cloud Antivirus Free Edition above other security products, including Windows Defender (Microsoft Security Essentials in previous versions of the OS), Microsoft’s free antivirus in Windows 8, both in terms of protection and performance.

These trials, run in January and February 2013, consider a series of factors including protection against malware infection, the ability to repair systems and eradicate malware in infected computers, as well as usability and system performance. Panda Cloud Antivirus scored 6 out of 6 in usability and returned great results in protection (4.5/6) and performance (4/6).

“Having already achieved the Windows 8 Compatible seal, now being one of the first security providers to deliver a free solution on Windows Store is truly satisfying for Panda Security,” says Alberto Añón, Consumer Product Manager at Panda Security. “It is essential for us to keep our users protected with maximum security, and Panda Cloud Antivirus has proven to be a quality product, and a better alternative to others on the market in terms of protection and performance.”

 An Exciting New Release

The release of Panda Cloud Antivirus on Windows Store also includes Panda Cloud Antivirus Pro. This advanced, paid version is available with a 50 percent discount until May 15 for Windows Store users.

The Pro version of Panda Cloud Antivirus offers extra features not included in the free version, such as a firewall, WiFi network protection, automatic USB vaccine and 24×7 VIP technical support in numerous languages. It also includes all the improvements made to the new 2.1.1 version, with anti-exploit protection against zero-day vulnerabilities affecting applications like Office, Adobe or Java.

Facebook’s AV Marketplace will now allow users to enjoy Panda Security’s malicious URL protection in six languages (English, Spanish, French, German, Italian and Portuguese),  increasing the scope of the initiative.

Since the start of the promotion, six months ago, Facebook users have carried out over 10,000 activations of  Panda Internet Security 2013’s free 6-month version.

“We’re extremely happy with the results obtained from our collaboration with Facebook, which now extends to six different languages. This joint initiative against malware has been extremely well received by users. In fact, during the first six months of the promotion, users have carried out a total of 10,000 activations of our solution Panda Internet Security 2013,” explained Enrique Aguilera, VP Consumer Sales and Marketing at Panda Security.

About Panda Internet Security 2013

Panda Internet Security 2013 is specifically designed to protect users’ identity while using social networking sites and other Internet services. Its powerful URL filtering engine and safe browser module are particularly useful for users who want to preserve their privacy and security. Additionally, it can encrypt and password-protect private files and folders to prevent the theft of personal, banking and financial data or valuable multimedia content.

Panda Internet Security 2013 also includes Identity Protect, a module that provides anti-phishing protection, data leak prevention, and anti-dialer protection against unauthorized charged calls. Also, it delivers real-time protection against known and unknown threats by harnessing the knowledge and experience of millions of users through Panda’s unique cloud-based Collective Intelligence technology.

Every day, PandaLabs receives nearly 206,000 new files, 73,000 of which are new malware strains that Collective Intelligence automatically analyzes, classifies and remedies in 99.6 percent of cases. These technologies gather information on malware received from each computer to continuously improve protection levels for the worldwide Panda community. The 2013 product line leverages this huge knowledge base, offering users a more rapid response to the newest and most dangerous malware attacks.

Panda Internet Security 2013 includes a more modern, intuitive interface than ever before, and is compatible with Windows 8, Microsoft’s new operating system.

Torres holds a Bachelor’s Degree in Journalism from the Complutense University of Madrid, and has over 15 years of experience working in the Information and Communication Technology (ICT) sector. For more than a decade, she was the editor-in-chief of TCN (Technology Channel News), a publication concerning IT distribution channels and partnerships, as well as a regular contributor to other publications in the technology area.

Over the last few months, Torres has acted as coordinator for Samsung’s IT and Telecommunications division at the Asesores de Relaciones Públicas y Comunicación PR and communications agency.

Silvia Torres has a Master’s Degree in Community Management & Social Media Marketing from CEDECO.

“Joining Panda Security, a leading multinational company with presence in 56 countries and over 10 million users around the world, is an exciting new challenge that will allow me to grow both personally and professionally, helping develop the communication processes of a top player in the security and innovation sectors”, said Silvia Torres.

 -       Partners can now offer a comprehensive security and system management service to customers, with Panda Cloud Office Protection, Panda Cloud Office Protection Advanced and Panda Cloud Systems Management integrated in the new console.

-      With Panda Cloud Partner Center, Panda partners can offer a flexible license subscription service to customers, buying packs of licenses at highly competitive prices.

Panda Security, The Cloud Security Company, is launching the new version of Panda Cloud Partner Center, the exclusive and free management console for Panda Security partners. This tool is a comprehensive solution for centralized security management, simplifying life for partners while maximizing their profits.

The Panda Cloud Partner Center console now offers a single access point from which to centrally manage Panda Security’s cloud solution portfolio. Through this tool, partners can provide security services and remote system monitoring and management, optimizing resources and increasing profitability.

The simplicity that this new console offers is thanks to the integration of the company’s cloud security solutions, Panda Cloud Office Protection, Panda Cloud Office Protection Advanced, and Panda Cloud Email Protection and the new management and monitoring system, Panda Cloud Systems Management. In this way, partners can manage the entire customer life-cycle quickly and simply without Panda having to intervene, while increasing profitability.

“The new Panda Cloud Partner Center lets partners focus on their business and eliminates the hassle of working with various cloud vendors,” says Manu Santamaria, Product Manager at Panda Security Headquarter. “As vendors, we need to help our partners make their business model flexible, so the service they offer customers is not only much more effective, but also generates higher margins” .

With this new version of Panda Cloud Partner Center, and thanks to Panda Security’s cloud solutions, partners can now sell added-value cloud services to SMBs simply, flexibly and profitably.

In addition, the new Panda Cloud Partner Center makes it easy to manage customers and the solutions from a single console. Managing and monitoring customers’ product life-cycle (trial versions, assigning licenses and renewals), identifying business opportunities, extending licenses and cross-selling between products, these are just some of the advantages offered by Panda Cloud Partner Center, not to mention remote system monitoring, incident resolution or anti-malware protection management. All through a system designed to offer partners speed and independence.

Greater Flexibility and Profitability for The Channel

One of the key new features of the new Panda Cloud Partner Center console is a new license sales model. Not only can partners sell licenses in the traditional way, they can now sell subscription services (e.g. monthly) without licenses expiring, and the solution will always be updated to the latest version.

This way, if a customer cancels their subscription and there are still active licenses, partners can use the console to automatically recover them and reassign them to another customer. All this with just a few clicks, from a Web console available from anywhere at any time.

Partners can also increase margins buying license packs at bulk discounts. These Panda Cloud solution license packs can be used directly by partners through the console without Panda’s intervention, enabling partners to buy licenses in advance and then assign them to customers, improving profitability and simplicity.

Partners that want to enjoy all the benefits of the new Panda Cloud Partner Center, -whose user base grew 81 percent worldwide in 2012-, can contact the Panda Security sales team. For more information, go to:

www.pandasecurity.com/enterprise/solutions/cloud-partner-center

About Panda Security

Founded in 1990, Panda Security is the world’s leading provider of cloud-based security solutions, with products available in more than 23 languages and millions of users located in 195 countries around the World. Panda Security was the first IT security company to harness the power of cloud computing with its Collective Intelligence technology. This innovative security model can automatically analyze and classify thousands of new malware samples every day, guaranteeing corporate customers and home users the most effective protection against Internet threats with minimum impact on system performance. Panda Security has 56 offices throughout the globe with US headquarters in Florida and European headquarters in Spain

Panda Security supports the Project Stella as part of its Corporate Social Responsibility policy to promote the integration of people with disabilities in society and the workplace.

For more information, visit www.pandasecurity.com

-               ’Police Virus’ still rampant despite the arrest of the cyber-criminals allegedly responsible for the attacks

-               The number of infections has doubled since the arrest of the cyber-gang leader in Dubai

Despite the arrest of the cyber-criminals allegedly responsible for the ‘Police Virus’ ransomware attacks, the infamous piece of malware has continued to infect thousands of computers around the world, according to data gathered by PandaLabs, the anti-malware laboratory of Panda Security, from December 2012 to February 2013.

The arrest of the cyber-gang leader in Dubai, in an international operation led by the Technological Investigation Brigade of Spain’s National Police force and coordinated by Europol and Interpol, has not put an end to the malware epidemic.

“This ransomware was netting its creators profits in excess of €1 million per year,” explained Luis Corrons, technical director of PandaLabs. “However, the number of infections keeps growing, which leads us to think that we are facing an unspecified number of groups launching the same kind of attacks.”

The ‘Police Virus’ Is Still Active 

This malware epidemic has continued to infect hundreds of thousands of computers around the world, using fear and blackmailing techniques to extort money from computer users. The scam is very lucrative and has evolved over time, using various techniques to trick users. The most recent evolution even shows images taken with the user’s webcam, making the scam all the more realistic.

In fact, research carried out by PandaLabs on two of the malware families used in the attacks has revealed that the number of infections has doubled from 2,500 to more than 5,000 since the arrest of the ringleader in December 2012 until February 2013.

The vast majority of these infections are caused by ”exploit kits”, applications that allow attackers to infect users’ computers simply by getting them to visit a compromised Web page. Cyber-criminals take advantage of security flaws in popular programs –such as Adobe Acrobat or Java, for example– to gain control of systems. At present, there are still a lot of variants of the Police Virus in circulation, all of them detected by PandaLabs as Trj/Ransom.AB.

PandaLabs offers users a series of tips to avoid falling victim to this type of scam: Keep your computer’s software (including the operating system and all installed programs) up-to-date; disable Java in your Web browser, or uninstall it completely if you don’t need it.

Panda Security, The Cloud Security Company, has launched a new version of its free antivirus software Panda Cloud Antivirus that neutralizes malware that takes advantage of any of the vulnerabilities exploited by the Police Virus, even of those that have not yet been identified.

More information is available in the PandaLabs Blog.