• Category Archives Computer News
  • News about computer and IT technology services

  • Google DNS servers suffer brief traffic hijack

    Are security measures enabled?

    Traffic to Google’s commonly used public DNS service was rerouted over the weekend, meaning all traffic with Domain Name System resolution queries destined for Google’s servers ended up at a Venezuelan network instead.

    UK telco BT’s Latin America division in Venezuela became the destination for the IP address range used by Google, in a phenomenon known as BGP (border gateway protocol) hijacking, according to monitoring firm BGPmon.

    The rerouting affected networks in that country and Brazil for 22 minutes, BGPMon said.

    Why BT Latin America was able to announce the incorrect traffic routing despite Google’s security measures to protect against hijacking isn’t known. iTnews has put in queries with both BGPMon and BT LATAM.

    BGP traffic hijacking is on the rise, according to internet performance metrics analyst firm Renesys, which last year noted that over a period of two months, around 1500 IP address blocks were rerouted. Several were in Australia.

    Google’s 8.8.8.8 and 8.8.4.4 (IPv6: 2001:4860:4860::8888 and 2001:4860:4860::8844) free public DNS resolvers were set up in 2009 with the aim to provide better performance for queries, as well as improved security.

    They are said to fully support DNSsec security policies and validation, but it is not clear whether the routers for the servers’ network support resource public key infrastructure (RPKI) for BGP.

    These security measures provide route origination authorization objects (ROAs) that specify which autonomous systems can announce routes for certain IP address prefixes

    A query by iTnews at whois.bgpmon.net for the ROA for the 8.8.8.0/24 network range did not produce any result, suggesting there is no policy in place to prevent BGP hijacking through wrong unauthorized announcements.

    Google’s free and open DNS infrastructure is very popular with users around the world. Last year, Google said its public DNS servers answer 130 to 150 billion queries a day from 70 million unique IP addresses.

    Similar large numbers were seen in a test by Geoff Huston at the Asia-Pacific Network Information Centre (APNIC) using just under 2.5 million clients. That test showed 7.2 percent had queries passed on to authoritative name servers from Google’s DNS service.

     

    Please visit ccrepairservices.com

    for latest computer repair and online news.

    Local and Online Virus removal and computer repairs anytime, anywhere


  • Scientists demonstrate first contagious airborne WiFi virus

    WiFi

    Researchers at the University of Liverpool have shown for the first time that WiFi networks can be infected with a virus that can move through densely populated areas as efficiently as the common cold spreads between humans.

    The team designed and simulated an attack by a virus, called “Chameleon”, and found that not only could it spread quickly between homes and businesses, but it was able to avoid detection and identify the points at which WiFi access is least protected by encryption and passwords.

    Researchers from the University’s School of Computer Science and Electrical Engineering and Electronics, simulated an attack on Belfast and London in a laboratory setting, and found that “Chameleon” behaved like an airborne virus, travelling across the WiFi network via Access Points (APs) that connect households and businesses to WiFi networks.

    Areas that are more densely populated have more APs in closer proximity to each other, which meant that the virus propagated more quickly, particularly across networks connectable within a 10-50 metre radius.

    Alan Marshall, Professor of Network Security at the University, said: “When “Chameleon” attacked an AP it didn’t affect how it worked, but was able to collect and report the credentials of all other WiFi users who connected to it. The virus then sought out other WiFi APs that it could connect to and infect.”

    “Chameleon” was able to avoid detection as current virus detection systems look for viruses that are present on the Internet or computers, but Chameleon is only ever present in the WiFi network. Whilst many APs are sufficiently encrypted and password protected, the virus simply moved on to find those which weren’t strongly protected including open access WiFi points common in locations such as coffee shops and airports.

    Professor Marshall continued said: “WiFi connections are increasingly a target for computer hackers because of well-documented security vulnerabilities, which make it difficult to detect and defend against a virus.

    “It was assumed, however, that it wasn’t possible to develop a virus that could attack WiFi networks but we demonstrated that this is possible and that it can spread quickly. We are now able to use the data generated from this study to develop a new technique to identify when an attack is likely.”


  • Microsoft will Alert Windows XP users to Upgrade

    In case you didn’t know already, Microsoft will be dropping support for Windows XP (SP3) and Office 2003 on April 8, 2014. From this date onwards, Microsoft will no longer provide new security updates, non-security hotfixes, free or paid assisted support options or online technical content updates.

    As such, use of Windows XP after this date (on non-isolated systems) is strongly discouraged. Indeed, to encourage PC owners to upgrade from Windows XP Microsoft will be presenting an official notification on the desktop of those Windows XP customers who are using the Home or Professional editions and who have elected to receive updates via Windows Update.

    The notification will look like this:

    Notification_5F00_64E154AA.jpg

    Note: this is a genuine notification and not a symptom of malware (which often uses similar looking prompts to entice a user to download further malicious software.

    Microsoft have also partnered with Laplink to provide Windows XP users with a free data migration tool called PCmover Express. This tool for Windows XP will copy over your files and settings from your Windows XP PC to a new device running Windows 7, Windows 8 or Windows 8.1. It will be available for download from windowsxp.com soon.

     

    WWW.CCREPAIRSERVICES.COM


  • Windows 8 had more vulnerabilities than previous versions of Windows

    Microsofts Windows 8 platform has been tagged by security research firm Secunia as being the most vulnerable Windows platform on the market….according to their research, Windows 8 had more vulnerabilities than previous versions of Windows that are currently supported by Microsoft for 2013….the answer is quite simple; Flash. Because Flash is now baked into the modern instance of IE, any Flash vulnerability can now be tied into Windows 8 as well.

    flashwin8.png

    Visit www.ccrepairservices.com for all latest computer repair and related news online


  • Dirty NSA hacked into Webcam of millions of Yahoo users for Private images

    Once again, a new revelation showed the ugly side of the Government who are conducting Global Mass surveillance and previous documents leaked by the whistleblower Edward Snowden have defaced the US Intelligence Agency NSA, who were taking care of a number of projects like PRISM, XKeyscore, DROPOUTJEEP, and various others to carry out surveillance of millions of people.

    Now, it has been revealed that the US National Security Agency (NSA) helped its British counterpart, the Government Communications Headquarters (GCHQ), to allegedly capture and store nude images and others from webcam chats of millions of unsuspecting Yahoo users, The Guardian reported.

    Documents handed to the Guardian by the former NSA contractor Edward Snowden show that the GCHQ’s worked with the US intelligence agency NSA on a joint project dubbed as ‘Optic Nerve’. The project carried out a bulk surveillance program, under which they nabbed webcam images every five minutes from random Yahoo users’ video chats and stored them in a database.

    The project didn’t target individual users; rather it targeted Yahoo webcam chats between 2008 and 2010. Indeed, the method of collection appears somewhat recklessly, and in just six months of period alone, the still images of about 1.8 million users were captured and stored in the government servers in 2008.

    Instead of saving full videos, the program logged one image every five minutes from a user’s chat. The document says that between 3 and 11 percent of the images taken contain “undesirable nudity.

    One GCHQ document states, “It would appear that a surprising number of people use webcam conversations to show intimate parts of their body to the other person.

    The collected webcam information was stored in the NSA’s XKeyscore search tool, and the NSA research was used to build the tool which identified Yahoo’s webcam traffic, reads the report.

    NSA Optic Nerve Webcam hacking

    GCHQ webcam spying program, Optic Nerve, was still active in 2012, according to an internal GCHQ wiki page accessed that year.

    Why Images??? It is known from the revealed documents that the images were collected by the government agency, so that the group could experiment with facial recognition.

    Face detection has the potential to aid selection of useful images for ‘mugshots’ or even for face recognition by assessing the angle of the face,” it reads. “The best images are ones where the person is facing the camera with their face upright.

    NSA Optic Nerve Webcam hacking

    The GCHQ agency staffs were allowed to display “webcam images associated with similar Yahoo identifiers to your known target”, the document reads, also it states “Bulk surveillance of Yahoo users was begun” as “Yahoo webcam is known to be used by GCHQ targets.

    Not Surprising, because your knotty private webcam sex session you loved and enjoyed with your lover four years back was potentially pored over by the suits at GCHQ.

    Yahoo has reacted furiously and denied any prior knowledge of the webcam interception program, and said that it had no awareness of or involvement with the GCHQ collection, describing the activity as “a whole new level of violation of our users’ privacy.

    And a GCHQ spokesman said in a statement, “It is a longstanding policy that we do not comment on intelligence matters. Furthermore, all of GCHQ’s work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorized, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence service commissioners and the Parliamentary Intelligence and Security Committee,” adding, “All our operational processes rigorously support this position.

    The NSA spokesperson declined to respond saying, “As we’ve said before, the National Security Agency does not ask its foreign partners to undertake any intelligence activity that the US government would be legally prohibited from undertaking it.

    This is how our privacy is getting ruined by the government intelligence officials that we all trust blindly.

    Latest Computer news and virus and malware threats at Complete computer Repair Services Fort Lauderdale and all South Florida Latest Computer News and Repair Services

    www.ccrepairservices.com


  • Android iBanking Trojan Source Code LEAKED ONLINE

    Smartphone is the need of everyone today and so the first target of most of the Cyber Criminals. Malware authors are getting to know their market and are changing their way of operations. Since last year we have seen a rise in the number of hackers moving from the Blackhat into the Greyhat.

     

    iBanking, a new mobile banking Trojan app which impersonates itself as an Android ‘Security App‘, in order to deceive its victims, may intimidate a large number of users as now that its source code has been leaked online through an underground forum.

    It will give an opportunity to a larger number of cybercriminals to launch attacks using this kind of ready-made mobile malware in the future.

     

    Since many banking sites use two-factor authentication and transaction authorization systems in order to deal with the various threats, by sending unique one-time-use codes to their customers’ registered phone numbers via SMS, but in order to defraud them, cyber criminals have started to create various mobile malware like iBanking to solve their purpose.

     In addition, with the iBanking malware, Computer malware is used to defeat the mobile-based security mechanisms used by the banking sites.

    Apart from the server-side source-code, the leaked files also include a builder that can un-pack the existing iBanking APK file and re-pack it with different configurations, essentially providing fraudsters with the means to create their own unique application,” added Daniel Cohen.

    In addition to SMS Sniffing, the iBanking app allows an attacker to redirect calls to any pre-defined phone number, capture audio using the device’s microphone and steal other confidential data like call history log and the phone book contacts.

    During the installation process, the malicious app attempts to Social Engineer the user into providing it with administrative rights, making its removal much more difficult.

    Latest Computer news and virus and malware threats at Complete computer Repair Services Fort Lauderdale and all South Florida Latest Computer News and Repair Services

    www.ccrepairservices.com


  • Mass Exploit of Linksys Routers

    It has been revealed that a vulnerability in possibly 23 different models of Linksys (Belkin) routers has been exploited by a worm known as The Moon.

     

    The exploit was first noticed about a week ago and reported by the Internet Storm Center. The Worm bypasses authentication on the router to take control. Linksys state that “the router starts flooding the network with ports 80 and 8080 outbound traffic, resulting in heavy data activity”. The worm also attempts to detect any vulnerable systems on the router’s network for exploitation.

     

    Current intentions of The Moon are not yet known, however, there is code within the worm which seems to suggest that it may be gathering infected routers into a network of compromised devices through a command and control system.

     

    Linksys will be issuing a firmware update to fix the vulnerability in the next few weeks. But for now, if you’re using a Linksys router, you should read the advice given here to disable Remote Access Management.

     

    Latest Computer news and virus and malware threats at Complete computer Repair Services

    www.ccrepairservices.com


  • The Mask, A malware campaign that remained undetected for 7 years

    A Sophisticated cyber spying operation, ‘The Mask’, that has been under the mask for about 7 years targeting approximately 31 countries, has now been ‘unmasked’ by researchers at Kaspersky Labs.
    The Researchers believe that the program has been operational since 2007 and is seems to be sophisticated nation-state spying tool that targeted government agencies and diplomatic offices and embassies before it was disclosed last month.
    In the unveiling document published by Kaspersky, they found more than 380 unique victims, including Government institutions, diplomatic offices/embassies, private companies, research institutions, activists etc.
    The name “Mask” comes from the Spanish slang word “Careto” (“Ugly Face” or “Mask”) which the authors included in some of the malware modules.
    Developers of the ‘Mask’ aka ‘Careto’ used complex tool-set which includes highly developed malware, bootkit, rootkit etc. that has the ability to sniff encryption keys, VPN configuration, SSH keys and RDP file via intercept network traffic, keystrokes, Skype conversation, PGP keys, WI-Fi traffic, screen capturing, monitoring all file operations, that makes it unique and dangerous and more sophisticated than DUQU malware.
    The malware targets files having an extension:

    *.AKF, *.ASC, *.AXX, *.CFD, *.CFE, *.CRT, *.DOC, *.DOCX, *.EML, *.ENC, *.GMG, *.GPG, *.HSE, *.KEY, *.M15, *.M2F, *.M2O, *.M2R, *.MLS, *.OCFS, *.OCU, *.ODS, *.ODT, *.OVPN, *.P7C, *.P7M, *.P7Z, *.PAB, *.PDF, *.PGP, *.PKR, *.PPK, *.PSW, *.PXL, *.RDP, *.RTF, *.SDC, *.SDW, *.SKR, *.SSH, *.SXC, *.SXW, *.VSD, *.WAB, *.WPD, *.WPS, *.WRD, *.XLS, *.XLSX.

    Victims of this malware found in: Algeria, Argentina, Belgium, Bolivia, Brazil, China, Colombia, Costa Rica, Cuba, Egypt, France, Germany, Gibraltar, Guatemala, Iran, Iraq, Libya, Malaysia, Mexico, Morocco, Norway, Pakistan, Poland, South Africa, Spain, Switzerland, Tunisia, Turkey, United Kingdom, United States and Venezuela.
    The malware remains untraceable for about 7 years and was able to infect Mac OS X version, Linux, Windows, iPad/iPhone and android running devices.
    According to the researchers, the Mask Malware was designed to infect the 32- and 64-bit Windows versions, Mac OS X and Linux versions, but researchers believe that possibly there may be more versions for Android and iPhones (Apple iOS) platforms.
    In its main binary a CAB file having shlink32 and shlink64 dll files are found during the research from which the malware extract one of them, depending upon the architecture of the victim’s machine and install it as objframe.dll.
    It includes the most sophisticated backdoor SGH, which is designed to perform a large surveillance function and except this it has DINNER module which gets executed via APC remote calls and reload ‘chef’ module responsible for network connectivity and ‘waiter’ modules responsible for all logical operations.
    Another backdoor called SBD (Shadowinteger’s Backdoor) which uses open source tools like netcat is included in the malware. To infect Linux versions, Mozilla Firefox plugin “af_l_addon.xpi” was used and was hosted on “linkconf[dot]net”
    Spear phishing, a favorite attack used by most cyber attackers like SEA, was used to distribute this malware. Users were lured to click some malicious websites that contain a number of exploits to compromise their systems.
    Latest Computer news and virus and malware threats at Complete computer Repair Services

    www.ccrepairservices.com


  • Bredo Banking Malware Campaign Targets Bank of America Customers

    Last month the researchers at AppRiver has noticed enormous volumes of traffic through their data centers, with the peaks of traffic reaching three or four times than their normal network traffic.

    They caught and blocked a malware campaign that was using the new and novel tactics designed specifically to beat the filtering engines.

    Last Wednesday the company experienced huge spam traffic i.e. 10 to 12 times the normal amount of their normal routine traffic. “These spikes have been driven by a tremendous increase in the number of incoming messages being sent with viruses attached.” and some user experienced delays in sending and receiving mail.

    They found the malware campaign, distributing a Financial Trojan designed to target, the Bank of America customers, known as ‘Bredo virus’, capable of stealing information such as Credit Card Numbers, Banking credentials, user’s keystrokes.

    AppRiver said that ‘The software may also have abilities to further infect a system by downloading more malware on to the machine’ and added that, ‘running through a variety of virus scanners showed that only 11 of 51 antivirus vendors were classifying it as malware.’

    The Bredo botnet was first detected in May 2009 and is capable of propagating through malicious e-mails that includes malware attachments which would infect a computer when opened, effectively turning the computer into another zombie controlled by the botnet.

    In October 2010, the Dutch law enforcement agents seized 143 LeaseWeb servers used as command & the control center of botnet, but were not able to successfully vanish it completely.

    COMPUTER REPAIR and Online Virus Removal 754-234-5598

    www.ccrepairservices.com


  • John McAfee ‘grateful’ Intel is dropping his name from ‘worst software on the planet’

    John McAfee

    John McAfee is glad that Intel is dropping his name from McAfee’s antivirus software. 

    The UpTake: Intel is dropping the McAfee name from the antivirus software brand. It’s infamous founder, John McAfee, couldn’t be happier.

    John McAfee is finally glad to be rid of his embarrassing association with McAfee antivirus software.

    Intel, which acquired McAfee Inc. in 2011, is dropping the McAfee brand in favor of Intel Security. McAfee founded the eponymous global software security firm in 1987, but left the company in 1994. When we last checked in with the gonzo antivirus pioneer, he was being evicted from his luxury Portland apartment and employing biker bodyguards.

    His response to Intel’s rebranding was pure McAfee: “I am now everlastingly grateful to Intel for freeing me from this terrible association with the worst software on the planet,” he told the BBC. “These are not my words, but the words of millions of irate users. My elation at Intel’s decision is beyond words.”

    Intel CEO Brian Krzanich announced the name change at the International Consumer Electronics Show this week. It’s not clear that McAfee’s shenanigans had anything to do with the re-branding.

    McAfee’s disdain for the product bearing his name is well known.

    “Although I’ve had nothing to do with this company for over 15 years, I still get volumes of mail asking how do I uninstall this software,” McAfee said in a salty parody video released in June called “How to Uninstall McAfee Antivirus Software.” Warning: the video, embedded below, contains mature themes and John McAfee.

    Visit or our Repair section and services, or Call 754-234-5598 to repair your computer online for a small fee

    www.ccrepairservices.com


  • Java Bot MalwareLaunching DDos Attacks from infected Machines

    These days botnets are all over the news. In simple terms, a botnet is a group of computers networked together, running a piece of malicious software that allows them to be controlled by a remote attacker.

    A major target for most of the malware is still Windows, but the growing market of Mac OS X, Linux and Smartphones, is also giving a solid reason to cyber criminals to focus.

    Recently, Kaspersky Lab has detected another cross-platform Java-Bot, capable of infecting computers running Windows, Mac OS X, and Linux that has Java Runtime Environment installed.

    Last year, Zoltan Balazs – CTO at MRG Effitas submitted the samples of malicious Java application for analysis to Kaspersky Lab and they identified it as HEUR:Backdoor.Java.Agent.a.

    According to researchers, to compromise computers, Java-Bot is exploiting a previously known critical Java vulnerability CVE-2013-2465 that was patched in last June. The vulnerability persists in Java 7 u21 and earlier versions.
    CVE-2013-2465 description says:

    •  An unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Once the bot has infected a computer, for automatic initialization the malware copies itself into the home directory, and registers itself with system startup programs. The Malware is designed to launch distributed denial-of-service (DDOS) attacks from infected computers.

    It uses the following methods to start it based on the target operating system:

    •     For Windows – HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    •     Mac OS – the standard Mac OS service launch is used
    •     For Linux – /etc/init.d/

    The malware authors used Zelix Klassmaster Obfuscator (encryption) to make the analysis more difficult.  It creates a separate key for the classes developed due to which analysis of all classes has to be done to get the decryption keys.

    The botnet executable contains an encrypted configuration file for the Mac OS ‘launchd service’. It also encrypts internal working methodology of malware.

    The malware uses PricBot an open framework for implementing communication via IRC. Zombie computers, then report to an Internet relay chat (IRC) channel that acts as a Command-and-control server.

    The Botnet supports HTTP, UDP protocols for flooding (DDoS attack) a target whose details i.e. Address, port number, attack duration, number of threads to be used are received from the IRC channel.

    Users should update their Java software to the latest release of Java 7 update 51 of 14 January 2014, can be found on Oracle’s Java website. The next scheduled security update for Java is on 14 April 2014.

    Complete Computer Repair Services Website:www.ccrepairservices.com


  • Oracle to issue huge security patch addressing 36 Java vulnerabilities

    ENTERPRISE VENDOR Oracle will issue its first patch update of 2014 on Tuesday and it just so happens that it’ll be one of its biggest ever that includes a slew of security patches, many of which address vulnerabilities in Java.

    The Critical Patch Update will address 144 flaws in hundreds of Oracle products, 36 of which apply to vulnerabilities in Java SE, including 34 that are bugs that can be exploited remotely by an attacker without requiring authentication.

    “Some of the vulnerabilities addressed in this Critical Patch Update affect multiple products”, Oracle said in its pre-release announcement. “Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update fixes as soon as possible.”

    Five of the security fixes will apply to Oracle Database Server. One of these vulnerabilities might be remotely exploitable without authentication, meaning it could be exploited over a network without the need for a username and password.

    The patch update will be released on 14 January for Oracle products and components including JavaFX, versions 2.2.45 and earlier, Java JDK and JRE, versions 5.0u55, 6u65, 7u45 and earlier, and Java SE Embedded, versions 7u45 and earlier.

    The highest CVSS 2.0 Base Score for vulnerabilities in Oracle’s Critical Patch Update is 10.0 for Java SE, Java SE Embedded, and JRockit of Oracle Java SE, MySQL Enterprise Monitor of Oracle MySQL, Oracle FLEXCUBE Private Banking of Oracle Financial Services Software and Oracle WebCenter Sites of Oracle Fusion Middleware.

    Security firm Qualys’ CTO Wolfgang Kandek warned that plug-ins like Java are one of the main threat vectors as more companies are being infected through web based attacks.

    “One needs to pay attention to the browser plug-ins, and in that class, the most important is Oracle’s Java,” Kandek said. “Java just suffered a widely published attack during the Yahoo Ad-based attacks from [December to January 2014], where the Magnitude exploit kit was used to deliver malware to users that were running an outdated version of Java.”

    He added that Oracle’s critical patch update will “further tighten its security parameters”.

    ONLINE COMPUTER REPAIR SERVICES AND NEWS AT

    www.ccrepairservices.com