Cobra Prey

iPhone Security Bug Lets Innocent-Looking Apps Go Bad

cobra — Tue, 08 Nov 2011 18:15:14 +0000

Apple’s iPhones and iPads have remained malware-free thanks mostly to the company’s puritanical attitude toward its App Store: Nothing even vaguely sinful gets in, and nothing from outside the App Store gets downloaded to an iOS gadget. Now serial Mac hacker Charlie Miller has found a way to sneak a fully-evil app onto your phone or tablet, right under Apple’s nose.

Click here to the full article on this subject and watch the video clip shown in the article demonstrating the technique.

Warning!! Another critical online banking trojan for Android

cobra — Tue, 20 Sep 2011 15:06:17 +0000

First, Android mobiles were found to be infected with the ZeuS trojan, and now there are reports that SpyEye has also made the jump to this smartphone platform. Online crime prevention vendor Trusteer says that the malware masquerades as a security app and can intercept incoming SMS text messages. This apparently allows it to bypass the mobile TAN system.

ZeuS uses a similar approach when infecting smartphones; previous variants of ZeuS and SpyEye were able to infect systems running Symbian or Windows Mobile. However, there is still no need for users to panic – the malicious programs don’t exploit a vulnerability in the device, they target the person holding the phone, the phone user, who must manually download and install the app. Reasonably careful users are unlikely to fall for the trick.

Please click here to read about SyeEye’s threat to Android.

Android trojan records phone calls

cobra — Sat, 06 Aug 2011 08:21:45 +0000

Security experts have discovered a new piece of malware for Google’s Android mobile operating system which secretly records phone conversations. If a user installs the application, which, in a crude attempt at camouflage, calls itself “Android System Message”, it saves recordings of all outgoing phone conversations in a subdirectory on the SD card.

Although the application does inform the user that it requires privileges which include audio recording, with so many applications requesting privileges which they clearly don’t need, most Android users are unlikely to notice this.

Please click here to find out how this Trojan works in detail.

Storing passwords in uncrackable form

cobra — Sat, 23 Jul 2011 12:09:02 +0000

News about intrusions into the servers of online stores, games vendors and other internet services can now be read on an almost daily basis. Often, the intruders obtain customers’ login data including their passwords. As many people use the same password in multiple places, criminals can use the passwords to obtain unauthorised access to further services.

To prevent passwords from being extracted, web site operators usually protect their users’ passwords through such cryptographic techniques as one-way hashing. For this purpose, a character string that doesn’t allow any conclusions to be drawn about the actual password is derived from the password. The only way of finding out whether a password matches a hash is to rehash the password and compare the results. This method is used by the authentication systems of operating systems and web applications – and also by password crackers.

MD5 hashing was long considered sufficiently resilient for this purpose, because the time that is required to try out all possible combinations made it difficult for attackers to reconstruct a password from a hash. With a strong password, trying out all password combinations (brute force attack) using a cracker such as John the Ripper on conventional hardware used to take months, if not years. But times have changed.

Cloud, CUDA and multi-core computer technologies are both a blessing and a curse: they can greatly accelerate the processing of data and make even complex simulations available to end users. Unfortunately, crackers use the same high-speed computing power to reconstruct plain-text data from an encrypted password, and then they use the password to log into a system as administrators. In this context, password crackers can take advantage of the fact that the harvested hashes were probably created using the MD5 algorithm, which is optimised for fast processing.

Commercial password crackers such as those by vendor Elcomsoft, and such free tools as Hashcat and BarsWF, can try out several million hashes per second to find out whether one of them matches a specific password. This means that a password of eight characters can be cracked in four days. However, there are even faster ways. As hard disk storage is getting cheaper and cheaper, attackers often use giant tables (rainbow tables) containing billions of pre-calculated hashes to find a password. These tables potentially allow them to determine a password within minutes. The lists required for dictionary attacks are also becoming longer and longer and, with very weak passwords, often enable cracking programs to succeed within hours.

Click here to read the complete article on this critical subject, it is a MUST read for all the individuals out there who are seeking password protection.

Google: Hundreds of Gmail accounts in U.S., Asia hacked

cobra — Thu, 02 Jun 2011 16:19:36 +0000

Hackers around the world are gaining more attention than usual in the last few months. Now Google has added another announcement to the pile that hundreds of Gmail accounts have been hacked recently.

Now, Google affirms that the problem doesn’t rest with Gmail security but rather this scheme was a result of phishing and malware.

Click Here to read the full article on this problem.

Six new and rising hacker threats

cobra — Tue, 24 May 2011 06:23:05 +0000

Hackers never sleep, it seems. Just when you think you’ve battened down the hatches and fully protected yourself or your business from electronic security risks, along comes a new exploit to keep you up at night. It might be an SMS text message with a malevolent payload or a stalker who dogs your every step online. Or maybe it’s an emerging technology like in-car Wi-Fi that suddenly creates a whole new attack vector.

Whether you’re an IT manager protecting employees and corporate systems or you’re simply trying to keep your own personal data safe, these threats, some rapidly growing and others still emerging, pose a potential risk.

Fortunately, there are some security procedures and tools available to help you win the fight against the bad guys.

Please click here to read the complete article at Techworld.com

SMS Trojan found in several Google Android Applications

cobra — Fri, 13 May 2011 07:43:37 +0000

Google has removed a group of mobile phone applications from its Android Market after it was discovered that the applications contained code that could be used to send SMS (Short Message Service) spam.

Google’s action came after a security firm in Taiwan published a security alert about the apps on Wednesday, saying that there were a total of 11 apps found to have the suspicious code in them. The advisory warns users that the apps send messages to three numbers that can cause users to be subscribed to paid services without their knowledge.The SMS functionality would only work when the user is located in China, according to the advisory.

Click here to read the full article

Google location tracking can invade privacy, hackers say

cobra — Sat, 23 Apr 2011 15:20:39 +0000

If you’ve got a Wi-Fi network, chances are Google has used its top-selling Android mobile operating system to store your router’s precise location and broadcast it for all the world to see.

Google has been compiling the publicly accessible database of router locations in its quest to build a service, a la Skyhook, that pinpoints the exact location of internet users who use its sites. Now, hobbyist hacker Samy Kamkar has developed a site that demonstrates just how comprehensive Google’s catalog is.

Plug the MAC address of your router into Kamkar’s website, and chances are it will pull up its precise location, courtesy of Google Maps.

In October, Google pledged to stop using its world-roving Street View vehicles to collect Wi-Fi data and said it instead would rely on Android handsets to get the information. When phones running the Google OS detect any wireless network, they beam its MAC address, signal strength and GPS coordinates to Google servers, along with the unique ID of the handset.

Google has long given assurances that it will use the geolocation database only when users give their explicit consent, such as when they want to be spared the hassle of typing in their current address when getting driving directions. But Kamkar has demonstrated at least two hacks that allow operators of unscrupulous websites to pilfer the information from Google’s database anyway, allowing them to know the precise whereabouts of vulnerable visitors.

Click here to read the full article on this matter.

Hacker Pleads Guilty To Theft of 600K Credit Cards, Could Get 10 Years

cobra — Sat, 23 Apr 2011 14:21:03 +0000

Credit cardsA 26 year-old Georgia man pleaded guilty in federal court in Virginia to the theft of hundreds of thousands of credit cards and a years-long fraud scheme that netted him more than $100,000 in illicit profits – money he used to buy himself a BMW and luxury clothing.

Rogelio Hackett of Lithonia, Georgia, admitted to stealing 676,443 credit card accounts and selling that information online. Credit card companies say that stolen accounts were linked to tens of thousands of fraudulent charges that total close to $37 million. Hackett could face ten years in prison and fines of $500,000 when he is sentenced and be asked to make restitution to credit card companies for the tens of millions of dollars in losses, according to a signed statement from the U.S. Attorney.

According to a statement of facts, signed by Hackett, his crime spree began in the late 1990s. A talented hacker, Hackett searched out vulnerable SQL databases online and exploited security vulnerabilities in them to gain access to credit card data.

Click here to read the full article.

IPv6 intro creates spam-filtering nightmare

cobra — Tue, 12 Apr 2011 07:05:00 +0000

The migration towards IPv6, which has been made necessary by the expansion of the internet, will make it harder to filter spam messages, service providers warn.

The current internet protocol, IPv4, has a limited address space which is reaching exhaustion* thanks to the fast uptake of internet technology in populous countries such as India and China and the more widespread use of smartphones. IPv6 promises 3.4 x 1038 addresses compared to the paltry 4.3 billion (4.3 x 109) addresses offered by IPv4.

While this expansion allows far more devices to have a unique internet address, it creates a host of problems for security service providers, who have long used databases of known bad IP addresses to maintain blacklists of junk mail cesspools. Spam-filtering technology typically uses these blacklists as one (key component) in a multi-stage junk mail filtering process that also involves examining message contents.

Please click here to continue reading this full article.