New Mac Trojan Exploiting Same [Patched] Java Vulnerability as Flashback

This is a perfect example as to why it’s important that you keep your system patched and up-to-date regardless of what operating system you use.

Symantec has warned that a new Trojan horse, OSX.Sabpab is hoping to follow the digital footsteps of the Flashback malware by exploiting one of the (patched) Java vulnerabilities (CVE-2012-0507) Flashback used to infect over 600,000 Mac computers.

According to Symantec’s security bulletin, once Sabpab Trojan makes its way onto your system, it will create system files to ensure it loads on system start-up and open a backdoor to grant an attacker remote control over the machine to create new processes, download arbitrary files, take desktop screenshots and upload files to a remote server.

To avoid being hit by this latest threat, Mac users should make sure they’ve installed all of the necessary Apple updates to close the targeted Java security hole.

Considering Java vulnerabilities are often exploited to plant malware on vulnerable machines, users should consider toggling Java browser plug-ins as necessary to protect against drive-by-download attacks or disabling/uninstalling Java completely if it’s not needed to eliminate the threat altogether.

Additionally, it may be beneficial for Mac users to install antivirus software to add an extra layer of protection against malware threats. Sophos offers Mac antivirus for free, so why not give it a shot? Other companies like Intego, ESET and Kaspersky also offer Mac antivirus software, so if you prefer a specific vendor, I recommend checking them out.

Stay safe, Mac users!

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Unpatched pcAnywhere on 200,000 Windows PCs = Disaster Waiting to Happen

One would think with all of the headlines flying around about how hackers stole the source code for a variety of Symantec products and Symantec going from saying users only faced a “slightly increased security risk” to urging them to disable pcAnywhere before finally saying the software is safe only after being patched that users would heed the warnings and do as they’re advised.

After all, it’s not every day that a security company discovers they were breached years ago without their knowledge and tells you to flat-out stop using their product.

Unfortunately, it seems as though quite a few folks missed the memo and a lot of PCs have been left vulnerable as a result.

Security researchers over at Rapid7 scanned the internet for the TCP port that pcAnywhere leaves open for incoming commands and found that up to 200,000 computers are running unpatched versions of pcAnywhere software.

Note to those who are running unpatched versions of Symantec’s pcAnywhere: if a security researcher can find you, then so can an attacker.

To make matters worse, an estimated 2.5% (roughly 3,450 – 5,000) of those vulnerable Windows PCs are running a point-of-sale system, leaving the door wide open for an attacker to hit the ultimate payday.

Was nothing learned from the Subway point-of-sale system breach that resulted in over $3million dollars in fraudulent charges?

It’s imperative that pcAnywhere users to either make sure their software is current or find an alternative remote desktop solution such as LogMeIn, GoToMyPC, or WebEX PCNow – just to name a few.

What do you think of all the issues surrounding Symantec and pcAnywhere? Share your thoughts below!

[via ComputerWorld]

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Extortion or Bribery? Story Behind Symantec Source Code Leak Gets a Little Weirder

Just when you thought the story behind the stolen Symantec source code hit the ultimate level of crazy, the bar gets raised a little higher.

On Monday, an email thread posted on Pastebin revealed that a hacker named Yamatough attempted to extort $50,000 from Symantec to prevent the release of stolen source code; however, the following day, Anonymous took to Twitter to say that the hacker(s) didn’t try to extort Symantec, but Symantec tried to bribe the hackers!

https://twitter.com/#!/YourAnonNews/status/166898121341804544

As if that statement isn’t mind boggling enough, a tweet by AnonymousIRC seems to backtrack on the idea of bribery and favor the extortion attempt by saying that Symantec got trolled and that the code was always destined for a public release:

https://twitter.com/#!/AnonymousIRC/status/166957537676099585

So, which is it?

Did Yamatough offer to settle the score without releasing the stolen source code for a cool $50k or was it Symantec that originally stepped up and dangled the green in front of the hacker in hopes of shutting them up?

Whatever the case may be, the source code for pcAnywhere has been released and the hackers are still sitting on the source code for other Symantec products.

Users who depend on Symantec’s antivirus and security products for protection should seriously consider switching vendors to avoid being hit by a 0-day exploit thanks to the release of Symantec source code.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Anonymous Posts pcAnywhere Source Code on Pirate Bay After Failed Extortion Attempt

It looks like the hackers that lifted source code from Symantec’s servers back in 2006 have kept their promise to release the stolen source code to the public.

According to an email exchange posted on Pastebin on Monday, a hacker going by the handle “Yamatough” had been communicating with a purported Symantec employee by the name of Sam Thomas in hopes of getting a $50,000 payday as long as he agreed not to release the stolen pcAnywhere and Norton Antivirus source code.

Unfortunately, negotiations that started back in mid-January eventually broke down and Yamatough fired off his final threat to release the source code if Symantec didn’t agree to hand over 50 grand within 10 minutes:

Since no code yet being released and our email communication wasn’t also released we give you 10 minutes to decide which way you go after that two of your codes fly to the moon PCAnywhere and Norton Antivirus totaling 2350MB in size (rar) 10 minutes if no reply from you we consider it a START this time we've made mirrors so it will be hard for you to get rid of it

Thomas replied, saying they couldn’t make a decision in 10 minutes and more time was needed.

Shortly thereafter, Yamatough took to Twitter to apologize to his followers for his silence, filled them in on the offer from Symantec and said the stolen source code was up for sale.

The AnonymousIRC channel helped get the word out by tweeting that the stolen Symantec source code would be published soon:

https://twitter.com/#!/AnonymousIRC/status/166676746689716226

Hours later, a 1.27GB RAR file named "Symantec's pcAnywhere Leaked Source Code" appeared on PirateBay and @AnonymousIRC  posted a tweet advertising the link:

https://twitter.com/#!/anonymousirc/status/166744502315388930

What's Symantec's Response?

Symantec has confirmed the extortion attempt and released the following statement:

In January an individual claiming to be part of the 'Anonymous' group attempted to extort a payment from Symantec in exchange for not publicly posting stolen Symantec source code they claimed to have in their possession. Symantec conducted an internal investigation into this incident and also contacted law enforcement given the attempted extortion and apparent theft of intellectual property. The communications with the person(s) attempting to extort the payment from Symantec were part of the law enforcement investigation. Given that the investigation is still ongoing, we are not going to disclose the law enforcement agencies involved and have no additional information to provide.

Update 2:22 PM: Symantec has also confirmed that the pcAnywhere source code posted on Pirate Bay is legitimate:

We can confirm that the source code is legitimate. It is part of the original cache of code for 2006 versions of the products that Anonymous has claimed to have been in possession during the last few weeks.

Photo Credit: zodman

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Symantec OKs using pcAnywhere again, hands out free upgrades

“Good news, everyone!”

Symantec says that it’s now safe to use pcAnywhere and is offering all pcAnywhere customers a free upgrade to the most recent version, 12.5.

It was only five days ago that Symantec was urging users to disable pcAnywhere or use it only for “business-critical purposes” following the discovery that hackers had stolen the source code for several Symantec products, including pcAnywhere, during a server breach back in 2006.

Today, Brian Modena, a spokesperson for Symantec, told Reuters that the company had determined that it’s safe for users to use the current version of pcAnywhere 12.5, as long as it’s been updated with a security patch that was released on January 23^rd.

Modena added that versions 12.0 and 12.1 were also safe to use if a second update that was released on January 27^th is downloaded and installed.

Users should verify that they're running one of the versions that have received the green-light from Symantec and double-check that the proper updates are installed.

If you have any questions, feel free to contact Symantec by sending an email to pcanywhere@symantec.com.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Symantec recommends disabling pcAnywhere, releases hotfix to address 2 vulnerabilities

When is the last time you recall a vendor telling users to stop using one of their products?

Symantec has begun advising users to disable their remote access software, pcAnywhere unless it’s absolutely needed.

Why? It all stems back to the fact that hackers stole a portion of Symantec’s source code from their servers back in 2006. Since then, Symantec has cautioned that pcAnywhere users faced a “slightly increased security risk” due to the breach.

It seems now that “slightly” is no longer the right word to describe it.

On Wednesday, Symantec released a white paper [PDF] that outlined the security risks associated with pcAnywhere, along with security recommendations and best practices.

Alongside such helpful information Symantec wrote:

“At this time, Symantec recommends disabling the product until Symantec releases a final set of software updates that resolve currently known vulnerability risks. For customers that require pcAnywhere for business critical purposes, it is recommended that customers understand the current risks, ensure pcAnywhere 12.5 is installed, apply all relevant patches as they are released, and follow the general security best practices discussed herein.”

If you need them, here are instructions on how to disable pcAnywhere.

Can’t go without pcAnywhere? Patch it & stick to the security guidelines

If you absolutely must use pcAnywhere, it’s strongly recommended that you use the most recent (and supported) version of pcAnywhere, apply any patches or updates and follow Symantec’s guide for best security practices.

Just yesterday, Symantec has issued a security advisory and corresponding hotfix in order to address critical vulnerabilities.

The two security risks listed in the security advisory are remote code execution and local access file tampering; the latter would allow an attacker to elevate their file privilege.

“The remote code execution is the result of not properly validating/filtering external data input during login and authentication with Symantec pcAnywhere host services on 5631/TCP.” the advisory explains, “Successful exploitation would require either gaining unauthorized network access or enticing an authorized network user to run malicious code against a targeted system.  Results could be a crash of the application or possibly successful arbitrary code execution in the context of the application on the targeted system.”

As far as the file tampering security risk goes, some files installed by pcAnywhere are writable by everyone and susceptible to file tampering, which leaves the door open for an attacker to overwrite the files to gain elevated privileges. However, it should be noted that the attacker would already need access to a vulnerable system to accomplish this.

Although there hasn’t been any evidence that these vulnerabilities are being exploited in-the-wild, Symantec is not taking any chances and urges pcAnywhere users to install a hotfix in order to patch the holes. The patch can be applied either manually or automatically via LiveUpdate.

The affected products are Symantec pcAnywhere 12.5.x, IT Management Suite 7.0 pcAnywhere Solution 12.5x, and IT Management Suite 7.1 pcAnywhere Solution 12.6.x.

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

So, Hackers Lifted Source Code from Symantec Servers After all

On Tuesday, Symantec spokesman Cris Paden told Reuters that a group of unknown hackers broke into Symantec’s networks in 2006 and stole the source code for four products – Norton Antivirus Corporate Edition, Norton Internet Security, Norton Utilities, Norton Goback and pcAnywhere.

It was only eleven days ago that Symantec confirmed that a band of hackers – who identify themselves as the ‘Lords of Dharmaraja’ – had obtained the source code for their products from Indian military servers, who had left the copy there by mistake. At that time, Symantec had stated that their network had not been compromised when the source code was stolen, but apparently that is not the case.

Paden also stated that they’re working to reach out to pcAnywhere users, who now face a “slightly increased security risk” due to the leak, and “provide remediation steps to maintain the protection of their devices and information.”

When hackers released fragments of source code lifted from the Indian military servers, Symantec confirmed that it was for two older enterprise products, Symantec Endpoint Protection 11.0 and Symantec Norton Antivirus 10.2, the latter being discontinued. Symantec stated that the release of the source code would not impact Norton’s products for consumers given the age of the products.

On Saturday, a hacker called Yama Tough announced to the world via Twitter that he was planning on releasing the full 1.7GB source code for Norton Antivirus:

However, on Monday the hacker switched gears, stating he wanted to have the first go at zero-day exploits to unleash mayhem on unsuspecting users:

The hacker had previously tweeted links to a list of the source code files, but those related pages have since been removed.

Symantec has stepped up to the podium to release the following statement, once again stressing that the source code leaks do not impact their current products:

The code for Norton Utilities that was posted publicly is related to the 2006 version of Norton Utilities only. That version of the product is no longer sold or supported. The current version of Norton Utilities has been completely rebuilt and shares no common code with Norton Utilities 2006. The code that has been posted for the 2006 version poses no security threat to users of the current version of Norton Utilities.

Furthermore, we have no indications that the code disclosure impacts the functionality or security of any of Symantec's other solutions. Lastly, there are no indications that customer information has been impacted or exposed at this time. As always, in general, Symantec recommends that users keep their solutions updated which will help ensure protection against any new possible threats.

Do you still feel comfortable using Symantec products to protect your PC? Share your thoughts below!

Don’t miss out on the latest tech news and computer security alerts! Follow us on Twitter at @hyphenet,  “Like” us on Facebook or add us to your circle on Google+.

Symantec Confirms Reports of Stolen & Leaked Norton Antivirus Source Code

On Thursday, Symantec confirmed that a group of hackers got their grubby little paws on a “segment” of the Norton antivirus source code.

Oddly enough, the source code wasn’t stolen directly from Symantec, but from servers that allegedly belong to Indian military intelligence agencies.

The reason for the Indian government having a copy of the source code still remains unclear, although the director of security strategy at Imperva, Rob Rachwald, says some governments require vendors to supply them with the source code in order to verify their software isn’t spyware in disguise.

Symantec is currently investigating the breach and corresponding theft, but they have stated that it “does not affect Symantec's Norton products for our consumer customers.”

The affected enterprise products have been identified as Symantec Endpoint Protection 11.0 and Symantec Norton Antivirus 10.2 (2006 edition). Symantec Antivirus 10.2 has been discontinued and Symantec Endpoint Protection 11.0 is 4-5 years old. The version of Symantec Endpoint Protection currently advertised on Symantec’s website is 12.1.

Although it may be a little unnerving for end-users to hear that the source code for the products that are supposed to protect their PCs from malicious programs and related intrusions is out in the open, Symantec stands by the belief that the functionality and security of their products remain uncompromised due to the rapid rate that their software has evolved over the years.

If it the source code was for a more recent version of the software and was released in full, then hackers could potentially discover critical vulnerabilities to exploit and competitors could benefit from taking a gander inside.

Follow us on Twitter at @hyphenet or “Like” us on Facebook or add us to your circle on Google+ to stay up-to-date on the latest tech news and PC security alerts.

Fake NetFlix Android App Hopes to Steal Your NetFlix Login

If you’re an Android smartphone user that’s looking into downloading the Netflix app that will allow you to watch movies on your phone, make sure you download the legitimate Netflix application!

Irfan Asrar posted on the Official Symantec Blog, warning Android users about an information stealing Trojan - Android.Fakeneflic – often found lurking in fraudulent NetFlix applications whose main purpose is to steal your NetFlix login credentials.

The imitation NetFlix app closely resembles the real one, sporting a bright red background with the company logo on load.

However, once you try to login to your NetFlix account by entering your email and password, you’re presented with a message saying that the app is incompatible with your phone’s hardware and that you should download a different version.

In reality, compatibility is not the issue. The crooks behind this app have already got what they wanted – your NetFlix login details!

While you were being told that your phone didn’t meet the requirements to stream NetFlix content, the username and password you entered had been uploaded and stored on the bad guy’s server.

Is there any way to tell the real NetFlix app from the fake one?

Based on the images provided in Symantec's report, there appear to be a few discrepancies between the login pages of the REAL NetFlix app and the fake one(s). Namely the REAL NetFlix app has:

• The text, “Not a member? Visit Netflix.com to sign up.” Below the email and password login fields.


• A “Forgot your password?” option. (It makes sense the fake app can’t send you your password if it has no real ties to NetFlix!)

So if you download a NetFlix app, make sure it has the above options.

Also, make sure the author of the app is NetFlix, Inc., not some random third party.

What should you do if you think you downloaded the fake NetFlix app?

Change your NetFlix password IMMEDIATELY.

Thankfully the Trojan seems to lose interest once it’s stolen your NetFlix login, so you can continue about your merry way to download the legitimate NetFlix app without issue.

Of course, be sure to remove the fake app before doing so.

To read the report from Symantec, visit their Official Blog.

Be sure to follow us on Twitter at @hyphenet or “Like” us on Facebook to stay up-to-date on the latest security threats.