Google is too slow at clearing crap from the Chrome extension store
Malware is something computer users -- and even mobile and tablet owners -- are now more aware of than ever. That said, many people do not give a second thought to installing a browser extension to add new features to their most frequently used application. Despite the increased awareness, malware is not something a lot of web users think of in relation to extensions; but they should.
Since the beginning of 2015 -- just over three months -- Google has already received over 100,000 complaints from Chrome users about "ad injectors" hidden in extensions. Security researchers have also discovered that a popular extension -- Webpage Screenshot -- includes code that could be used to send browsing history back to a remote server. Google is taking steps to clean up the extension store to try to prevent things like this from happening, but security still needs to be tightened up.
New endpoint protection offers instant detection and response to unknown threats
Traditional endpoint protection is usually reliant on the use of signature-based detection systems. But of course these don't spot zero day attacks that can slip in before the antivirus software catches up.
Security solutions provider Endgame is using its extensive experience providing security intelligence and analytics solutions to the US government to offer an enterprise solution focusing on protecting critical infrastructure, enabling customers to detect and respond faster to unknown threats, and preventing damage and loss.
Android malware drops, but there are still nearly 10 million affected devices
Google says that it is keen for Android to be a secure platform for developers and end users alike. It's not a unique claim; Apple would likely say much the same about iOS, and Microsoft about Windows Phone/Windows 10 for Phones.
To demonstrate how fervently it has been working away at improving security and introducing new security-focused features, Google today published a report looking back on Android security in 2014. Dubbed the Android Security State of the Union 2014, it makes for interesting reading. It includes the revelation that nearly 10 million Android devices have potentially harmful apps installed.
Fake Puush update steals passwords from Windows users
Screenshot-sharing app Puush has inadvertently infected Windows users with malware. Over the weekend, the Puush server was breached and a fake, malware-infected program update was put in place. This means that anyone updating to version r94 of the software is infected.
The malware tries to grab passwords from infected systems, and was noticed after users complained on Twitter that the latest update had been flagged up by BitDefender. As a precautionary measure, the update server has been taken offline, and a clean update has been made available as a standalone download.
Amazon patches huge XSS vulnerability that left user data exposed for two days
A serious XSS vulnerability left Amazon customers in "real danger" of having their accounts compromised. The man who made the discovery is Brute Logic, the current top security researcher at XSSposed.org and "light-gray computer hacker". We spoke to him about the security issue as well as talking about the responsibilities involved in exposing vulnerabilities.
The cross-site scripting vulnerability was discovered on March 21 and was left unpatched for two days. In this time, Brute Logic says there was a real risk that people "could have their Amazon account compromised or had their computer invaded by means of a browser exploit". He says it is the responsibility of sites to fix problems when they are highlighted by the hacking community.
Multi-purpose backdoor Trojan threatens Windows systems
New variants of malware come and go with depressing regularity, but some have capabilities that offer more cause for concern than others.
The latest piece of scary software comes from researchers at security company Doctor Web who have uncovered a new Trojan dubbed BackDoor.Yebot that's capable of carrying out a wide range of destructive actions on an infected machine.
New malware makes credit card transactions a scary PoSeidon adventure
As more and more transactions are carried out electronically, point of sale systems become an ever more tempting target for cyber criminals. Security researchers at networking company Cisco have identified a new strain of PoS malware that seeks to extract credit card data from memory and send it to remote servers.
Named PoSeidon it has a more sophisticated design than other PoS malware and has some resemblance to ZeuS. It's written to evade detection, can communicate directly with C&C servers, self-update to execute new code and has self-protection mechanisms to guard against reverse engineering.
Give me all your money -- yet more ransomware found in the wild
The online community has been living under the threat of ransomware for sometime now -- it feels like dwelling near Mordor. While many of you reading this are likely too savvy to fall for these tricks, there are people who do, which is why scammers stay in business. Now a new threat arises to go after people's hard earned money.
Security firm Doctor Web reports that a mass of spam emails have recently been detected. This latest threat comes in the guise of "Incoming fax report". The so-called report contains a ZIP file which disguises an SCR, or Windows executable file. It's been tagged as Trojan.DownLoader11.32458.
LightEater malware attack places millions of unpatched BIOSes at risk
Two minutes is all it takes to completely destroy a computer. In a presentation entitled "How many million BIOSes would you like to infect?" at security conference CanSecWest, security researchers Corey Kallenberg and Xeno Kovah revealed that even an unskilled person could use an implant called LightEater to infect a vulnerable system in mere moments.
The attack could be used to render a computer unusable, but it could also be used to steal passwords and intercept encrypted data. The problem affects motherboards from companies including Gigabyte, Acer, MSI, HP and Asus. It is exacerbated by manufactures reusing codes across multiple UEFI BIOSes and places home users, businesses and governments at risk.
Giving pirates free Windows 10 is a goddamn good idea
Meet the new Microsoft. Maybe the company really charts a new course under CEO Satya Nadella's leadership. Colleague Mark Wilson reports that even software pirates can upgrade free to Windows 10. Seriously? Reward the thieves who rob revenue from the platform's cradle? Hand robbers sacred possessions at the door? Give them the house keys and ask them to lock up after they take the tellie, silver, and jewelry?
Outstanding! I really am not being sarcastic, just pretending to be. The strategy is simply brilliant and too long coming, assuming nothing changes before Windows 10's summer release or Microsoft clarifies licensing rules to mean something different. Without even stressing a single synapse I can conjure up more good reasons for the upgrade plan than the fingers on my hands. But I'll keep the list a bit shorter for this post.
CryptoLocker-like ransomware, Teslacrypt, targets gamers
Ransomware is one of the latest tactics used by cybercriminals to extract money from victims. CryptoLocker hit the headlines last year, encrypting the files on infected machines until a ransom was paid. Now the same idea has spread to the world of gaming thanks to Teslacrypt.
Teslacrypt works in much the same way as CryptoLocker, but its raison d'etre is seek out game saves and download content for dozens of popular titles and hold them to ransom. Until victims cough up $500 in Bitcoins, or make a $1,000 PayPal payment, there is no way to access the games.
Reports that uTorrent silently installs Bitcoin crapware are... crap
Sometimes it's easy to be swayed by what's being written online. At the moment there are lots of stories creeping out about the iPad Pro and Apple Watch, none of which are founded in any fact whatsoever. Still, making stuff up, popping it in quotes and attributing it to an anonymous source is great fun, right?
It may be fun, but it's not really fair on the reader. Another story which popped up on my radar today was about uTorrent -- the popular BitTorrent client that's loved and hated in equal measure. Stories on Trusted Reviews, Engadget and the Verge suggest a Bitcoin mining tool called Epic Scale is installed without permission, and is a tricky blighter to remove. There's an easy way to find out; let's just install it.
Oracle: How about some adware to go with that new Java for Mac?
One of the things I -- and I assume a lot of fellow users -- like about using a Mac is that most OS X programs do not try to trick the user into installing adware. In fact, a lot of the programs I use do not even feature a typical setup, as they can be installed simply by copying them to the Applications folder. For someone coming from Windows, it may feel impossible to grasp at first -- yes, you can actually enjoy the install process. Wow!
Of course, there are developers who do not care about the experience their users have during and after the setup, so they bundle adware with their programs. Thankfully, on Macs it's easier to spot, but it's still something to look out for at times, especially if you wish to install Oracle's latest Java release.
Malware detection in 2014 doubles from 2013 -- 2015 could be even worse
A report from PandaLabs suggests that there were twice as many malware infections in 2014 compared to 2013 -- and China was the hardest hit. Globally, Europe was found to be the area with the lowest rate of infection, and Sweden topped the chart as the safest country. The UK found itself in fourth place with an infection rate of 22.14 percent.
There were certainly plenty of big name security issues throughout 2014. CryptoLocker was just one high-profile example of ransomware, and Trojans continue to be the most common form of infection, accounting for 70 percent of new malware. Viruses tend to be the most commonly known and feared form of infection, but these make up just 12.33 percent of new infections, and a mere 2.7 percent overall.
Yet more aggressive Android adware found on Google Play
Google Play is supposed to be the safe place to download Android apps from, but that’s increasingly not the case. Three weeks ago security firm Avast detailed how it had found three popular Android apps riddled with Adware in Google’s store.
Today Bitdefender reports that it has found ten Google Play apps that are packed with aggressive adware that can do all sorts of nasty things.
Recent Headlines
BetaNews, your source for breaking tech news, reviews, and in-depth reporting since 1998.
© 1998-2025 BetaNews, Inc. All Rights Reserved. About Us - Privacy Policy - Cookie Policy - Sitemap.