Banking Malware Distributed via YouTube Ads.

Malvertising attacks are becoming more and more common and it appears that not even YouTube users are safe.
Security researchers from Bromium Labs recently found that YouTube advertising network has been used by cyber criminals to distribute malware. According to experts, cyber criminals compromised an ad network and were redirecting users to malicious websites, hosting the 'Styx Exploit Kit' and infect users computer with Caphaw Banking Trojan..
This particular exploit kit is designed to exploit java vulnerability (CVE-2013-2460) in outdated versions, once in the targets computer system the malware detects the Java version installed on the operating system and based upon it loads suitable exploit compatible with the installed java version.
The command and control server (C&C) used by the cyber criminals appears to be hosted in Europe and it relies on a domain generation algorithm (DGA). Researcher has notified Google of the attack, but so far, they still do not know how the cyber criminals have pulled it off to evade Google’s internal advertisement security checks.And how many users had become victim of this attack is yet a question.
Google has confirmed that a rogue advertiser was behind this malvertisment and also said it has taken this campaign off and is beefing up internal procedures to prevent such events from occurring again.

'The Mask', A Sophisticated cyber spying operation that has been under the mask for about 7 years.

Kaspersky Lab’s security research team have uncovered "The Mask" (aka Careto) a highly sophisticated cyber spying operation that has been alive since at least 2007 infecting more than 380 high-profile targets in 31 countries after investigating and monitoring data found on a set of command-and-control (C&C) servers used by the attackers. The main targets of the operation are government institutions; embassies and other diplomatic missions; energy, oil and gas companies; research institutions; private equity firms and activists.

Researchers dubbed the whole operation “The Mask,” the English translation for the Spanish word Careto, which is what the attackers called their main backdoor program. Based on other text strings found in the malware, the researchers believe its authors are probably proficient in Spanish.
Kaspersky's researchers believe this could be a nation-state sponsored operation as the level of operational security is not normal for cyber-criminal groups and might be new players on the global nation-state cyber-espionage stage.
When active in a victim system, The Mask can intercept network traffic, keystrokes, Skype conversations, PGP keys, analyze WiFi traffic, screen captures and monitor all file operations, collecting a large list of documents from the infected system, including encryption keys, VPN configurations, SSH keys and RDP (remote desktop protocol) files.They also found several extensions which have not been able to identify and could be related to custom military/government-level encryption tools.

 Infections have been observed in: Algeria, Argentina, Belgium, Bolivia, Brazil, China, Colombia, Costa Rica, Cuba, Egypt, France, Germany, Gibraltar, Guatemala, Iran, Iraq, Libya, Malaysia, Mexico, Morocco, Norway, Pakistan, Poland, South Africa, Spain, Switzerland, Tunisia, Turkey, United Kingdom, United States and Venezuela.

Victims were targeted using spear-phishing emails with links leading to websites that hosted exploits for Java and Adobe Flash Player, as well as malicious extensions for Mozilla Firefox and Google Chrome.These malicious links seemed to point to news websites, most of them Spanish dailies like El Mundo and El Pais. But they also included fake links to The Guardian, The Washington Post and Time.

The Mask Malware was designed to infect the 32- and 64-bit Windows versions, Mac OS X and Linux versions, but researchers believe that possibly there may be more versions for Android and iPhones (Apple iOS) platforms.

Researchers said,"This is not very common in APT [Advanced Persistent Threat] operations, putting the Mask into the ‘elite’ APT[Advanced Persistent Threat] groups section"because they observed a very high degree of professionalism in the operational procedures of the group behind this attack, including monitoring of their infrastructure, shutdown of the operation, avoiding curious eyes through access rules, using wiping instead of deletion for log files, etc.

This is why they call it Careto, or "The Mask."

It includes the most sophisticated backdoor SGH, which is designed to perform a large surveillance function and another backdoor called SBD (Shadowinteger's Backdoor) which uses open source tools like netcat is included in the malware. 

The careto module used two layers of encryption both RSA and AES for its communication with the attackers’ command-and-control servers, preventing anyone who got physical access to the servers from reading the communication.

Kaspersky discovered the operation last year when the attackers attempted to exploit a five-year-old vulnerability in a previous generation of Kaspersky’s security software that had long-ago been patched and on investigation of this malware, CC servers were found down, which shows that attacker group was monitoring all aspects related to the malware activity. Since there are no identified patterns in these attacks and who is behind these activities is yet a matter of investigation for the researchers.

QR Codes: Quick Response or a Quick Virus code?

Before scanning that QR code you just saw give it a second thought, Is it a clean code that will redirect you to an authentic site for the information you seek or a malicious code to breach your mobile security?

It seems like everywhere you look these days in business cards, ads, posters, websites, magazines, buses, almost on any object about which you might want to know more, you see a QR code which have proved to be the cheapest and easiest way to link the real world with the virtual.
QR code short for ‘Quick Response' code is a small two dimensional barcode that somewhat look like a scrambled checkerboards, invented by the Japanese corporation Denso Wave in 1994. Although these codes have been around for almost two decades, they were mainly used for industrial purposes until the last few years.

Why are QR codes so popular?
A Quick Response code is a type of matrix barcode that can store alphanumeric characters, in the form of URL's or text encoded in both vertical and horizontal direction, thus increasing its capacity of holding data than the traditional single dimensional barcodes i.e. 7,089 numeric characters or 4,296 alphanumeric characters and can store up to 2KB of data.
All you have to do is take a picture of a QR code with your smartphone camera and a QR reader application to scan it, the link within will direct you to websites, online videos or launch apps. The problem is there is no way to tell what's behind that QR code until scanned by QR code reader app. The biggest risk is if someone sees a random QR code that's not connected to anything just a sticker on the wall people cannot deny  their own curiosity, they will scan it because they want to know what it is, and attackers depend on this curiosity and craft their attacks.

Mobile Malwares:-
According to McAfee Labs Mobile malwares have doubled in last year.

Scams involving QR codes are gaining popularity. There are many cases of malicious QR codes being neatly placed over legitimate ones known as QRishing similar to phishing attacks.

IOS Device:-
On IOS devices for example, hackers are using jail-break exploits to send users to websites that will jailbreak the device. When a user scans a QR code he is redirected to an unknown website. These are drive by download attack, where these website hosts modified jailbreak exploits. Once visited the user phone will be jail broken and additional malware would be installed such as GPS trackers and key loggers.

Your laptop Camera could spy on you without lighting up the warning light.

If you own a MacBook or any other laptop, you should cover up it's webcam, because there’s a possibility someone could be watching you.
Most of the webcam have a tiny light lets you know that the webcam is active, but it's possible for malware to disable this important privacy feature.
Two Students from Johns Hopkins University  Matthew Brocker and Stephen Checkoway created a proof of concept app called “iSeeYou” that confirmed that MacBook iSight webcams can spy on their users without the warning light being activated.
A young man recently pleaded guilty in court to extortion after he performed a remote hack on Miss Teen USA’s webcam to secretly collect nude photos. It was revealed through court papers that the FBI has the ability to do the same thing with a variety of current laptops including Apple products.
Your laptop camera could Spy on You without lighting up

Android app SwiftKey Keyboard turned into a Keylogger app.

One of the best 3rd party Android Mobile Keyboard called 'SwiftKey' turned into a Keylogger Trojan by an Android developer to show the possible security threat of downloading pirated cracked apps from non-official App Stores and websites , "anyone pirating Swiftkey is taking a serious risk" developer said.

 He demonstrated how to inject a Keylogger snippets of code into a legitimate Android Keyboard application that infected a mobile device with Trojan, connected with a remote server and transmitted data from the device inducing your all key logs.

Android apps are coded in Java and compiled to byte code that is run on the Dalvik VM and this byte code is not that hard to edit and insert back into an APK." he explained.

He developed a keylogger from SwiftKey(APK Download), a malicious Java program designed to collect and send all key logs to a remote server (Check Keylogs) Along with the host IP address. He explained the complete code also on his blog.

Android malware is growing at a far more rapid pace than for other mobile platforms. For a Cyber Criminals, it is not important to develop their own malware program from scratch, Reversing ready-mate apps and inserting malware code can easily make their job more easy.

 Be careful from where you are downloading apps and think about the permissions and consider what the app is asking to do, and

Skype Malware that turns computers into Bitcoin miners.

Increasingly  desperate  to  cash  in  on  the  sky-rocketing  price  of  Bitcoin  these days,  gangs  of  cybercriminals  have  designed  a  new  malware  that’s  infecting computers  via  Skype in an attempt to build a botnet massive enough to start mining the virtual currency.

Researchers from Kaspersky Lab have discovered a new spam message campaign being transmitted via Skype contains malware capable of using an infected computer to mine for Bitcoins. The malware, identified as Trojan.Win32.Jorik.IRCbot.xkt.
According to Kaspersky Lab,  the average click rate for the rogue URL is high, at over 2,000 clicks per hour, and the creators of this malware had used it to seize control of hundreds of computers in Russia, Germany, Ukraine, Poland, Spain and other countries.

The malware spreads itself by infecting the Skype VoIP program, using the age old