YiSpector First iOS Malware That Attacks On Apple iOS Devices

YiSpector: First iOS Malware That Attacks On Apple iOS Devices

YiSpecter is different from previously seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices through unique and harmful malicious behaviors. 

Cyber Security firm Palo Alto networks researcher Claud Xiao defines that, how this malware attack work on iOS devices which targets in China and Taiwan.

He said in the blog,

Specifically, it’s the first malware we’ve seen in the wild that abuses private APIs in the iOS system to implement malicious functionalities.

Yispector Infected iOS device

 YiSpecter is the first real world iOS malware that combines these two attack techniques and causes harm to a wider range of users. It pushes the line barrier of iOS security back another step.

• Whether an iPhone is jailbroken or not, the malware can be successfully downloaded and installed.
• Even if you manually delete the malware, it will automatically re-appear
• Using third-party tools you can find some strange additional “system apps” on infected phones
• On infected phones, in some cases when the user opens a normal app, a full screen advertisement will show.

Palo Alto Networks has released IPS and DNS signatures to block YiSpecter’s malicious traffic. This blog also contains suggestions for how other users can manually remove YiSpecter and avoid potential similar attacks in the future. Apple has also been notified.

According to analysis reports by Qihoo 360 and Cheetah Mobile, YiSpecter was also spread by the Lingdun worm.

A malicious webpage uploaded by Lingdun worm

Lingdun uses fake VeriSign and Symantec certificates to bypass malware detection systems. Its primary goal is to download and to install additional Windows software onto a PC. Most of this additional software is benign but at least one installation was malicious.

Apple said in Statement,

"This issue only impacts users on older versions of iOS who have also downloaded malware from untrusted sources. We addressed this specific issue in iOS 8.4 and we have also blocked the identified apps that distribute this malware. We encourage customers to stay current with the latest version of iOS for the latest security updates. We also encourage them to only download from trusted sources like the App Store and pay attention to any warnings as they download apps.”

How to Remove YiSpecter from Your iOS Devices?

• Go  to Settings –> General –> Profiles and remove all unknown or untrusted profiles.
• Delete any installed apps with names 情涩播放器, 快播私密版 or 快播0.
• You can use any third-party iOS management tool such as iFunBox on Windows or Mac OS X to connect with your iPhone or iPad
• Then check for installed iOS apps like Phone, Weather, Game Center, Passbook, Notes, or Cydia and delete them.

Last month, we reported XcodeGhost malware infected almost 40 popular apps in the Chinese App. Store.

MEMSCAN A Memory Scanning Tool For A Specific Sequence of Bytes

MEMSCAN A Memory Scanning Tool.. 
For A Specific Sequence of Bytes!

A memory scanning tool which uses mach_vm* to either dump memory or look for a specific sequence of bytes.
To build MEMSCAN, you will need to have the OS installed. Well, you don't really need it but it makes life easier.

Once Theos is installed, simply navigate to the MEMSCAN folder in terminal and run:

make package install

Usage

Dumping the memory of a process

1. Obtain the target process PID, using ps.
2. Provide the PID to memscan:

./memscan -p <PID> -d

Finding objects in memory

Open your target app or process in a disassembler, grab first ~16 bytes (customise this number as you will) of the method you want to hook and these bytes will be your "signature".

Write the signature to a file, make sure to encode the bytes like so:

echo -n -e '\x55\x48\x89\xE5\xB8\x15\x00\x00\x00\x5D' > needle

Run the scanner against the target process. It will locate the signature in memory and print it's address. The signature has to be passed in as bytes, not a literal string so use the scanner as shown:

./memscan -p <pid> -s <Path to file containing needle> 

e.g:

./memscan -p 1234 -s ./needle

MEMSCAN should then print the address where the needle is located in memory.


Download

US Stock Market Company Scottrade Hacked 4.6 million Customers Are On Risk

US Stock Market Company Scottrade Hacked.
4.6 million Customers Are on Risk!

Hackers hacked the name and physical address of customers data.
Scottrade is a privately owned American discount retail brokerage firm headquartered in Town and Country, Missouri.

"We take the security of the information entrusted to us very seriously and are fully cooperating with law enforcement in its investigation and efforts to bring the perpetrators to justice," the company said.

Was I Affected?
Current information indicates that the cybercriminals had unauthorized access to our network for a period of several months between late 2013 and early 2014.

If you had an account previous to February 2014, your information may have been accessed through this incident. We are directly notifying everyone whose information was contained in the affected database so they are aware of what happened.

For Clients

If your information was contained in the affected database, you will receive a letter or email from Scottrade with additional information and resources.

We have secured the known intrusion point and conducted an internal data forensics investigation on this incident with assistance from a leading computer security firm. We have taken appropriate steps to further strengthen our network defenses.

What they Hacked

• Names
• Physical Address
• Email Id's 
• Social Security numbers

Mostly hackers wants to steal customer names and address. According to Krebon Security Scottrade spokesperson was not immediately available by email, but said in a statement to journalist Brian Krebs, who first reported the breach, that the focus of the attack was "a list of client names and street addresses" that was taken from its systems.

Yesterday, we reported about T-Mobile 15 million customers data got Hacked

T- Mobiles 15 Million Users Data Gets Hacked

T- Mobiles 15 Million Users Data Gets Hacked!

Hackers breached an Experian network it is the World's biggest consumer credit monitoring firm and vendor of the T-mobile company who process the credit card applications.

T Mobile CEO John Legere said in the statement,

"Obviously I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian, but right now my top concern and first focus is assisting any and all consumers affected. I take our customer and prospective customer privacy VERY seriously. This is no small issue for us. I do want to assure our customers that neither T-Mobile’s systems nor network were part of this intrusion and this did not involve any payment card numbers or bank account information."

Investigation is on ?
The investigation is ongoing, but what we know right now is that the hacker acquired the records of approximately 15 million people, including new applicants requiring a credit check for service or device financing from September 1, 2013 through September 16, 2015.

These records include information such as name, address and birth date as well as encrypted fields with Social Security number and ID number (such as driver’s license or passport number), and additional information used in T-Mobile’s own credit assessment. Experian has determined that this encryption may have been compromised. We are working with Experian to take protective steps for all of these consumers as quickly as possible.

"We take privacy very seriously and we understand that this news is both stressful and frustrating.  We sincerely apologize for the concern and stress that this event may cause," said Craig Boundy, Chief Executive Officer, Experian North America. "That is why we're taking steps to provide protection and support to those affected by this incident and will continue to coordinate with law enforcement during its investigation."

If you have been affected ?
Anyone concerned that they may have been impacted by Experian’s data breach can sign up for two years of FREE credit monitoring and identity resolution services at www.protectmyID.com/securityincident.

T-Mobile International AG is a German holding company for Deutsche Telekom AG's various mobile communications subsidiaries outside Germany. Based in Bonn, Germany.

T-Mobile is the third biggest mobile firm in the US.

GitHub Announces To Support Universal 2nd Factor Authentication

GitHub Announces To Support Universal 2nd Factor Authentication (U2F) 
A rapidly growing open authentication standard!

When you insert them, these physical USB keys automatically generates a second-factor code. And you don't even enter a Six-digit code from Google Authentication and similar Apps. GitHub announced that its partnership with Yubico.

Two-factor authentication is a security process in which the user provides two means of identification from separate categories of credentials; one is typically a physical token, such as a card, and the other is typically something memorized, such as a security code.

The FIDO U2F Security Key by Yubico is a specially designed YubiKey, relying on high-security, public-key cryptography. U2F is built to protect against phishing and man-in-the-middle attacks, allowing one U2F authenticator to access any number of services without any shared secrets.

What is U2F — FIDO UNIVERSAL 2ND FACTOR

U2F is an open authentication standard that enables internet users  to securely access any number of online services, with one single device, instantly and with no drivers or client software needed.

U2F was created by Google and Yubico, with contribution from NXP, and is today hosted by the open-authentication industry consortium FIDO Alliance.

U2F is used with USB devices, including YubiKeys, as one of many authentication methods

In order to take advantage of the security improvements provided by U2F, you'll need to purchase a hardware key. You can purchase the U2F key of your choice from a range of vendors. GitHub are partnering with Yubico, inventor of the YubiKey, co-creator of the U2F protocol, and a leading provider of U2F authenticators.

Together with Yubico we are offering discounts to GitHub users for a limited time through a special offer page where you will verify your GitHub account and place your order:

• While supplies last, GitHub users can purchase special edition U2F Security Keys for $5 plus shipping and handling (regular price $18; 5,000 special edition keys available).
• After the special keys are gone, all GitHub users are eligible for a 20% discount on U2F-certified YubiKeys, for a limited time.
• In addition, all students who are eligible for the Student Developer Pack will receive a 20% discount on any U2F-certified YubiKey.

Your Android Phone is Vulnerable To Remote Hacking With StageFright Bugs

Your Android Phone is Vulnerable To Remote Hacking With StageFright Bugs!

Stagefright 2.0, a set of two vulnerabilities that manifest when processing specially crafted MP3 audio or MP4 video files. 

Security Researcher of Zimperium Joshua Drake (Vice President of platform research and exploitation at Zimperium) discovered two more vulnerabilities in the Android. His aimed to researching media processing in Android and focused on remote attacks agains current devices.

What is the vulnerability ? 
Processing specially crafted MP3 or MP4 files can lead to arbitrary code execution. -

The vulnerability lies in the processing of metadata within the files, so merely previewing the song or video would trigger the issue. Since the primary attack vector of MMS has been removed in newer versions of Google’s Hangouts and Messenger apps, the likely attack vector would be via the Web browser.

• An attacker would try to convince an unsuspecting user to visit a URL pointing at an attacker controlled Web site (e.g., mobile spear-phishing or malicious ad campaign)
• An attacker on the same network could inject the exploit using common traffic interception techniques (MITM) to unencrypted network traffic destined for the browser.
• 3rd party apps (Media Players, Instant Messengers, etc.) that are using the vulnerable library.

After the execution this Vulnerbaility allow attackers to access to personal data and photos stored on the phone, be able to take photos, record conversations, email and SMS and can download malicious apps remotely.

Google said that new Stagefright bugs will be fixed in next schedule update.

Source: Zimperium

Whonix - Privacy And Anonymity Operating System

Whonix - Privacy And Anonymity Operating System

Whonix is an operating system focused on anonymity, privacy and security. It’s based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user’s real IP.

Whonix consists of two parts: One solely runs Tor and acts as a gateway, which we call Whonix-Gateway. The other, which we call Whonix-Workstation, is on a completely isolated network. Only connections through Tor are possible.

Interested? Look Below! ;-)

Whonix for Qubes
https://www.whonix.org/wiki/Qubes


Whonix for KVM
https://www.whonix.org/wiki/KVM


Whonix for VirtualBox
https://www.whonix.org/wiki/VirtualBox


If you want to upgrade existing Whonix version using Whonix’s APT repository Special instructions required:

https://www.whonix.org/wiki/Upgrading_Whonix_10_to_Whonix_11

Download


About the Author:
Christian Galeone is an IT Security Specialist from Italy. He has been Acknowledged by the TOP 5 Companies including Yahoo!, Microsoft, AT&T, Sony etc. He is currently working with HOC as Author of Cyber Security & VA Research Articles.