Gauss wants YOUR log-on

Kaspersky Lab has announced the discovery of ‘Gauss’, a new cyber-threat targeting users in the Middle East. Gauss is a nation-state sponsored cyber-espionage toolkit designed to steal sensitive data, with a specific focus on browser passwords, online banking account credentials, cookies, and specific configurations of infected machines.

The online banking Trojan functionality found in Gauss is a unique characteristic that was not found in any previously known cyber-weapons..............

Click here to read more .... 
Solutions : www.xcyss.in

New bot targeting Windows, Mac OS

Security experts at Kaspersky Lab noted that the first quarter of 2012 started with a bang after a quiet 2011, because botmasters failed to come up with anything new last year. But in the first three months of 2012, the experts noticed cybercriminals using a ‘fileless' bot to build a zombie-net; and rising targeted attacks against Mac Operating System.............

The criminals were targeting organisations that used both Windows and Mac platforms. These criminals use two Trojans — one for Mac and the other for Windows — to gain access to confidential records.

They were found loading the appropriate malware (based on the platform on which the targeted machine was in use at that time) and these Trojans were found getting commands from a single control centre.

Criminals were found using a loophole that worked in both Windows and Mac OS X environments to make the initial intrusion into the system..............

Click here to read more ....
Solutions : www.xcyss.in

SURWARE DuQu - a handiwork of Wednesday's Gang

Aleks of Kaspersky Lab Expert has Posted November 11, 12:09  GMT

The Duqu Saga Continues: Enter Mr. B. Jason and TV’s Dexter

Kaspersky Lab in hot chase of DUQU and in close coordination with Sudanese CERT has reveled new facts about this game changing SURVEILLANCE MALWARE (This family of malware , I like to call SURWARE pronounces similar to 'surveyor'). 

Kaspersky lab  found three ~DQ-type files, created on May 25, June 29 and August 24, all three dates were Wednesdays. This could be just a coincidence, maybe not. Still, based on this ‘coincidence’ Kaspersky Lab preferred to name the group behind Duqu as the Wednesday’s Gang :)

The report brings many new facets of this Surware which can be read at http://www.securelist.com/en/blog/208193243/The_Duqu_Saga_Continues_Enter_Mr_B_Jason_and_TVs_Dexter

Some of the key findings of the report are :

- For every victim, a separate set of attack files was created;

- Each unique set of files used a separate control server;

- The attacks were conducted via e-mails with a .DOC file attached;

- The mail-outs took place from anonymous mailboxes, probably via compromised computers;

- At least one e-mail address is known from which the mail-outs were conducted -bjason1xxxx@xxxx.com;

- For each victim, a separate DOC file was put together;

- The vulnerability exploit was contained in the font called “Dexter Regular”;

- The attackers changed the shellcode, and varied the range of dates for possible infection;

- After penetration into a system the attackers installed extra modules and infected neighboring computers;

- The presence on the systems of the files ~DF.tmp and ~DQ.tmp unambiguously points to an infection by Duqu.





Solutions : www.xcyss.in