One million Android devices infected in China

One million Android devices in China were infected with an Xshqi SMS worm on August 2, the day the country celebrated Valentine’s Day.

Experts at Kaspersky Lab revealed that a malware, dubbedTrojan.AndroidOS.Xshqi.a, infected neatly 500,000 Android devices in just six hours last week in China, but Chinese media provided a more pessimistic estimate declaring that the number of infected mobile is over 1 million smartphones.

The attackers operated in conjunction of the day the country celebrated Valentine’s Day as explained by Kaspersky team.

“The fact that this Trojan combination appeared on the Chinese Valentine’s Day is premeditated, taking advantage of user credulity on this special day. And it uses social engineering techniques to spread as much as possible and infect more devices. This Trojan is a good example of why it’s always worth thinking twice about trusting a link received on your mobile phone. No matter who sends it, it could still be a malicious program.,” reported researcher Vigi Zhang in a blog post.

The malware has been classified as a mobile SMS worm, but it includes also two malicious modules, the XXshenqi.apk and its asset Trogoogle.apk, the first one is used to spread the malicious code meanwhile the other component is a backdoor.

Once a mobile device is infected by Trojan.AndroidOS.Xshqi.a, the malware sends malicious SMSs to all the contacts in the victim’s address book. The link is used by malware authors to get victims to install the Trojan as well, Trojan.AndroidOS.Xshqi.a that verify the presence of the Trogoogle.apk, if it isn’t installed it displays a dialog window to prompt the user to install Trogoogle.apk. detected by Kaspersky as Backdoor.AndroidOS.Trogle.a.

The backdoor is used by cybercriminals to perform numerous operations, for example in order to steal victim’s personal information it asks user to register the app. The backdoor also enables the attackers to control victim’s device and send different commands to perform several operations, for example to create and send text messages.

Chinese law enforcement has already identified the author of the malicious campaign, he is a 19-year-old college student that admitted creating the malicious code, but he claimed that he only did it for fun. The young man was detained in the city of Shenzhen while visiting his parents.

Russian Cyber criminals hacked 1.2 billion usernames and Passwords

A Russian group has hacked 1.2 billion usernames and passwords belonging to more than 500 million email addresses, according to Hold Security - a US firm specialising in discovering breaches.

Hold Security described the hack as the "largest data breach known to date".

It claimed the stolen information came from more than 420,000 websites, including "many leaders in virtually all industries across the world".

Hold Security did not give details of the companies affected by the hack.

"They didn't just target large companies; instead, they targeted every site that their victims visited," Hold Security said in its report.

"With hundreds of thousands of sites affected, the list includes many leaders in virtually all industries across the world, as well as a multitude of small or even personal websites."

These databases were used to attack e-mail providers, social media, and other websites to distribute spam to victims and install malicious redirections on legitimate systems”

Hold Security

The New York Times, which first reported the findings, said that on its request "a security expert not affiliated with Hold Security analysed the database of stolen credentials and confirmed it was authentic".

"Another computer crime expert who had reviewed the data, but was not allowed to discuss it publicly, said some big companies were aware that their records were among the stolen information," the paper said.

The paper added: "Hold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable."

The Wall Street Journal later revealed that Hold intended to offer website owners the ability to check whether they had been affected, but only if they paid a fee.

The firm initially posted a message on its site saying it would charge $120 (£71) a month for the "breach notification service", however the details have since been replaced with a message saying "coming soon!".

Multi-pronged attack?

Hold Security, which has previously reported about hacks on Adobe and Target, said it took more than seven months of research to discover the extent of the latest hack.

The firm claimed the gang initially acquired databases of stolen credentials from fellow hackers on the black market.

"These databases were used to attack e-mail providers, social media, and other websites to distribute spam to victims and install malicious redirections on legitimate systems," Hold Security said.

The hackers also got access to data from botnets - a network of computers infected with malware to trigger online fraud.

Hold Security said the botnets helped the hacking group - which it dubbed CyberVor - identify more than 400,000 websites that were vulnerable to cyber attacks.

"The CyberVors used these vulnerabilities to steal data from these sites' databases," the firm said.

"To the best of our knowledge, they mostly focused on stealing credentials, eventually ending up with the largest cache of stolen personal information, totalling over 1.2 billion unique sets of e-mails and passwords."

Read more at: http://www.bbc.com/news/technology-28654613

Wall Street Journal’s Facebook Page Hacked

On July 21, the Journal confirmed that its Facebook account was hacked and false comments posted. "We are aware that our Facebook page was compromised," the newspaper said. "We have deleted the posts and are looking into it."

News site Mashable took screen-grabs of the fake comments. One of the comments read, "#BREAKING: US Air Force One crash feared as air traffic controller loses contact with pilot over Russian air space."

The Journal confirmed to Information Security Media Group that the unauthorized postings to its Facebook page were due to a compromise of a third-party account. "We acted quickly to remove the erroneous material and have reset affected accounts," according to a statement from the newspaper.
What's At Stake?

The incident highlights the many risks of a corporate social media account takeover, says Nikki Junker, communications and media manager at the Identity Theft Resource Center. "These risks range from damage to a brand's reputation to global financial impact, as was seen in the hacking of an Associated Press Twitter account last year," which caused the Dow Jones Industrial Average to drop 143 points, she says (see: Social Media Needs 2-Factor Authentication).

Shirley Inscoe, a security analyst at consultancy Aite Group, says the attack could have been a test to see if the hackers could post the false items successfully and how long it would take to be removed. "Media and social websites need to be much more security conscious than they have proven to be to date," she says.

It's important to take advantage of two-factor authentication offered by many social networks, Junker says. "You can set both your Twitter and Facebook accounts to send you a text message with a verification code which must be entered in order to log-in to an account," she says. "While it may take a bit of extra time, it can help prevent serious problems for your organization."

For more details: http://www.databreachtoday.com/wsj-facebook-page-hacked-a-7087#.U9_LW5azwOQ.twitter