Tag Archive for Graham Cluley

Skype targeted by ‘worm’ malware

Microsoft-Skype press conferenceMicrosoft acquired the Skype video chat service in 2011

Skype, the internet communications platform, is being used by hackers to distribute a “worm” that infects Windows PCs.

When users click on an instant message saying “lol is this your new profile pic?” they unwittingly download a file containing a Trojan horse malware file.

This opens a backdoor allowing hackers to hijack infected PCs and recruit them into a “botnet army”.

Users can be locked out of their machines and held to ransom.

According to internet security specialist Sophos, the worm is a variant of the well-known “Dorkbot” worm which has been spread by social media platforms such as Facebook and Twitter.

When the worm infects a computer it sends out the “lol” message to the user’s contact list.

Unsuspecting recipients think the message has originated from someone they know and click on the link, thereby downloading the malware payload.

Hijacked computers

Skype said in a statement: “Skype takes the user experience very seriously, particularly when it comes to security. We are aware of this malicious activity and are working quickly to mitigate its impact.

“We strongly recommend upgrading to the newest Skype version and applying updated security features on your computer.

“Additionally, following links – even when from your contacts – that look strange or are unexpected is not advisable.”

Botnets are often used to mount distributed denial of service (DDoS) attacks – forcing websites offline – to run spyware or to send out spam emails.

Publicity about the threat has made many users wary of clicking on strange-looking links posted via social networks, which may have prompted the perpetrators of this latest attack to switch tactics.

“The danger is, of course, that Skype users may be less in the habit of being suspicious about links sent to them than, say, Facebook users,” said Sophos’s senior technology consultant Graham Cluley.

Article source: http://www.bbc.co.uk/news/technology-19886241#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa

Rented computers ‘spied on sex’

A webcam on a computerUsers should be extra careful when using machines that do not belong to them, experts said

Rented computers from seven different companies secretly took photographs of their users, US authorities have said.

The companies used software made by US company Designerware which could track key strokes and other personal data.

The software, called PC Rental Agent, captured people engaging in “intimate acts”, including sex.

The settlement means the companies are banned from using the software which invaded the users’ privacy.

However, some software – such as location tracking – could still be used as long as the companies involved made it explicitly clear to the users.

It is believed that PC Rental Agent has been installed in approximately 420,000 computers worldwide.

The Federal Trade Commission ruling concerned a feature in the software, called Detective Mode, which would typically become activated if the user was late in returning equipment, or failed to pay for use.

Detective Mode would assist the rental store in locating the overdue computer in order to pursue its return.

Part of the process involved a pop-up window designed to look like a software registration screen.

It would request personal information such as email addresses and telephone numbers that could then be used to pursue the users for payment and/or the return of equipment.

‘Partially undressed’

In addition, the FTC said the software had access to much more sensitive information, including: usernames and passwords for email accounts, social media websites, and financial institutions.

Among the other data collected were social security numbers; medical records; private emails to doctors; bank and credit card statements.

Webcam pictures of children, partially undressed individuals, and intimate activities at home were also found.

In the FTC’s formal complaint document, it said the software had captured “couples engaged in sexual activities”.

Graham Cluley, from UK-based computer security firm Sophos, said the case highlighted the need for people to be especially cautious on machines they do not own.

“Whenever you’re using someone else’s computer, whether it’s borrowed or rented, you can’t always know all of the software on it and what it might be doing,” he told the BBC.

“If you are entering an agreement to rent a computer, read the small print, and maybe think twice about doing anything too personal on them.”

Designerware could not be reached for comment.

Article source: http://www.bbc.co.uk/news/technology-19726954#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa

Facebook: The challenges ahead for the social network

Mark ZuckerbergPlenty to think about: Facebook boss Mark Zuckerberg has several key problems to solve, the experts say

When Facebook first floated on the stock exchange earlier this year, it started out at an astronomical high, valued at over $100bn (£65bn).

Since then, rockier times. From an initial share price of $38, Facebook’s stock dipped to below $29 in May.

This week, there comes another huge test for the site as it releases the financial results for its first quarter of public trading.

The BBC has asked four key experts for their views on where Facebook’s challenges lie in the coming months.

What do you think Facebook should do next? Send us your comments at the bottom of this page.

Privacy

Jennifer Lynch

Jennifer Lynch is a staff attorney at the Electronics Frontier Foundation, a privacy campaign group. Ms Lynch is concerned about Facebook’s recent takeover of a facial recognition company:

Facebook’s acquisition of facial recognition software face.com is concerning from a privacy perspective for two reasons.

First, it is unclear what Facebook intends to do with the facial recognition data face.com collected. Face.com has stated that its database includes over 30 billion face prints.

If this data is combined with the facial scans from the 300 million images Facebook users upload every day, it would likely create the largest (and largest privately-owned) facial recognition database in the world.

The United States government regularly asks for copies of all photographs in which a user is tagged when it issues a warrant to Facebook. And government agencies in the States and abroad that are building out facial recognition databases have an interest in acquiring as many face images as possible.

Face.com and Facebook’s combined data could become a honeypot for government if Facebook doesn’t take steps to protect it properly.

Second, as Facebook expands the tools face.com developed to use mobile devices to collect images and identify people, the security of the data becomes a real issue.

Facebook must show it has adequate measures in place to protect both the integrity of the face recognition data and its users’ accounts from hacking and fraud.

Mobile

Malcolm Barclay

Ahead of going public, Facebook, itself, predicted it might struggle to make money from its mobile users who have been reluctant to engage with ads while on the go. If this is to ever change, argues independent app developer Malcolm Barclay, Facebook’s mobile offering needs to improve greatly.

The existing app suffers from endless loading, refresh problems and feels more like using a website from the late 90′s. To put it another way, it is like listening to a transistor radio. Rewriting it in a different programming language, Objective-C, will be more akin to surround sound, an experience people expect from their £400+ devices.

A rewrite in Objective-C is exactly what the Facebook app needs. Facebook’s existing app is written mostly in HTML5.

It is a very promising and useful technology, but right now more suited to desktop web browsers. Objective-C is the native programming language of the iPhone. It can exploit all of its features, it is fast and has a tool kit of interface elements that users are familiar with.

So why did Facebook make the app in HTML5 in the first place? It was cheaper, HTML5 can run on many different devices (eg Android), hence it costs less to maintain and there’s no need to make separate apps. I doubt Facebook really benefited from this – users certainly did not.

Last week Facebook purchased the developers at Acrylic, a tiny operation. Google did the same and acquired Sparrow, a very popular mail app for Mac the iPhone – all of these apps are written in Objective-C.

Reports suggest that Facebook has already begun working on rebuilding their app from the bottom up. I hope this is the case – experience matters.

Security

Graham Cluley

Graham Cluley is a security researcher and blogger with Sophos. He argues that Facebook needs to get a firmer grip on the third-party applications on its platform, perhaps taking a few cues from a familiar computing giant:

Want to see who has viewed your profile? There’s a Facebook app for that. But you shouldn’t be too quick to grant it permission to access your account.

Rogue Facebook apps, created by internet scammers and cybercriminals, want to access your personal data, and hope to make money by luring you into following links.

These apps run on the Facebook platform itself (don’t confuse them with the apps you run on your computer or smartphone), and – if you allow them – have access to your profile, your personal info, your photos..

The result is that you don’t know who you are sharing your information with, and who is going to access it. The apps can even present themselves as though they are entirely located on Facebook – even when hosted on third-party websites that could be under the control of any Tom, Dick and Harry.

Most chilling of all, rogue Facebook apps can actually post messages in your name – tricking your online friends into thinking that it’s you spreading a link, which could be designed to infect their computers or steal further information.

Maybe Facebook should learn a lesson from Apple? Apple reviews all iPhone/iPad apps before they are allowed in the iOS App Store. That doesn’t just stop yet another fart app, it also makes it harder for hackers to spread dangerous code via this route. Whatever Apple is doing, it seems to be doing it right.

Not everyone may like Apple’s “walled garden” approach, but you cannot deny that it has kept the Apple iPhone a relatively safe place to be.

Maybe Facebook should consider something similar.

And maybe users need to think carefully about what data they upload to Facebook – that’s the one sure way of ensuring it is never grabbed by a rogue app.

FacebookPhone?

Carolina Milanesi

Many have speculated that Facebook is looking at creating its own device – the so-called “Buffy” phone. Carolina Milanesi, an analyst for Gartner, questions the logic behind any such predictions:

“Speculations about a possible Facebook phone have been on and off for the past couple of years.

After the first round of rumours we saw mobile phone maker HTC bring to market the HTC Salsa and the HTC ChaCha. Both had dedicated Facebook keys and both saw only modest sales.

So why would Facebook come out with its own phone? I struggle to see why it would.

Although social is a key part of today’s mobile life for many consumers, only a sub-set of users would actually want a phone that totally centres on social networking.

Users would also not compromise on the specifications of the hardware, meaning that Facebook would have to bring to market a device comparable to a high-end Android phone in order to be taken seriously.

Manufacturing costs would likely be too high to be covered by advertising revenue.

The reality is that most consumers are perfectly happy with an app on their current phone. We believe that a deeper integration of Facebook on the current operating systems iOS, Android and Windows Phone will deliver a much wider addressable market to Facebook than not a dedicated phone. And what is social about if not the mass market?

If we put rumours aside for a second and we look at the facts, we know that Facebook is to be integrated more tightly with Apple’s next mobile operating system, iOS 6. One has to wonder if Apple would have made such a decision if the possibility of a Facebook phone was actually on the horizon.”

Article source: http://www.bbc.co.uk/news/technology-18981495#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa

Last.fm suffers password breach

Last.fm screenshotLast.fm is the latest in a string of sites to admit its passwords are at risk

Music website Last.fm is investigating the leak of “some” of its members’ passwords, the UK-based company has said.

A message posted on the site’s homepage advised all of its customers to “change their passwords immediately” as a precautionary measure.

The breach follows similar leaks at social network LinkedIn and dating site eHarmony.

Last.fm apologised, saying it took user privacy “very seriously”.

It added: “We will never email you a direct link to update your settings or ask for your password.

“We strongly recommend that your new Last.fm password is different to the password you use on other services.”

‘More to come?’

On Wednesday, business social network LinkedIn admitted that over six million of its users’ passwords had been obtained and details posted online.

Graham Cluley, security expert at Sophos, told the BBC he worried the sites could have shared the same vulnerability.

“Can it be coincidence? It seems unlikely to me. There’s a mystery in the middle of the LinkedIn breach about how they got the data. You have to worry there’s a common vulnerability.

“The fact is, the only people who know are the hackers and maybe the companies concerned, but they may be struggling to work out what’s happened.

“Is this the end of the story, or is there more to come?”

He reiterated advice suggesting users have different passwords for different web services.

How to change your LinkedIn password

ScreenshotSecurity experts have advised users to change their passwords on LinkedIn. Here’s how: First, visit www.linkedin.com, and log in with your details

ScreenshotOnce logged in, hover over your name in the top right-hand corner of the screen, and select Settings from the menu

ScreenshotOn the next screen, click the Account tab, found near the bottom left-hand side of the page

ScreenshotUnder the Email Password heading, you will find a link to change your password. If you use the same passwords on other sites, change those too

Article source: http://www.bbc.co.uk/news/technology-18358485#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa

India becomes top spamming nation

Spam in email inboxMany spammers have shifted their focus from email to social networks

India has become the top spam-spewing nation on the planet, suggests a report.

Compiled by security firm Sophos, the report ranks nations by the amount of junk mail routed through computers in each country.

India has leapt to the top of the spam chart in less than a year, rapidly overtaking the US, said Sophos.

About 10% of all junk mail sent across the web came from or passed through computers in India, said the firm.

India’s rapid rise up the chart of spam producers has been helped by the rapid growth of the web in the country, said Graham Cluley, senior technology consultant at Sophos.

The inexperience of the many first-time net users in India had led many to fall victim to hi-tech criminals, he said.

“The latest stats show that, as more first-time internet users get online in growing economies, they are not taking measures to block the malware infections that turn their PCs into spam-spewing zombies,” he added.

Social networks

About 80% of all junk email is thought to be routed through PCs hijacked by hi-tech criminals who use computer viruses to seize control of the machines. Once a machine is under their control they use them to send out mail on their behalf, typically relaying it from another nation.

Sophos estimates that about 9.3% of all junk mail travels through Indian computers. In second place is the US (8.3%) and South Korea (5.7%) is third.

India’s rise up the rankings was also helped by the ongoing shift away from traditional email by spammers. More and more of them, said Sophos, were using social networks as the route to spread their junk messages.

Facebook, Twitter and Pinterest were all being hit with increasing regularity by spammers, said Sophos.

Article source: http://www.bbc.co.uk/news/technology-17813300#sa-ns_mchannel=rss&ns_source=PublicRSS20-sa