Viruses & Malware
Security firm Kaspersky Labs reports that a new sample of the Destover malware—the malware family used in the recent attack on the networks of Sony Pictures—has been found bearing a valid digital signature that could help it sneak past security screening on some Windows systems. And that digital signature is courtesy of a certificate stolen from Sony Pictures.
Details of malware that may have been associated with the attack on Sony Pictures were disseminated in an FBI “Flash” earlier this week. A copy of the memorandum obtained by Ars Technica details “a destructive malware used by unknown computer network exploitation (CNE) operators” that can destroy all the data on Windows computers it infects and spread itself over network file shares to attack Windows servers.
Symantec Security Response has discovered a new malware called Regin which, they say, "...displays a degree of technical competence rarely seen and has been used in spying operations against governments, infrastructure operators, businesses, researchers, and private individuals."
This back-door trojan has been in use, according to the security company, since at least 2008, and has stayed under the radar since.
The king of the castle has a new tormentor.
IBM’s Trusteer researchers have discovered a new configuration of the Citadel malware that attacks certain password managers. The configuration activates key logging when certain processes are running on the infected machine. The targeted processes include Password Safe and KeePass, two open-source password managers. The variant also targets the nexus Personal Security Client used to secure financial transactions and other services that require heightened security.
An app recently available in the Google Play store claimed to be a download for wallpapers, videos and music, but in reality, it was a SMS trojan app.
The package name “com.FREE_APPS_435.android” tricked victims by getting them to allow the app to access their SMS messages, according to a Malwarebytes blog post. If a user clicked through the app's Google Play homepage to the developer's website, they found two banners and links.