A few days ago we published an article that covered a leaked batch of emails that showed Kaspersky has worked with the Russian Government. We also covered that the pieces of the emails that were published were completely out of context, and also are nothing out of the ordinary for a company that has a contract with a Government body. Kaspersky's denial of cooperation is also nothing new, so why the big deal in the media? Well we might have found a few pieces to that puzzle which would certainly explain the big push to discredit Kaspersky.
The targeting of travelers is something that is a very old idea. To the would-be attacker you are getting a target that is not familiar with their surroundings and (in many cases) has a lot of money on them. In the “old days” the target was the cash they brought with them. This quickly changed to a number of scams to get access to their credit card numbers and the cash that they protected. Still the idea was to go after the traveler because they were easy targets when they were out and about.
At times it seems that the words Microsoft and Malware go hand-in-hand. I do not think that a day goes by that we do not hear about a new malware threat (often simply an old threat that has been modified). This has put Microsoft in an interesting position. They are always working to shore up holes in their operating systems we can see this by the continuous patches and hotfixes that are in existence for Windows (all versions). Of course it is not an easy task to develop an OS that is safe(er) or secure(ish) and still make it easy to operate. However recently we have seen Microsoft go to some extremes in trying to keep up with things… sometimes they appear to go way too far.
It appears that the earlier claims from FireEye about a link between Gauss and Flame were a little premature. According to their blog they had found what appeared to be a shared command and control server. This was a significant find as it linked the two serious pieces of malicious code together and would have made Gauss another in the growing list of suspected State-Sponsored cyber-attacks. Unfortunately for FireEye, what they thought was a command and control (CNC) server turned out to be a sinkhole run by Kaspersky Labs.
Another day another bit of malware hits the internet. This time the malware is a very nasty bit of code and one that you should be very concerned about. The new malware named Shamoon was first reported on Thursday and has the nasty capability to grab user information before attempting to render the system unusable. Both Symantec and Kaspersky have independently reported on the malware and from their reports on the new bug seem to feel it is definitely worth keeping an eye on.
It would appear that the developers of Stuxnet/Duqu and Flame shared at least some source code during development. At least that is what security research firm Kaspersky seems to think. Kaspersky was the company that found the massive bit of malware that was using a compromised Microsoft Terminal Server licensing model to sign certificates for their code. Flame appears to have been a very coordinated espionage attack on Iran and has been in the news thanks to the complexity and functionality that it has.
An interesting report has popped up about a rather large attack on a group of Middle Eastern countries. The attack (called Flame) appears to be a targeted attack against Iran, Israel, Palestine, Sudan, Syria, Lebanon, Saudi Arabia and Egypt with the most effected being Iran, Palestine, and Israel. The attack was reported by Kaspersky Labs and looks to be intended to collect all kinds of information (not just data on computers). Kaspersky believes that Flame has been operating for at least two years in this region.
Well, well, well… although we have been saying it ever since the first Macs with Intel CPUs rolled off the lines in the Foxconn factories in China it seems like the world is finally realizing that the Mac IS a PC just running a different OS. The first kick in the head was delivered when the Flashback Malware hit the streets in the form of a fake flash installer which made any infected Mac part of a global botnet.
Although it will come as no surprise to anyone really the is now a report stating that Symantec’s estimation of the number of infected Macs with the Flashback Trojan might have been a tad low. You all remember that a couple of weeks ago Apple admitted to the malware and its effect on OSX. They finally released a patch for the affected subsystem (the Java API in Safari) and then released a tool that was supposed to identify and fix infected systems. This was actually after Kaspersky and F-Secure released tools to perform the same task.
With SOPA still a hot topic we are hearing about more fallout as lines are being drawn even between one time partners. We have heard that several members of the Business Software Alliance have asked the organization to pull all support from the dangerous and potentially damaging bill. The BSA has complied (for the most part) but has still left enough of an opening that not everyone is satisfied with the way things stand.