iPhone, Apple PCs vulnerable to hackers: consultant

The iPhone and Apple Inc.'s desktop computers may be vulnerable to hackers due to a flaw in their Web browser, according to a security firm, which said it found a way to hack into the iPhone.

Baltimore-based Independent Security Evaluators, which tests its clients' computer security by hacking it, said on Monday that three employees found a way to take control of iPhones through a Wi-Fi link or by tricking users into going to a Web site.

Charles Miller, principal security analyst at the firm, said a security weakness allows someone to take control of Apple's Safari Web browser and see other applications on the device at the same time, which could potentially make users of Macintosh desktop computers vulnerable to attacks.

"The same problem actually exists on Apple's desktops," said Miller. But he added that while his firm had identified the risk for both desktops and phones, it had written only the code necessary to hack into the iPhone.

The security consultants, who took about a week and a half to work out the move, said they were able to take control of an iPhone and make calls or send text messages, as well as access e-mails, voice-mail, address books and call and Web browsing history.

Miller said his company gave details about the hack and a potential security patch to Apple, but did not publicly release the details.

"We're looking into the report submitted by (Integrated Security Evaluators) and we always welcome feedback on how to improve our security," Apple spokeswoman Lynn Fox said.

Miller said Apple could have avoided the risk by eliminating links between the browser and other applications.

"It turns out that on the iPhone there are probably some basic things they could have done that would have made it better," said Miller.

The claim comes more than three weeks after Apple and AT&T Inc. (T.N: Quote, Profile, Research) started selling Apple's first cell phone, which includes a music and video player as well as a Web browser.

As many as 700,000 iPhones were sold on the first weekend after the June 29 launch, according to analyst estimates.

Days after launch, a well-known hacker Jon Johansen, claimed to have overcome restrictions on the iPhone, allowing highly technical users to bypass AT&T's network to use the phone's Internet and music features.

While cell phones have not historically been as vulnerable to attack as desktop computers, some experts worry that phones take on greater risks as they add more computer-like features.

Miller said he had not looked into security on other mobile phones to see how they compare to the iPhone, but said the more complex a system is, the greater the likelihood is that it will have problems.

source: reuters.com

Read More

New Sophos Security Threat Report Reveals Record Number of Web-Borne Attacks During 2007

Sophos Reveals Sharp Rise in Web Threats, and Uncovers Latest Trends in Viruses, Spyware and Spam

Sophos, a world leader in IT security and control, has published new research on the first six months of cybercrime in 2007. The Sophos Security Threat Report examines existing and emerging security trends and has identified a sharp increase in the number of web threats, as well as the countries and server types hosting the most infected sites.

The first half of 2007 has seen a significant increase in threats spread via the web, which has surpassed email as the preferred method of attack for financially motivated cybercriminals. In June alone, Sophos’s global network of monitoring stations uncovered a record number of infected web pages - approximately 29,700 - each day. In contrast, earlier in 2007, only as few as 5,000 malicious pages per day were detected.

Sophos blocks access to millions of web pages to protect customers from malware and inappropriate content. Taking a snapshot of just one million of those web pages, experts found that 28.8 percent were hosting malware. An additional 28 percent were blocked due to the adult nature of their content, most commonly because they were pornography or gambling sites. Pages created by spammers accounted for 19.4 percent and 4.3 percent were classed as illegal sites, including phishing sites or those peddling pirated software. Of the websites containing malicious code, just one in five had been designed specifically for malicious activity, with the remaining 80 percent made up of legitimate sites that have fallen victim to hackers.

APACHE IS THE MOST COMPROMISED SERVER

By compromising a single file on a web server, cybercriminals can easily and quickly cross-contaminate a huge number of websites, as the infected file may form part of a plethora of unrelated pages, all of which are published from the same server.

The breakdown of the world’s top server types affected by web threats in the first six months of 2007 reads as follows:
1. Apache 51.0%
2. Microsoft IIS 6 34.0%
3. Microsoft IIS 5 9.0%
5. nginx 3.0%

Other 3.0%

The fact that more than half of all infected web pages were hosted on Apache servers demonstrates that infection is not simply a Windows problem. Earlier this year, during a global ObfJS attack, in which legitimate sites were compromised so that they could serve up a malicious code, 98 percent of affected servers were running Apache - many of which were hosted on UNIX rather than Windows platforms.

“Website infections have increased significantly in the past six months. The number of infected sites has grown more than five times since January,” said Ron O’Brien, Boston-based Sophos senior security analyst. “As 80 percent of those sites are legitimate, it makes you wonder why more action is not taken to help prevent such attacks. Simple measures such as keeping up to date with security patches are one of the most effective ways to prevent infections on servers.”

TOP WEB-BASED THREATS OF 2007 - SO FAR

The top 10 list of web-based malware hosted on these infected sites during the first six months of 2007 reads as follows:
1. Mal/Iframe 49.2%
2. Troj/Fujif 7.9%
3. JS/EncIFra 7.3%
4. Troj/Psyme 8.3%
5. Troj/Decdec 6.9%
6. Troj/Ifradv 4.1%
7. Mal/ObfJS 2.5%
8. Mal/Packer 1.5%
9. VBS/Redlof 1.1%
10. Mal/FunDF 0.9%

Other 10.3%

Mal/Iframe, which works by injecting malicious code onto web pages, dominates this chart, accounting for almost half of the world’s infected URLs. Furthermore, it shows no sign of abating - in a recent potent attack, more than 10,000 web pages were infected, the majority of which were on legitimate web pages hosted by one of Italy’s largest ISPs.

MOST INFECTED WEB PAGES HOSTED IN CHINA

The top 10 list of countries hosting malware-infected web pages during the first half of 2007 reads as follows:
1. China 53.9%
2. United States 27.2%
3. Russia 4.5%
4. Germany 3.5%
5. Ukraine 1.2%
6. France 1.1%
7. Canada 0.8%
8. United Kingdom 0.7%
9= Taiwan 0.6%
9= South Korea 0.6%

Other 5.9%

China, which at the end of 2006 hosted just over a third of all malware, has now overtaken the U.S., and in the first six months of 2007 was responsible for hosting more than half of all web threats reported to Sophos. China’s dramatic rise in the chart is primarily due to widespread Mal/Iframe infections on Chinese hosted web pages. In fact, more than 80 percent of the country’s compromised web pages are infected with this malware.

HACKERS TURN TO PDFS AND REMOVABLE DRIVES TO COMMIT CYBERCRIMES

The first half of 2007 has seen cybercriminals using attachments in spam messages. To avoid detection by less sophisticated gateway filtering products, there is a growing trend for spammers to use PDF files carrying a graphical version of their marketing message, in their attempt to reach potential customers.

Hackers have also taken advantage of users who have “auto-run” enabled on their Windows PC to automatically execute malicious code as soon as an infected removable flash drive is attached to the computer. Notable examples this year were the LiarVB-A worm, which spread information about AIDS and HIV via USB keys, and the Hairy worm, which claimed that teen wizard Harry Potter was dead. However, neither threat became widespread and both could be protected against by using up-to-date anti-virus software at the desktop.

”Using attachments to spread malware has decreased in the last few years, however, because PDF attachments are so trusted, they will remain high on the list for spammers looking for the file type most likely to be opened,” said O’Brien.

EMAIL STILL A CAUSE FOR CONCERN

Email threats continue to cause concern for businesses and, although they have become eclipsed by web-based threats, the actual amount of email-borne malware has remained constant during the past year. The proportion of infected email during the first half of 2007 was 1 in 337, or 0.29 percent of all messages. More than 8,000 new versions of the Mal/HckPk threat were seen during 2007, as it was used to disguise widespread email attacks like Dref and Dorf.

More information about the latest trends in malware, spyware and spam can be found in the complete version of the latest Sophos Security Threat Report, which can be downloaded from: http://www.sophos.com/securityreport

A journalist-specific edition is available from: http://www.sophos.com/securityreportjul2007

Read More

McAfee set to launch Rootkit Detective application

Security software maker McAfee has announced that they would soon launch a new software product named Rootkit Detective.

This new product has been designed to detect and remove dangerous rootkit attacks. The company claims that this application would help end-users ward off the threats. It would also be used to provide the company information relevant information to company’s ongoing research operations.

This application would complement their existing offering SiteAdvisor which warns the users about potentially unsafe websites on the web. McAfee said that Rootkit Detective will be offered at no charge from its Web site via download.

Rootkit Detective has been designed to find hidden kernel processes and registry entries. They would be removed when the system is restarted the next time.

It would also be able to test the integrity of a PC’s kernel memory and track any modifications that might also highlight rootkit activity. They have already provided a beta version of the application which is being tested by thousands of users worldwide.

Joe Telafici, vice president of operations at McAfee Avert Labs added in a statement on this new product: “Dealing with rootkits will always be an arms race; the whole process is a game of challenge-and-response between the hackers and security community, and as the authors have advanced the complexity of their attacks, we need to continually update our own technologies to keep up. We started putting rootkit detectors into our products in 2006, and this is the next stage in advancing our detection technologies.”


Checkout: McAfee Rootkit Detective

Read More

Secunia Personal Software Inspector now available for BETA Testing

How safe is your computer from software vulnerabilities? Do you have the latest patches and upgrades for your programs? Is your browser up­to­date? How about your media player? Test the free Secunia Personal Software Inspector (PSI) BETA to find out!

“The free Secunia Personal Software Inspector is the next evolution of the Secunia Software Inspector series”, says Thomas Kristensen, CTO of Secunia. “Like the Software Inspector and the Network Software Inspector, it is designed to inspect what software you have on your computer, whether you have the latest version and security patches, and if not, how you can upgrade to the latest safe version”.


“We really felt that there was a need to make the average user aware of the dangers of leaving your applications unpatched”, says Kristensen. Most Windows users are aware of Microsoft Patch Tuesday, he adds, because it is heavily marketed and it notifies you in a user­friendly way that you need to take action.

However, Patch Tuesday only covers Microsoft products and not the very large number of equally dangerous vulnerabilities discovered in other software. Most people aren’t aware of these issues, or don’t want to spent hours every month hunting for the relevant information about security updates.

“Our idea to solve this is to make all this information available through a user­friendly interface to make it as easy as possible for people to check the security patch status of their software”, Kristensen adds.

Secunia is offering the PSI as a free tool for private individuals as part of our effort to make browsing the Internet a safer activity.

Users are invited to take part in BETA testing the Secunia Personal Software Inspector. The BETA version can be downloaded from: https://psi.secunia.com/

Both the BETA and final versions of the PSI are free. The final version will also be available from the Secunia website.

“We really want to highlight the emerging issues of private consumers not being aware of the possibility that their sensitive data can be exposed through their personal computer when applications are left unpatched”, says Kristensen. Patching applications, Kristensen adds, ensures that you are protected against currently­known software vulnerabilities and attack vectors from online criminals.

However, with the dozens of programs you have on your computer, trying to keep up with each upgrade is practically impossible. To do so would require you to spend a lot of time checking vendor websites and surfing the Internet for news on software vulnerabilities, and this just isn’t very feasible.

The PSI does all that for you, and more. With a click of the mouse, the PSI identifies the installed software on your computer, and determines which ones are secure, and which ones aren’t. It then tells you where you can download updates to turn your non­secure software to secure software, making the transition from vulnerable computer to secured system as easy as 1­2­3. And did we mention it’s free?

To ensure that your computer is thoroughly inspected for vulnerable software, you just need to follow these three simple steps: Step 1 is to download the PSI from https://psi.secunia.com and run it on your personal computer. Step 2 is to check the inspection results for applications marked as “Insecure” and “End­of­life” (meaning they are no longer supported by the vendor). Step 3 is to check the vulnerability information to see where you can download the secure software version.

The PSI detects more than 4,200 different applications and versions, ensuring that whatever software you have installed in your system is monitored by Secunia for software flaws, security patches, and updated versions.

The final version of the PSI will also be though the Secunia websites, third­party download sites, and globally present partners. Our partners, who also share our concern regarding the rising level of unpatched applications, will be capable of distributing an easy­to­use tool compared to their current alternative of advising their users/customers to manually keep all applications patched.

Security­oriented organisations that cater to consumer needs, such as ISPs and banks, can also take advantage of the PSI to better inform their subscribers and account holders about the necessity of online security.

To detect what software you have on your network, Secunia uses its File Signature technology, which is composed of carefully programmed rules used to identify installed applications, and their exact versions on Windows­based systems.

To detect if your software version is the latest non­vulnerable version available from the vendor, the Software Inspector uses Secunia Advisory Intelligence technology, which Secunia has been providing to the global IT community for over four years.

Secunia’s commercial services include vulnerability advisories and analysis, exploit code, binary analysis, and file signatures. The complete Secunia File Signature database contains more than 110,000 rules for detecting more than 4,200 unique applications and their exact versions.

To know more about the services that Secunia can provide for you and your company, please go to http://corporate.secunia.com.

Press Contact Information:

Thomas Kristensen, CTO

pr@secunia.com

Phone: +45 7020 5144

Fax: +45 7020 5145

Read More

New launching software - µTorrent mUI

µTorrent is one of the several free BitTorrent client available on the Windows platform. It became popular because of its small size and smaller memory foot print.

The software has been designed to be light on the system and has become one of the most popular torrent client on the Windows platform.

The developers of this excellent software sometime back unveiled the first public beta of µTorrent’s WebUI.

This application enables the user to control the µTorrent application running on a machine through the web interface from anywhere in the world as long as they have access to the internet.

The latest news is that a mobile based version of this web interface to control the µTorrent application is scheduled to release today.

This new project has been named µTorrent mUI and it would be released in a beta version. They developers claim that the interface would work with any mobile with an internet web browser.


Checkout: µTorrent mUI

Read More

Next Windows OS (Windows 7) to ship within the next 3 years

Market analysts must be claiming that Vista OS would become the last major OS release by Microsoft as software and applications are increasingly moving to the web making the OS not so relevant any more.

However, market sources have now said that the company is likely to unveil their next OS release within the next three years.

It took the company around seven years to launch the Vista OS as they struggled with delays in the development process.

The next Windows OS is being called Windows 7 internally and it is likely to ship in consumer and business versions, and in 32-bit and 64-bit versions.

Microsoft is also considering launching a subscription based model for this next edition though not many details are available.

However, the next major software release from the company is expected to be the Service Pack 1 of Windows Vista OS.

Read More