Cyber criminals move beyond Windows

ORGANISED criminals involved in cyber attacks aimed at stealing IDs and money are moving beyond Windows, and are for the first time knocking loudly at the doors of Macintosh and Linus-based systems, experts warn.

Tech security and control firm Sophos has published in its Security Threat Report 2008 found Apple was a significant target of criminal hackers in 2007, and that the threat would expand in 2008.

While Malware for Macs has been seen before, the Sophos reports that malicious code seemed for the first time to have been written by financially-motivated hackers who saw an opportunity.

“No-one should underestimate the significance of financially-motivated malware arriving for Apple Macs at the end of 2007,” Sophos senior technology consultant Graham Cluley said.

“Although Macs have a long way to go in the popularity stakes before they overtake PCs, particularly in the workplace, their increased attractiveness to consumers has proven irresistible to some criminal cybergangs.,” Mr Cluley said.

The Sophos' Threat Report also reveals that the wider use of new mobile technologies and wi-fi enabled devices, like the iPhone and iPod Touch, may be opening up new vectors of attack for hackers.

Flaws have been found in the mobile email program and Safari browser installed on such devices. But while uptake remains limited cyber-criminals are unlikely to exploit these avenues on a major scale in the near future. However, as personal wi-fi devices grow in popularity, the risks will no doubt increase.

Sophos experts also said that the low cost ultra-mobile PCs, such as the popular Linux-based ASUS EEE laptop, will gain the attention of the cyber underworld as sales continue to grow.

“The ultra-mobile ASUS EEE laptop, like many others, comes pre-installed with Unix, making it automatically immune to the vast majority of spyware and malware attacks,” Mr Cluley said.

For more IT Security news, click here.

Malware incidents double in 2007

EUROPEAN tech security specialist F-Secure has reported it has detected as many malware signatures during 2007 as it had in the entire preceding 20 years.

And the company is predicting a miserable 2008, with malware volumes continuing to increase as criminals successfully create a network-based underground ecosystem, trading malware development tools, skills, capabilities and resources.

F-Secure says in its 2007 Data Security Wrap-Up that it has identified a total about 500,000 malware signatures in its cumulative database – compared to 250,000 a year ago. The number of examples of malware had doubled in just one year.

“We've never seen as many samples arrive to our labs,” F-Secure Corporation Chief Research Officer Mikko Hypponen said.

“We would be unable to handle such huge samples loads if we would not have built a high degree of automation into our malware analysis systems over the past years,” he said.

The company said that while no truly new malware technologies were seen the existing ones were refined and adapted for much greater effectiveness.

Financial transactions remain a favorite target for network crime. The amount of phishing sites continues to increase, but as bank customers have become more aware of this threat the criminals have started employing more sophisticated techniques.

For more IT Security news, click here.

Sharp rise in global malware threat: Sophos

NEW figures compiled by security vendor Sophos’ global network of monitoring stations has found a further sharp rise in web-based virus threats – with 80 per cent of the threats located on hacked legitimate sites.

Sophos uncovered an average of 29,700 new infected web pages every day.

The research for June puts the Iframe malware as by far the most prevalent web-based threat, making up 64 per cent of all threats during the month.

Earlier this month, an Iframe attack on multiple Italian web sites occurred, making headlines around the world. More than 10,000 web pages were infected, most of which were on legitimate but compromised web sites hosted in Italy.

Victim web sites included Italian city councils, employment services and tourism sites. Most of the affected pages appear to be hosted by one of the largest ISPs in Italy.

“The Italian Iframe attack should certainly act as a wake-up call to ISPs across the globe,” said Sophos senior security consultant Carole Theriault.

“Malicious code dumped on these web sites is just waiting to pounce on innocent surfers. Web sites should be as secure as Fort Knox, but at the moment, too many web pages are easy pickings for cybercriminals,” Ms Theriault said.

Nearly 60 per cent of malware-infected web pages in June were hosted in China, while 24 per cent were hosted in the US.

For more Business Software news, click here.

Bogus email declares PM dead, infects computer

AN email widely circulating in Australia that links to a bogus news report claiming Prime Minister John Howard had suffered a heart attack is being used to spread a malicious computer virus, experts have warned.

Global security firm Sophos has issued a global warning to users to be wary of unsolicited emails posing as breaking news reports.

The comes after the widespread distribution of a message which claims Mr Howard was in Sydney’s Royal North Shore Hospital fighting for his life after a heart attack suffered at Kirribilli House.

The emails pretend to link to a story from The Australian newspaper. The bogus news story points to a web site containing malicious code.

Clicking on the link takes users to a web page which downloads malicious code into their PC, and then displays the real ‘404 page not found’ error page used by The Australian on the news.com.au site.

The Prime Minister is the latest in a long line of public figures to be used by malware authors and hackers. Politicians like George W Bush, Arnold Schwarenegger, Ronald Reagan and Bill Clinton have been used in the past.

“It seems the hackers are back to their old tricks of spamming out sensational headlines in the hope that computer users will forget to think before they click, and visit the website hosting the malignant code,” said Sophos senior technology consultant Graham Cluley.

For more IT Security news click here.