Month: March 2017

IndependentSecuriteam

Know your community – Veronique Loquet

Credit to Author: Maor Schwartz| Date: Wed, 29 Mar 2017 11:27:56 +0000

Veronique Loquet is the proud owner of AL’X Communication, No Such Con Co-founder, Security Vacation Club member and infosec enthusiastic! Questions Q: How many years have you been working in the security field? A: I have been in the security field since 2002. Q: What was your motivation for getting into the security field in … Continue reading Know your community – Veronique Loquet

Read More
ComputerWorldIndependent

New Mirai IoT variant launched 54-hour DDoS attack against a U.S. college

Credit to Author: Darlene Storm| Date: Wed, 29 Mar 2017 08:10:00 -0700

A new variant of the Mirai IoT malware was spotted in the wild when it launched a 54-hour DDoS attack against an unnamed U.S. college.

While the attack occurred on February 28, Imperva Incapsula is informing the world about it today. The researchers believe it is a new variant of Mirai, one that is “more adept at launching application layer assaults.”

The average traffic flow was 30,000 requests per second (RPS) and peaked at about 37,000 RPS, which the DDoS mitigation firm said was the most it has seen out of any Mirai botnet so far. “In total, the attack generated over 2.8 billion requests.”

To read this article in full or to leave a comment, please click here

Read More
FortinetSecurity

Microsoft Word File Spreads Malware Targeting Both Mac OS X and Windows (Part II)

Credit to Author: Chris Navarrete & Xiaopeng Zhang| Date: Wed, 29 Mar 2017 12:29:47 -0700

In the blog we posted on March 22, FortiGuard Labs introduced a new Word Macro malware sample that targets both Apple Mac OS X and Microsoft Windows. After deeper investigation of this malware sample, we can confirm that after a successful infection the post-exploitation agent Meterpreter is run on the infected Mac OS X or Windows system. Meterpreter is part of the Metasploit framework. More information about Meterpreter can be found here. For this to work, the attacker’s server must be running Metasploit as the controller to control the…

Read More
ComputerWorldIndependent

Trojan source code leak poised to spur new online banking attacks

Credit to Author: Lucian Constantin| Date: Wed, 29 Mar 2017 10:55:00 -0700

The source code for a new Trojan program that targets banking services has been published online, offering an easy way for unskilled cybercriminals to launch potent malware attacks against users.

The Trojan is called Nuclear Bot and first appeared for sale on underground cybercrime forums in early December for $2,500. It can steal and inject information from and into websites opened in Mozilla Firefox, Internet Explorer and Google Chrome and can also open a local proxy or hidden remote desktop service.

These are all features commonly seen in banking Trojans, as they’re used by attackers to bypass the security checks of online bank websites to perform fraud. For example, the proxy and remote desktop functionality allows hackers to initiate rogue transactions through the victims’ browsers after they have been tricked into providing the second authentication factor.

To read this article in full or to leave a comment, please click here

Read More