FBI to kill servers supporting DNSChanger virus victims

Hundreds of thousands of people around the world could lose access to the Internet on July 9 when the FBI plans to kill temporary servers servicing victims of a virus. That virus is called DNSChanger, and the FBI plans to shut down the temporary DNS servers that were being used to assist victims of the Internet theft ring. Any computer that still uses the servers won’t be able to go online starting July 9.

Before people with infected systems will be able to get back online, they will have to clear the computer of the DNSChanger virus. The shutdown of the temporary servers is the final move in an FBI operation called Ghost Click that spanned two years and officially ended in November 2011. The virus changed victim’s DNS servers, routing them to websites of the hacker’s choosing.

Some of those websites were fraudulent in nature according to authorities. Six Estonians behind the fraud ring were arrested by the FBI during the course of the investigation. The virus was originally disseminated via traditional channels, including e-mail and malware. The FBI had replaced the hacker’s nefarious servers with “clean” servers to keep PCs infected by the virus online.

[via CBC]


FBI to kill servers supporting DNSChanger virus victims is written by Shane McGlaun & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.


Android botnet discovered

While malware on Android isn’t exactly unheard of, it looks like there’s more than meets the eye. A Microsoft researcher recently came across some interesting spam emails that were delivered via Yahoo! Mail servers. In addition to being sent from their servers, he noticed that the emails also originated from Android devices. With this info, he came to the conclusion that a spammer has control of a botnet that lives on Android devices.
(more…)

By Ubergizmo. Related articles: DroidKungFu malware evolved into LeNa, Bogus Netflix Android app steals login credentials,

Yahoo! email spam linked to Android botnet

Malware has increasingly become a problem for Android, with most malicious apps intended to send premium text messages in the background that will rack up a nasty phone bill. Android might also be used to setup botnets and send spam emails, according to Terry Zinck’s blog on MSDN. He discovered that standard spam email messages were being sent from Yahoo! Mail servers on Android devices.

Zinck took a closer look at the header information and signatures that were being sent out with the spam. All the messages come from compromised Yahoo! accounts and sent through Yahoo! Mail servers, and all also seem to finish with the “Sent from Yahoo! Mail on Android” signature. Zinck postulates that a hacker has developed a botnet that can access Yahoo! Mail accounts on Android devices and send spam messages as a result.

Yahoo! does provide the IP address of where the emails came from, with origin countries including Chile, Indonesia, Lebanon, Oman, Philippines, Russia, Saudi Arabia, Thailand, Ukraine, and Venezuela. The odds of downloading a malicious app on the Play Store are extremely low, so Zinck believes that users are tracking down pirated versions of apps to avoid paying, or have acquired a fake version of the Yahoo! Mail app.


Yahoo! email spam linked to Android botnet is written by Ben Kersey & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.


Is Someone Trying to Hack the Dalai Lama? [Security]

If you didn’t know, the Dalai Lama is a Mac user. He also happens to be an advocate for an ethnic Turkish group spread throughout Eastern and Central Asia who are embroiled in a human rights battle with the Chinese government. The combination of these two factors have security firm Kaspersky Labs believing that a new backdoor exploit found on Macs is targeted specifically towards his high holiness and Uyghur people he’s advocating for. More »