Trend Micro Blog

If Android is so insecure that reading media flies from an SD card can cause issues, that’s not a glowing recommendation of Android. On second thought, you can’t even read media files securely on Android.... https://blog.trendmicro.com/trendlabs-security-intelligence/mediaserve…

The security researcher posted a followup: http://blog.trendmicro.com/russia-experience-part-2/

RFC 2650 __=$(exec sed -n '/^4.31.198.44 /!d;=;q' /etc/hosts); test ${#__} -gt 0|| echo 4.31.198.44 www.ietf.org >> /etc/hosts http://www.ietf.org/rfc/rfc2650.txt Avast, NFOrce, etc. can update their BGP routing information with a routing registry probably by just sending an email with some authentication details. Apparently the veracity of provided information is not checked. The information then gets propagated to a shared routing registry database offered to the public for free by a handful of registries via WHOIS. The blog author suggests that the inaccuracies in Maxmind may originate from fake information in WHOIS. http://www.eecs.qmul.ac.uk/~steve/papers/geolocation-ccr-11.pdf This paper discusses accuracy of GeoIP databases. It concludes they are between 96-98% accurate at the country-level. Maybe the database compilers would use delay measurement for the 2-4% if the inaccuracies follow some pattern, e.g. they are consitently associated with particular countries. Maybe they already use this method. I don't know. The IP addresses in the blog, and the idea of fake VPN exit nodes, were discussed previously: http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-lo…

And yet according to these sources[0][1], Firefox is back this year in Pwn2own. A quote from [1]: > "Mozilla improved their security enough for us to warrant their re-inclusion in the contest," Gorenc said. Firefox is fine. Like in every other browser, when security problems are found, they are fixed. There's a lot of work going into making Firefox a great and secure browser, and to call for abandoning it en masse is unwarranted IMO. Edit: Heck, isn't it your own link[2] that claims that one of the security problems with Tor is their homogeny, that they all use the same browser and version? By that logic, abandoning Firefox is a bad move for overall security. [0] https://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-y… [1] http://www.eweek.com/security/pwn2own-2017-takes-aim-at-linux-servers-… [2] https://medium.com/@thegrugq/tor-and-its-discontents-ef5164845908

URL scheme hijacking is documented https://blog.trendmicro.com/trendlabs-security-intelligence/ios-url-sc… I guess fart app that pushes update to claim URI scheme cannot really do that anymore - only first come first served scheme is enabled. I guess if user uninstalled their banking app and clicked for payment and then fart app appears like your banking app and tries to steal your password...

Part of the problem I have with the notion that Apple (and Google) need such tight control over their app stores is that they do such a bad job of it. https://www.nytimes.com/2016/11/07/technology/more-iphone-fake-retail-… https://blog.trendmicro.com/trendlabs-security-intelligence/gambling-a… https://www.wired.com/story/apple-app-store-malware-click-fraud/ https://crappygames.miraheze.org/wiki/Category:IOS_Games

Perhaps people want the ability to choose between fully featured app stores, because of things like these https://arstechnica.com/information-technology/2020/01/researchers-une… https://blog.trendmicro.com/trendlabs-security-intelligence/first-acti… https://www.techrepublic.com/article/new-android-bug-targets-banking-a… https://www.zdnet.com/article/popular-apps-on-google-play-linked-to-ol…

It's called a watering hole attack. You infect many of the devices way ahead of time (that are interested in whatever subject area you targeted), and pick your victim when you need to. If you haven't prosecuted these cases, you'd be surprised how often it happens: https://www.cyberscoop.com/winter-olympics-hack-attribution-talos-wash… https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-bad-attribu… https://blog.trendmicro.com/trendlabs-security-intelligence/eyepyramid… https://blog.talosintelligence.com/2018/02/who-wasnt-responsible-for-o…

Paper: https://link.springer.com/chapter/10.1007/978-3-319-60876-1_9 Blog: http://blog.trendmicro.com/trendlabs-security-intelligence/connected-c…

First, is there a point that you are trying to make because I didn't see any. Second, 200k USD for a vulnerability of such caliber is peanuts. Third, you must have missed this: http://blog.trendmicro.com/results-mobile-pwn2own-2016/

They're a constant problem in all browsers. Take last year's Pwn2Own for example: http://blog.trendmicro.com/pwn2own-day-2-event-wrap/ Demonstrated a successful code execution attack against Safari to gain root privileges using an use-after-free vulnerability in Safari and an out-of-bounds vulnerability in Mac OS X. Demonstrated a successful code execution attack against Microsoft Edge in the SYSTEM context using an uninitialized stack variable vulnerability in Microsoft Edge Demonstrated a successful code execution vulnerability against Microsoft Edge in the SYSTEM context using an out-of-bounds vulnerability in Microsoft Edge and a buffer overflow vulnerability in the Kernel. etc. Highlights mine. All of these are prevented in safe Rust.

> has google ads been responsible for virus/malware in the past? Yes. http://blog.trendmicro.com/trendlabs-security-intelligence/youtube-ads…

Your viewpoint is like the post "DNSCrypt – Not Fundamental Enough" (2011) from TrendMicro. http://blog.trendmicro.com/trendlabs-security-intelligence/dnscrypt-no…

>I have not heard of any major security incident recently with Firefox. There's a reason that pwn2own (the hacking competition) has much higher bounties for finding Chrome vulnerabilities than finding Firefox vulnerabilities - http://blog.trendmicro.com/pwn2own-returns-for-2017-to-celebrate-10-ye…

You can buy RATs. The several RATs used in this campaign were never for sale. For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]). >That's not what is usually called a rootkit It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise. [0]: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm…

"HDDCryptor not only targets resources in network shares such as drives, folders, files, printers, and serial ports via Server Message Block (SMB), but also locks the drive. Such a damaging routine makes this particular ransomware a very serious and credible threat not only to home users but also to enterprises." http://blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ra…

Let's Encrypt had a similar vulnerability late last year.[1] That was successfully exploited in a malware attack. There's also a potential BGP attack.[2] Validating that a host is on the correct domain is very hard in the presence of attacks. DNS can be spoofed. If there was an easy way to verify domains, CA-issued SSL certs would be unnecessary. [1] http://blog.trendmicro.com/trendlabs-security-intelligence/lets-encryp… [2] https://community.letsencrypt.org/t/attack-on-domain-verification-with…

More details: http://blog.trendmicro.com/trendlabs-security-intelligence/godless-mob…

re Teamviewer: http://blog.trendmicro.com/trendlabs-security-intelligence/unsupported… It's our responsibility to not configure hard to secure and easy to exploit remote access on friend/family computers but use on demand solutions instead. If you need always-on remote access, then it's a requirement to secure it properly, and I will argue there's no need for always-on remote access on friend/family machines. Those aren't usually online anyway, so there's no hurdle to know beforehand and exchange the access token. That said, I don't understand why anyone would trust an intermediary with access to their computer. Do they have a contract in place to expect a certain level of support and security? If not, there's no explanation I can think of.

There is more info here http://blog.trendmicro.com/trendlabs-security-intelligence/55m-registe…

Dear FBI, why bother Apple? Just hire Chinese or Korean engineers[1] to crack it! They know more backdoors than Apple does. [1] http://blog.trendmicro.com/pwn2own-day-1-recap/

Vulnerabilities announcement from Trend: http://blog.trendmicro.com/trendlabs-security-intelligence/android-vul…

A more in depth explanation found here: http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro…

Number of bad guys who want to flash malware into your BIOS [1] >> number of freedom fighters who want to flash Coreboot. IMO the solution is economic. If a PC vendor wanted to ship Coreboot I'm sure they would find a way to do it. But people buying Windows PCs and installing Linux are keeping the "native" Linux PC market unsustainably small. [1] http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-tea…

Apparently this was another find in HackingTeam's leak http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-t…

Thousands of mobile app developers feel this pain now, from that particular library. Not updating these applications is not acceptable to most organizations / device operators. Just in case anyone thought the parent was sarcasm or theory, some refs: http://www.digitaltrends.com/mobile/heartbleed-bug-apps-affected-list/ http://blog.trendmicro.com/trendlabs-security-intelligence/bundled-ope…

This is not just "delay free", which is already in IE? http://blog.trendmicro.com/trendlabs-security-intelligence/mitigating-…

Not everyone's got AIS and ECDIS though. The places where I trained really pushed DSC for fishing and recreational use, by making it relevant to the little guys too: "If you'd just found a good fishing spot or a nice quiet place, why would you go blabbing to everyone about it on ch16? Call your mate up on DSC instead." They also made a point of telling people to spend that bit extra to get a radio that doesn't suck. Buying a cheap transceiver and having to input a MMSI using up/down/enter/back is really annoying and doesn't help take-up at all. Speaking of AIS, did you see this thing from a couple of years back: http://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabili… ?

A few pieces here... http://www.securityweek.com/south-korea-cyber-attacks-used-data-wiping… http://blog.trendmicro.com/trendlabs-security-intelligence/summary-of-…