F-Secure Blog

So excellent that some malware deletes itself if Little Snitch is even installed (https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_a.sht… However, it's worth noting "DYLD_PRINT_TO_FILE" is a root exploit, which may circumvent or disable Little Snitch entirely if used by APT; Little Snitch may not see all network activity. In fact, a root exploit allows one to write malware completely hidden from userland altogether (lsof, ps, tcpdump, etc.) (https://github.com/hackedteam/driver-macos). It is truly scary how vulnerable OS X is at the moment.

This is HN. Can we skip the blogspam and link directly to F-Secure? There is nothing of value in the blog post. Actual content: http://www.f-secure.com/weblog/archives/00002256.html It's important to note that this is a trojan virus, which means the user must download and run it. It would be far more significant if this were a drive-by attack. One interesting item I noticed in the information about the trojan itself is this bit: ===QUOTE=== On installation, the installer first checks if the following file is found in the system: * /Library/Little Snitch/lsd Little Snitch is a firewall program for Mac OS X. If the program is found, the installer will skip the rest of its routine and proceed to delete itself. ===QUOTE=== So if you're running Little Snitch, this trojan deletes itself. Effective.

I wasn’t really aware of computer viruses until the early 2000s when viruses such as Nimda and ILOVEYOU got a lot of attention so I find it interesting to learn that computer viruses were causing problems in the 80s when the world wasn’t half as connected as it was by the end of the millenium. There’s not much technical details included in this news report video It mentions two logic bombs that are activated on Friday 13th and shows how one of these viruses (I’m guessing “Data Crime”) caused damaged to the UK’s Royal National Institute for the Blind which, at the time, was helping blind people use computers. This Computer Knowledge article on the 1989 Datacrime virus [1] has more information: > … on any day after October 12th, it would trigger a low level format of cylinder zero of the hard disk, which would, on most hard disks, wipe out the File Allocation Table, and leave the user effectively without any data. It would also display the virus’ name: Datacrime virus. It looks like the 1989 “Data crime” virus was not notable enough to be included in Wikipedia’s Timeline of computer viruses and worms [2] – though the Jerusalem virus is included under 1987: > The Jerusalem virus, part of the (at that time unknown) Suriv family, is detected in the city of Jerusalem. The virus destroys all executable files on infected machines upon every occurrence of Friday the 13th (except Friday 13 November 1987 making its first trigger date May 13, 1988). Jerusalem caused a worldwide…

I miss Delphi as well even though I never got to use it for anything professional as I was very young at the time. However I do remember very fondly how I came to know about Delphi 2 (or 3?). Somehow I met this guy in ICQ and started talking about programming and about these (back then) very popular programs for "hacking" your friends: Back Orifice, Netbus, Sub7, etc. when he then says that he's actually developing his very own trojan tool called "Hacker's Paradise". Long story short, at some point he sends me the source code and starts to explain to me how it works. Some time later time he realizes that there's much more future in actually developing a tool for sysadmins so he renames the tool "Master's Paradise"[1] and starts trying to sell it. Sadly, I never knew or heard from him again, but I love that story because I was around 10 or 12 at the time and it seemed like magic to me be able to open the Delphi editor, drag and drop some buttons and have a fully functional Windows program at my fingertips. Just beautiful. Also, the fact that I was getting source code from a stranger over the internet for a tool that would do such "magical" things as opening and closing the cd-rom tray of whoever you had the chance to infect, made me feel like part of the super elite hacker world (ha!). [1]Now classified by antivirus programs not as a virus but as a backdoor tool: https://www.f-secure.com/v-descs/paradise.shtml

I'd say definitely: https://www.f-secure.com/v-descs/exploit_w32_jpg_vulnerability.shtml

F-Secure did, https://www.f-secure.com/en/consulting/foundry/usb-armory Unless we now start the semantic debate if a Unikernel is an OS.

Your question implies that the yubikey is an HSM. It isn't. It has a secure element. If you want to implement your own novel test of user presence, you could get an F-Secure USB armory device (https://www.f-secure.com/en/consulting/foundry/usb-armory) and tap into the GPIO.

Related... enables you to build your own Trezor/Ledger secure wallet... https://www.f-secure.com/en/consulting/foundry/usb-armory

Sure, I know it's not a contender for significant monetary damages, but I was disappointed not to see the Happy Birthday Shankar virus on the list. [0] In my early tech days riding the helpdesk in college, I'd heard about it and half thought it an urban legend. Then it hit campus, and I had to clean about a half dozen systems. Not a complex process, and more fun than most given that I could admonish the user, "You really should have wished Shankar a happy birthday." [0]https://www.f-secure.com/v-descs/marker.shtml

Seems pretty naive to risk jail timeover the commercial claims of some internet company... I use a vpn to reduce tracking and keep my ISP in the dark - and so have gravitated to the names in the space that seem to be more solid corporate citizens F-secure - https://www.f-secure.com/en/web/home_global/freedome Proton Tech - https://protonvpn.com

Professional poker players have been dealing with this type of risk for years. Major poker tournaments present a juicy target for organised hacking gangs. A high-stakes pro might have tens or hundreds of thousands of dollars deposited in their PokerStars account. Hundreds of professional players in a tournament cardroom means hundreds of very valuable laptops left in hotel rooms. The most sensible precautions seem to be a) full-disk encryption with a strong passphrase, b) hardware 2fa using a token that is stored separately from the computer, c) physically securing the machine whenever possible and d) tamper-evident seals covering screwholes or seams. If your adversary is capable of beating these precautions, you're probably screwed anyway. https://www.f-secure.com/weblog/archives/00002647.html

If you must use AV, better look for AV solutions with clear written policies on the information they collect https://www.f-secure.com/en/web/legal/privacy/security-cloud

I like Freedome from F-Secure pretty user friendly so it actually gets used... https://www.f-secure.com/en/web/home_global/freedome

Freedome (https://www.f-secure.com/en/web/home_global/freedome) is my go to

Not animated but I have been struck by the music bug virus[1]. Given hacker's egos and sense of humor I wouldn't be surprised for a moment by a animated singing virus. [1] https://www.f-secure.com/v-descs/musicbug.shtml

I've been using Freedome[0] for a few months now and I am really liking it. While I don't use it to escape censorship and digital embargos it's adequate for such purposes too. You can pick from exit IPs all over the world and easily switch it. I run all my traffic through Finland usually because they have fairly strong data protection laws, especially compared to the UK where I live. It's also a nice way to get around traffic shaping and other invasive measures from your ISP. During peak hours I have better speeds for Netflix and the likes through Finland than without VPN. 0: https://www.f-secure.com/en_GB/web/home_gb/freedome

JPEG exploit: https://www.f-secure.com/v-descs/ms04-028.shtml

Before OSX 10.10.2, apparently there was a "heartbleed" style info leak in spotlight where it "may save unexpected information to an external hard drive", according to http://support.apple.com/en-us/HT204244 (CVE-2014-8832). Probably related to this report: https://www.f-secure.com/weblog/archives/00002752.html

"As always, attribution is difficult with cases like this. Our belief is that this malware, for a change, isn't coming from Russia or China." https://www.f-secure.com/weblog/archives/00002766.html "Securelist - Regin: Nation-state ownage of GSM networks" http://securelist.com/blog/research/67741/regin-nation-state-ownage-of…

To see if you haven't got it: In terminal run: defaults read /Applications/Safari.app/Contents/Info LSEnvironment You should get this error: The domain/default pair of (/Applications/Safari.app/Contents/Info, LSEnvironment) does not exist Then run: defaults read ~/.MacOSX/environment DYLD_INSERT_LIBRARIES You should get this error: The domain/default pair of (/Users/YOURUSER/.MacOSX/environment, DYLD_INSERT_LIBRARIES) does not exist If you do you are clean of this variant! If this doesn't happen go to http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtm… to fix it

i'm only familiar with f-secure but imagine any av vendor would have something like this(but yea, what if system files were infected?)? https://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/v…

Facebook must be one of the only large sites that hasn't been hit directly with serving malware, closest I can recall are incidents like this: http://www.f-secure.com/weblog/archives/00002172.html

Q: Disabling AutoRun in Windows will stop USB worms, right? A: Wrong. There are several other spreading mechanisms USB worms use. The LNK vulnerability used by Stuxnet would infect you even if AutoRun and AutoPlay were disabled. http://www.f-secure.com/weblog/archives/00002040.html

Q: How could governments get something so complex right? A: Trick question. Nice. Next question. -http://www.f-secure.com/weblog/archives/00002040.html

Vulnerability numbers alone do not accurately convey the mobile security landscape. To start with, even if those mean something, we must consider that Android devices tend to lag behind in terms of receiving OS updates. By contrast, iOS devices tend to be quickly updated. It is widely known that iOS is far more secure in the practical sense for the average user. Report: http://www.f-secure.com/static/doc/labs_global/Research/Mobile%20Threa…

Mikko Hypponen, from F-Secure. http://mikko.hypponen.com/ http://www.f-secure.com/weblog/

Check out Mikko Hypponen's company weblog (http://www.f-secure.com/weblog/), they have a lot of posts on different cybersecurity related incidents and go into detail about them. I find it is far more fascinating to read then a lot of the news media coverage.

Found the info, interesting. Easy to think plain text is safe and forget about the parser. http://www.f-secure.com/weblog/archives/00001777.html http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html

I think the recent Flashback.K qualifies to some degree. All you had to do is visit an infected webpage and the Java applet would walk onto your system. It would immediately ask for admin privileges, but due to the huge Java hole it would have your user privs automatically. Since OSX enabled Java by default, and since responsible practices were no defense, this compromised enough Macs that it was proportionally comparable to the Conficker infection on Windows. http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_k.shtm… http://en.wikipedia.org/wiki/Trojan_BackDoor.Flashback

F-Secure claims that this /would/ allow forgery of Windows Updates (!!): http://www.f-secure.com/weblog/archives/00002377.html "...Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update system..."