Adobe Flash Player to Be Retired in 2020

/in

Adobe Systems’s Flash, a once-ubiquitous technology used to power most of the media content found online, will be retired at the end of 2020, the software company announced Tuesday.

Adobe, along with partners Apple, Microsoft, Alphabet Inc’s Google, Facebook and Mozilla, said support for Flash will ramp down across the Internet in phases over the next three years.

After 2020, Adobe will stop releasing updates for Flash and Web browsers will no longer support it. The companies are encouraging developers to migrate their software onto modern programming standards.

“Few technologies have had such a profound and positive impact in the Internet era,” said Govind Balakrishnan, vice president of product development for Adobe Creative Cloud.

Created more than 20 years ago, Flash was once the preferred software used by developers to create games, video players and applications capable of running on multiple Web browsers. When Adobe acquired Flash in its 2005 purchase of Macromedia, the technology was on more than 98 percent of personal computers connected to the web, Macromedia said at the time.

But Flash’s popularity began to wane after Apple’s decision not to support it on the iPhone.

In a public letter in 2010, late Apple CEO Steve Jobs criticized Flash’s reliability, security and performance. Since then, other technologies like HTML5 have emerged as alternatives to Flash.

In the past year, several Web browsers have begun to require users to enable Flash before running it.

On Google’s Chrome, the most popular Web browser, Flash’s usage has already fallen drastically. In 2014, Flash was used each day by 80 percent of desktop users. That number is now at 17 percent “and continues to decline,” Google said in a blog Tuesday.

“This trend reveals that sites are migrating to open Web technologies, which are faster and more power-efficient than Flash,” Google said. “They’re also more secure.”

Flash, however, remains in use among some online gamers. Adobe said it will work with Facebook as well as Unity Technologies and Epic Games to help developers migrate their games.

Adobe said it does not expect Flash’s sunset to have an impact on its bottom line. “In fact, we think the opportunity for Adobe is greater in a post-Flash world,” Balakrishnan said.

Gadgets 360

Mac Computers Hacked With ‘FruitFly’ Surveillance Malware

/in , ,

American Apple Mac computers have been hacked with FruitFly malware, Forbes reports.

The hack is thought to be for surveillance as hackers were able to jump into the webcams of the affected computers and take screenshots, though the FruitFly malware has the ability to take over the entire computer.

“This didn’t look like cybercrime type behaviour, there were no ads, no keyloggers, or ransomware,” said Patrick Wardle, cybersecurity researcher, via Forbes. “Its features had looked like they were actions that would support interactivity: it had the ability to alert the attacker when users were active on the computer, it could simulate mouse clicks and keyboard events.”

This isn’t the first time that FruitFly is making a hacking appearance. Earlier this year, it was used to target biomedical research centers.

“The only reason I can think of that this malware hasn’t been spotted before now is that it is being used in very tightly targeted attacks, limiting its exposure,” wrote Thomas Reed, MalwareBytes researcher. “Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.”

FruitFly is difficult to detect. Not much is known about the malware.

Microsoft is preparing to kill off Paint after 32 years

/in ,

Microsoft has revealed that the graphics editing app is no longer “in active development”, and may be removed from Windows altogether.

Paint was introduced back in 1985, and has featured on every version of Microsoft’s computer operating system.

Though it was never the most capable program, it was easy to use and familiar to millions of people, many of whom used it as their main source of digital fun before going online.

The company has published a support document listing a number of Windows features that are set to be killed off.

“The following features and functionalities in the Windows 10 Fall Creators Update are either removed from the product in the current release (“Removed”) or are not in active development and might be removed in future releases (“Deprecated”),” Microsoft says.

“This list is intended to help customers consider these removals and deprecations for their own planning.”

Paint would be the biggest casualty by far, though it might yet survive, as Microsoft says “the list is subject to change and may not include every deprecated feature or functionality”.

Paint 3D, a modern version of the app, was introduced earlier this year, but Microsoft decided to make it available alongside regular Paint, rather than instead if it.

3D Builder app, Apndatabase.xml, Enhanced Mitigation Experience Toolkit (EMET), Outlook Express, Reader app, Reading List, Screen saver functionality in Themes, Syskey.exe, TCP Offload Engine, Tile Data Layer and Trusted Platform Module (TPM) Owner Password Management will be removed from Windows 10 when the the Fall Creators Update arrives – most likely in September.

Along with Paint, IIS 6 Management Compatibility, IIS Digest Authentication, RSA/AES Encryption for IIS, Sync Your Settings, System Image Backup (SIB) Solution, TLS RC4 Ciphers, Trusted Platform Module (TPM): TPM.msc and TPM Remote Management, Trusted Platform Module (TPM) Remote Management, Windows Hello for Business deployment that uses System Center Configuration Manager and Windows PowerShell 2.0 have also been marked as Deprecated.

independent

This cheap password-stealing malware just added to your security headaches

/in ,

A new form of credential-stealing malware — complete with slick marketing and support from its authors — is available for as little as $7, providing wannabes with a worryingly easy entry point into the world of cybercrime.

First appearing a month ago, Ovidiy Stealer is regularly updated by its Russian-speaking authors and the malware has hit targets around the world including the UK, the Netherlands, India, and Russia.

Despite its low price of 450-750 Rubles ($7-13), the malware comes with code designed to avoid analysis and detection.

Uncovered by researchers at Proofpoint, the malware is spread via a number of methods, including malicious email attachments, file-hosting websites, and even within software packages.

It comes with functionality to target multiple applications, but buyers are able to purchase a version of the malware which only focuses on a single browser if they so wish.

If the malware is able to find passwords in its targeted applications, it will send them to the gang using it, putting the victim and their organisation at risk of compromise, especially if the same password is used across multiple accounts.

Ovidiy Stealer is openly sold on a domain which boasts support and features — including the ability to view statistics and logs of infected machines — to potential customers. Payment for the malware is taken by RoboKassa, the Russian equivalent of PayPal.

In order to help drive sales in the competitive criminal world of malware, the developers include statistics and detail plans for future releases of Ovidiy Stealer.

ovidiy-stealer-reviews.png
Reviews help Ovidiy Stealer look appealing to potential buyers.Image: Proofpoint

While Ovidiy Stealer isn’t advanced, the marketing and advertising around it, combined with a low price, could make it very attractive to wannabe cybercriminals who might not otherwise have the expertise to get involved.

“Ovidiy Stealer highlights the manner in the cybercrime marketplace drives innovation and new entrants and challenges organizations that must keep pace with the latest threats to their users, their data, and their systems,” said Proofpoint researchers.

While many cybercriminal operations are run by highly sophisticated gangs which do not sell their products to outsiders, there’s a growing market for ‘cybercrime-as-a-service’ schemes which provide low-level criminals with all the tools they need to get started, in return for a cut of the profits.

ZDNet

Hackers use NSA’s leaked EternalBlue exploit to power more malicious payloads

/in ,

Hackers are expanding the use of EternalBlue, the leaked NSA hacking exploit that was thrust into the spotlight in May with its initial use in the WannaCry ransomware and Adylkuzz cryptocurrencyminer.

Security researchers have now found threat actors exploiting the vulnerability in Microsoft Server Message Block (SMB) protocol to distribute other malicious payloads including Backdoor.Nitol and Trojan Gh0st RAT.

Backdoor.Nitol is a Trojan horse that opens a backdoor on the infected computer. Gh0st RAT is a remote access trojan that has been making the rounds for years to target Windows machines and is capable of giving attackers full access and control of an infected machine. It has also been used in extensive cyber espionage and data stealing campaigns.

According to security firm FireEye, both the well-known payloads have been previously used in cyberattacks targeting the aerospace and defence industry with Gh0st RAT targeting government agencies and activists as well.

“We observed lab machines vulnerable to the SMB exploit were attacked by a threat actor using the EternalBlue exploit to gain shell access to the machine,” FireEye researchers said in blogpost. “The initial exploit technique used at the SMB level is similar to what we have been seen in WannaCry campaigns.

“However, once a machine is successfully infected, this particular attack opens a shell to write instructions into a VBScript file and then executes it to fetch the payload on another server.”

Researchers said the combination of EternalBlue and VBScript has been used to distribute Gh0st RAT in Singapore and Backdoor.Nitol in the South Asia region.

EternalBlue came as part of the cache of alleged NSA hacking tools released by notorious hacking group Shadow Brokers in April.

Security researchers warned that with EternalBlue exploit now released and available for any threat actors to target, it is likely that it will be used in new sophisticated and more frequent cyberattacks.

“The addition of the EternalBlue exploit to Metasploit has made it easy for threat actors to exploit these vulnerabilities,” FireEye said. “In the coming weeks and months, we expect to see more attackers leveraging these vulnerabilities and to spread such infections with different payloads.

“It is critical that Microsoft Windows users patch their machines and update to the latest software versions as soon as possible.”

IBTimes

Samsung releases SoundAssistant app for improved audio experience on Galaxy phones

/in ,


Samsung has launched a new app to allow Samsung Galaxy owners to customize a wealth of audio settings on their devices.

Known as SoundAssistant, the app offers “150 steps” of volume adjustment, a floating EQ, mono and stereo balancing, as well as the chance to set individual volumes for different apps.

What’s more, SoundAssistant can alter the hardware volume keys so that they default to media volume control rather than call volume. Typically, these keys will automatically switch to control whatever sound is playing at the time, but this can be a little finicky and doesn’t always adjust the desired setting. As a person who usually has their phone on silent, though, having it default to media volume would be far more useful than call volume.

If you own a Galaxy S8 or S8 Plus, SoundAssistant can even allow you to set different outputs for different apps, like using a Bluetooth speaker for Spotify and the phone’s speaker for Clash of Clans.

On paper, the app looks like it could be a useful tool and I expect that many Android users would appreciate the features it offers: here’s hoping Samsung opens it up to non-Galaxy devices sometime (and non-Android 7.0 Nougat devices, as that’s another current restriction).

You can download SoundAssistant via the link below and let us know in the comments what your favorite Android audio customization tool is.

DOWNLOAD SAMSUNG SOUNDASSISTANT

Android Authority

Interconnected smart toys “can be weaponised”

/in , ,

An audience of security experts attending a cybersecurity conference at the World Forum in The Hague (The Netherlands) on Tuesday were shocked when a demonstration done by an 11-year-old “cyber ninja” showed the dismal cyber security standards that are prevailing in technology. He hacked into the Bluetooth devices to manipulate a teddy bear and show how interconnected smart toys “can be weaponised”.

The wonder kid in question is American Reuben Paul, a cyber security expert and white hat hacker who’s currently studying in the sixth standard of a school in Austin, Texas. Techworm had reported about the hacking skills of Reuben way back in 2015 when he warned an audience about the dangers of smartphone hacking while delivering a keynote address as a 9-year-old.

“From airplanes to automobiles, from smartphones to smart homes, anything or any toy can be part of the” Internet of Things (IOT),” Reuben told the crowd. “From terminators to teddy bears, anything or any toy can be weaponised.”

As part of his live demonstration and to prove his point, Reuben deployed his cuddly looking teddy bear ‘Bob’, which connects to the iCloud via Wi-Fi and Bluetooth smart technology to receive and transmit messages.

He then plugged a “Raspberry Pi” – a tiny and low cost computer – into his laptop on stage and started scanning the hall for available Bluetooth devices. To the astonishment of everyone in the hall, Reuben was able to download dozens of numbers including some of top officials.

Then, using the programming language called Python, he went on to hack into his Internet-connected teddy bear via one of the numbers and turned on Bob’s lights and transferred a recorded message from the audience through to the bear.

“Most internet-connected things have a blue-tooth functionality … I basically showed how I could connect to it, and send commands to it, by recording audio and playing the light,” he told AFP explaining his demonstration.

“IOT home appliances, things that can be used in our everyday lives, our cars, lights refrigerators, everything like this that is connected can be used and weaponised to spy on us or harm us.”

For instance, they could be used to steal private information such as passwords, as remote surveillance devices to spy on kids, or to locate a person using GPS.

More terrifyingly, toys could even be programmed to say “meet me at this location and I will pick you up,” Reuben said.

Besides being a cyber-ninja, Reuben is also the youngest American to earn a black belt in Shaolin Kung Fu. With the help from his family, Reuben has set up a non-profit organisation called CyberShaolin whose purpose is to spread awareness about “the dangers of cyber-insecurity”.

Since his talk, Reuben has been receiving congratulatory messages on Twitter from various experts in the infosec community applauding his work.

Reuben’s father, Mano Paul, an IT expert, said that his kid’s cyber skills emerged at the age of six, when he began exploring how software systems worked.

“He has always surprised us. Every moment when we teach him something he’s usually the one who ends up teaching us,” he told the AFP.

Reuben hopes to study cyber-security at either CalTech or MIT universities.

TechWorm

Twitter co-founder: ‘Yeah, I’m sorry’ if Twitter helped Trump get elected

/in ,

Twitter co-founder Evan Williams wants you to know he’s super sorry for any role the social media platform played in the election of President Donald Trump.

The sort-of apology was made in an interview with The New York Times published on Saturday. Williams’ remorse for possibly helping to create a political monster comes after Trump’s claims that Twitter was key in helping him clinch the election.

“I think that maybe I wouldn’t be here if it wasn’t for Twitter, because I get such a fake press, such a dishonest press,” Trump told Fox News in March.

The Times reports that Williams has only recently heard Trump’s claim for the first time, reflecting on it for a while before speaking out.

“It’s a very bad thing, Twitter’s role in that,” Williams told the Times. “If it’s true that he wouldn’t be president if it weren’t for Twitter, then yeah, I’m sorry.”

Trump’s use of Twitter has long been the source of criticism, especially now as he holds the highest office in the country. The Wall Street Journal reported earlier this week that Trump’s aides recently held a social media intervention with the president due to concerns his tweets could have political and legal ramifications.

The White House did not respond to a request for comment on Williams’ remarks, according to the Times

WATCH: Trump’s outrageous insults throughout his campaign

Windows 7, not XP, was the reason last week’s WCry worm spread so widely

/in ,

Wanacry stats

Eight days ago, the WCry ransomware worm attacked more than 200,000 computers in 150 countries. The outbreak prompted infected hospitals to turn away patients and shut down computers in banks and telecoms. Now that researchers have had time to analyze the self-replicating attack, they’re learning details that shed new and sometimes surprising light on the world’s biggest ransomware attack.

Chief among the revelations: more than 97 percent of infections hit computers running Windows 7, according to attacks seen by antivirus provider Kaspersky Lab. By contrast, infected Windows XP machines were practically non-existent, and those XP PCs that were compromised were likely manually infected by their owners for testing purposes. That’s according to Costin Raiu, director of Kaspersky Lab’s Global Research and Analysis Team, who spoke to Ars.

While the estimates are based only on computers that run Kaspersky software, as opposed to all computers on the Internet, there’s little question Windows 7 was overwhelmingly affected by WCry, which is also known as “WannaCry” and “WannaCrypt.” Security ratings firm BitSight found that 67 percent of infections hit Windows 7, Reuters reported.

The figures challenge the widely repeated perception that the outbreak was largely the result of end users who continued to deploy Windows XP, a Windows version Microsoft decommissioned three years ago. In fact, researchers now say, XP was largely untouched by last week’s worm because PCs crashed before WCry could take hold. Instead, it now appears, the leading contributor to the virally spreading infection were Windows 7 machines that hadn’t installed a critical security patch Microsoft issued in March

The Kaspersky figures are illuminating because they show Windows 7 x64 Edition, which is widely used by large organizations, being infected close to twice as much as Windows 7 versions mostly used in homes and small offices. It’s not clear if that means enterprises are less likely to patch or if there are other explanations.

Also on Friday, researchers published convincing evidence that malicious spam e-mails played no role in initially seeding last week’s ransomware worm. Rather, according to a blog post published by AV provider Malwarebytes, it spread through a mechanism that scanned the Internet for computers with open Server Message Block ports. The worm then used a modified version of “EternalBlue,”—the advanced SMB exploit that was developed by the National Security Agency and leaked by the Shadow Brokers group—to install WCry on vulnerable computers. From there, WCry propagated from vulnerable machine to vulnerable machine inside local networks.

“Developing a well-crafted campaign to identify just… a few thousand vulnerable machines would allow for the widespread distribution of this malware on the scale and speed that we saw with this particular ransomware variant,” Malwarebytes Senior Malware Intelligence Analyst Adam McNeil wrote.

A third revelation: more people than previously known may have been repackaging EternalBlue and other recently leaked NSA exploits in the weeks before the WCry outbreak. Security firm Secdo said on Friday that it unearthed evidence showing that multiple groups exploited the SMB vulnerabilities to install a separate ransomware package, steal login credentials, and to conscript computers into a botnet.

According to Secdo researcher Gil Barak:

Based on these findings, we suspect that the scope of the damage is much greater than previously thought and that there are at least three different groups that have been leveraging the NSA exploit to infect enterprise networks since late April… These attacks demonstrate that many endpoints may still be compromised despite having installed the latest security patch.

Researchers from a separate security firm already showed that criminals were using EternalBlue to make vulnerable computers part of a cryptocurrency mining botnet. A Secdo representative said the attacks the company reported occurred around the same time.

Meanwhile, EternalRocks—a separate self-replicating exploit also developed by the NSA and released in last month’s Shadow Brokers release—is also being repackaged in active attacks. Researcher Miroslav Stampar has details here.

Finally, as reported by Wired on Friday, attackers have been using a knock-off of the powerful Mirai Internet-of-things botnet to attack two servers that are currently preventing WCry and a WCry copycat variant from spreading. Before executing on a vulnerable computer, the worms are programmed to reach out to hardcoded domain names. If the domains respond, the worm aborts without infecting or spreading. Researchers suspect developers intended the mechanism to function as a killswitch they could use to stop the worm, should attackers lose control of it. Should the distributed denial-of-service attacks knock the servers out of commission, there is the possibility the self-replicating infections could start again.

MalwareTech, the pseudonymous researcher who registered the domain that stopped last Friday’s WCry worm, said he’s not concerned about the attacks. He explained to Ars: “at this point, very few samples are actually spreading, so even if the sinkhole were to go offline, the damage would be limited.”

Just to be on the safe side, he has sought the help of an unnamed DDoS mitigation service.

IBM Warns Customers After Shipping Them Infected USB Drives

/in , ,

IBM is urging customers to destroy flash drives it shipped to storage system customers because they contain malware.

The company warned in an advisory Tuesday that an unspecified number of USB flash drives shipped with the initialization tool for Storwize systems contain malicious code. IBM instructed customers who received the V3500, V3700 and V5000 Gen 1 systems to destroy the drive to prevent the code from replicating.

“When the initialization tool is launched from the USB flash drive, the tool copies itself to a temporary folder on the hard drive of the desktop or laptop during normal operation,” IBM said in its advisory.

The malicious code is part of the Reconyc Trojan malware family, which typically targets computers in Russia and India, according to data from Kaspersky Lab.

IBM said that while the malware is copied onto the victim’s device, the malicious code is not executed during initialization.

IBM recommends users who have already inserted the drive into their systems run an antivirus system to remove the malware. Users can also remove the directory containing the identified malicious file.

It wasn’t immediately clear how the malware landed on the flash drives. IBM didn’t immediately respond to a request for comment.

The affected Initialization USB flash drive looks like the image below, and contains a folder called InitTool.

IBM infected USB