This week, a couple of malicious Android applications are causing quite a stir because they have been used to steal over 1 million Facebook credentials.
The Cowboy Adventure game and the Jump Chess game are packing phishing Trojans, which steal Facebook passwords using a nattily named TinkerAccountLibrary.dll.
If you have downloaded either of these applications, remove them and change your Facebook credentials as soon as possible. If any of your friends are sending you strange Facebook messenger messages that look something like this: ‘Take a look at this: http://bit.ly/xxxjsjsjsj” do not click on them and do your mate a favour and let them know that they are pwned and need to:
- Change their Facebook password
- Change as many other passwords as systems they have accessed from their Android phones
- Run up to date antivirus scans on all of their devices
Screeching newspaper headlines about improbable numbers of Android malwares being discovered every minute may be exaggerated, but with the really slack quality control on the Google Play (or should that be pay?) Store, one has to be very careful about downloading free stuff. At least you can run AntiVirus on Android (of course you don’t need it on your Apple devices, do you now?).
The other big news of the week is a new release of OpenSSL which was very worryingly announced thus:
The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2d and 1.0.1p.These releases will be made available on 9th July. They will fix a single security defect classified as "high" severity. This defect does not affect the 1.0.0 or 0.9.8 releases.
GULP!
While not as serious as, say, HeartBleed (it doesn’t even have a name or a logo yet), if you are vulnerable you really need to get patching, and if you run Cisco stuff, wait for the forthcoming swathe of updates. We will be recommending appropriate patching to our NetSure360° managed service customers presently.
For full details of this vulnerability, we would direct you to this excellent piece by the fabulous people at Sophos: https://nakedsecurity.sophos.com/2015/07/09/the-openssl-cve-2015-1793-certificate-verification-bug-what-you-need-to-know/
A busy week this one! As you will know the Hacking Team were themselves hacked. What does that mean to you? It means that their stash of Zero Day exploits have been published and are already being exploited in the wild. More patching. Brilliant.
Of particular concern are a number of exploits against our old friend the leaky sieve that is Adobe, which once again requires urgent update. To the coalface amigos!
In very sad news, it was reported yesterday that Caspar Bowden, a campaigner for privacy and all round good guy passed away. Our condolences and very best wishes are with his friends and family. The world is a worse place without him. Rest In Peace.
If you would like to know more about any of the above, please get in touch by calling 020 7517 3900 or email: [email protected]
