Windows Registry-infecting malware has no files, survives reboots [ Mon Aug 11 2014]

Dear etechnews today,

Your weekly security newsletter from theregister.co.uk
for the week ending 11th August 2014





*** Security News ***

Anonymous wifi the latest casualty of Russia net neurosis
Ruskies must provide mobile phone numbers to surf Starbucks
http://www.theregister.co.uk/2014/08/11/anonymous_wifi_the_latest_casualty_of_russia_net_neurosis/

Blackphone rooted at BlackHat
Details awaited on privilege escalation bug
http://www.theregister.co.uk/2014/08/11/blackphone_rooted_at_blackhat/

US 911 service needs emergency upgrade and some basic security against
scumbags
12-year-old spoofs system to try and get Justin Bieber shot
http://www.theregister.co.uk/2014/08/11/us_911_service_needs_emergency_upgrade_and_some_basic_security_against_scumbags/

Why hackers won't be able to hijack your next flight - the facts
Commercial aircraft are safe, for the time being
http://www.theregister.co.uk/2014/08/10/why_hackers_wont_be_able_to_hijack_your_next_flight_the_facts/

Crypto Daddy Phil Zimmerman says surveillance society is DOOMED
We've been here before when we defeated slavery and the absolute
monarchy
http://www.theregister.co.uk/2014/08/09/technology_and_market_forces_will_defeat_surveillance_society_claims_crypto_king/

Beware WarKitteh, the connected cat that sniffs your Wi-Fi privates
Inventor says, despite it all, he's still not a cat person
http://www.theregister.co.uk/2014/08/09/beware_warkitteh_the_connected_cat_that_sniffs_your_wifi_privates/

Oracle Database 12c's data redaction security smashed live on stage
Microsoft should school Ellison on safeguarding privates, says infosec
bod
http://www.theregister.co.uk/2014/08/08/oracle_database_12c_redaction_is_totally_borked_by_bad_code/

Intruder alert: Cyber thugs are using steganography to slip in malware
badness
Signature-sniffers WILL be fooled – researcher
http://www.theregister.co.uk/2014/08/08/malware_steganography/

Smartcard firm Gemalto slurps SafeNet in $890m securo-boost deal
Crypto tech and license management tech will boost profits, hope firms
http://www.theregister.co.uk/2014/08/08/gemalto_buys_safenet/

'Up to two BEEELLION' mobes easily hacked by evil base stations
Android, BlackBerry, and Apple fall to OMA-DM flaw – claim
http://www.theregister.co.uk/2014/08/08/two_billeeon_mobile_phones_easily_hackable_with_dummy_base_station/

Yahoo! to! deploy! E2E! crypto! by! 2015!
Purple Palace also to loose script autobots to verify bug bounties
http://www.theregister.co.uk/2014/08/08/yahoo_to_deploy_e2e_crypto_by_2015/

DON'T PANIC! Satellite comms hacking won't be able to crash an aircraft
Cute idea but it just won't fly
http://www.theregister.co.uk/2014/08/08/dont_panic_satellite_comms_hacking_wont_be_able_to_crash_an_aircraft/

Network hijacker steals $83,000 in Bitcoin ... and enough Dogecoin for
a cup of coffee
Wow. Such hack. Very router. So BGP. Wow.
http://www.theregister.co.uk/2014/08/07/bgp_bitcoin_mining_heist/

Awooga: August Patch Tuesday incoming – with two remote-code exec bugs
in IE, Windows
Good news for Server admins – no critical fixes planned
http://www.theregister.co.uk/2014/08/07/august_patch_tuesday_due_up_nine_bulletins_two_critical/

Microsoft throws old versions of Internet Explorer under the bus
Come 2016, if you're not up to date you're on your own – enjoy your
security bugs
http://www.theregister.co.uk/2014/08/07/microsoft_old_ie_end_of_support/

Flying United Airlines? If you could just scan your passport with your
phone, that'd be great
New trial launch – but pack your paper for the TSA
http://www.theregister.co.uk/2014/08/07/united_airlines_kicks_tires_on_mobile_passport_checks/

Americans to be guinea pigs in vast chip-and-PIN security experiment
PSA: If you really want to steal millions – embarrass the banks enough
http://www.theregister.co.uk/2014/08/07/americans_about_to_become_guinea_pigs_in_chip_and_pin_experiment/

Hey guys. We've got 1.2 BILLION stolen accounts here. Send us your
passwords, 'cos safety
Enraged securo-bods bare fangs over new service
http://www.theregister.co.uk/2014/08/07/hold_security_backlash/

Snowden is FREE to ESCAPE FROM RUSSIA, say officials
But he can stay put for another 3 years if he really wants to
http://www.theregister.co.uk/2014/08/07/snowden_gets_russia_residency_permit_three_years/

Russia, China could ban western tech if they want to live in the PAST
Top apps and hardware don't appear overnight
http://www.theregister.co.uk/2014/08/07/russia_china_could_ban_western_tech_if_they_want_to_live_in_the_past/

Researcher snaps a Zeus hacker's photo through his webcam
Shoddy scammer served security smackdown
http://www.theregister.co.uk/2014/08/07/researcher_snaps_a_zeus_hackers_photo_through_his_webcam/

Zero-day hits Symantec endpoint products
Soak those connections, download those patches
http://www.theregister.co.uk/2014/08/07/zeroday_hits_symantec_endpoint_products/

Cracker takes control of 200 rooms in Chinese hotel
Blinds go up, blinds go down, hotel manager has no idea why
http://www.theregister.co.uk/2014/08/07/cracker_takes_control_of_200_rooms_in_chinese_hotel/

Car hackers build kit to protect you and your motor from fiery death
Turns out IDS is actually useful for something
http://www.theregister.co.uk/2014/08/07/car_hackers_build_simple_system_to_protect_your_motor_from_fiery_death/

Now even Internet Explorer will throw lousy old Java into the abyss
Out-of-date, unsafe ActiveX controls to be blocked starting next week
http://www.theregister.co.uk/2014/08/07/ie_out_of_date_activex_control_blocking/

CIA infosec guru: US govt must buy all zero-days and set them free
Destroy the software industry before it destroys the world, says Dan
Geer
http://www.theregister.co.uk/2014/08/07/geer_we_have_to_destroy_the_software_industry_in_order_to_save_it/

Android banking apps vulnerable to cash theft by CAS hole hackers
Toolkit Apache Cordova suffers cross-application scripting bug, IBM
discovers
http://www.theregister.co.uk/2014/08/06/android_vuln_banking_app_risk/

CryptoLocker victims offered free key to unlock ransomed files
Plus: One in four CERT cases relate to malware
http://www.theregister.co.uk/2014/08/06/decryptolocker/

Edward Snowden's not a one-off: US.gov hunts new secret doc leaker
Poor old Julian Assange – whistleblower went straight to Glenn
Greenwald
http://www.theregister.co.uk/2014/08/06/us_hunts_second_snowden/

Watch this Aussie infosec bod open car doors from afar
Homes unlocked now car doors popped
http://www.theregister.co.uk/2014/08/06/watch_this_aussie_infosec_bod_open_car_doors_from_afar/

Target tosses US$148m onto data breach barbecue
And even that sum may not hit the spot for hungry sueball-flingers
http://www.theregister.co.uk/2014/08/06/target_tosses_us148m_cash_onto_data_breach_barbecue/

One in 2900 phone calls is an IDENTITY THIEF
Breached citizen ID numbers used in painful IVR brute force attacks
http://www.theregister.co.uk/2014/08/06/one_in_2900_phone_calls_is_an_identity_thief/

Hacker crew nicks '1.2 billion passwords' – but WHERE did they all come
from?
Russian gang 'audited the internet'
http://www.theregister.co.uk/2014/08/05/russians_amass_1_2bn_stolen_passwords/

US cyber-army's cyber-warriors 'cyber-humiliated by cyber-civvies in
cyber-games'
'They were pretty much obliterated' – report
http://www.theregister.co.uk/2014/08/05/us_military_cyberwarriors_reservists_war_games/

White Hats splat Black Hat chats: Talks on home alarm flaws and Russian
spy tools axed
Three presentations now pulled from hacking shindig
http://www.theregister.co.uk/2014/08/05/black_hat_talks_pulled/

Israel snooped on John Kerry's phone calls during Middle East peace
talks
Well, if you will make basic security cockups...
http://www.theregister.co.uk/2014/08/05/israel_spied_on_john_kerry_us_during_middle_east_peace_talks/

Synology and the NAS-ty malware-flingers: What can be learned
'Security first' gets more NB for little guys
http://www.theregister.co.uk/2014/08/05/the_growing_importance_of_security_first_in_wake_of_synology_attacks/

Why no one smells a RAT: Trojan uses YAHOO WEBMAIL to pick up
instructions
Badness uses innocent-looking mailer for c&c ops
http://www.theregister.co.uk/2014/08/05/yahoo_webmail_controlled_trojan/

Multifunction printer p0wnage just getting worse, researcher finds
Konica Minolta, Sharp, Dell, Canon and HP printers spew credentials
when probed
http://www.theregister.co.uk/2014/08/05/printer_pwnage_just_getting_worse_researcher_finds/

Leaked docs reveal power of malware-for-government product 'FinFisher'
Win 8 Pro tip: Govt spyware can't tap Skype's Metro app
http://www.theregister.co.uk/2014/08/05/finfisher_spy_malware_docs_leaked/

Ransomware attack hits Synology's NAS boxen
This is as bad as you think, says Reg sysadmin Trevor
http://www.theregister.co.uk/2014/08/05/synologys_synolocker_crisis_its_as_bad_as_you_think/

NSA leaker Thomas Drake says Oz security reforms are 'scary'
Australians urged to oppose NatSec laws before they silence
whistleblowers
http://www.theregister.co.uk/2014/08/04/thomas_drake_scary_oz_security_reforms_will_stifle_whistleblowers/

If you ate at one of these PF Chang's restaurants, your bank card is at
risk
Pwned payment systems at eateries throughout the US
http://www.theregister.co.uk/2014/08/04/restaurant_chain_pf_changs_says_33_locations_were_breached/

Crumbs! Holiday phish based on genuine hotel booking surfaces
'The email looked incredibly authentic,' warns scam target
http://www.theregister.co.uk/2014/08/04/hotel_booking_phish/

EE rolls out London bus pay-by-bonk app – only fandoids need apply
iPhone-toting customers just don't have the power
http://www.theregister.co.uk/2014/08/04/ee_contactless_payments_on_london_buses/

China: Our approved vendor list – Kaspersky, Symantec AREN'T on it
Foreign firms dropped from infosec roll
http://www.theregister.co.uk/2014/08/04/kaspersky_symantec_china_dropped/

Snowden latest: NSA targets Gaza, pumps intelligence to Israel
Dragnet spook agency passes info to Middle East combatants
http://www.theregister.co.uk/2014/08/04/snowden_latest_nsa_helps_israel_target_palestinians_gaza/

Windows Registry-infecting malware has no files, survives reboots
Antivirus doesn't stand a chance because there's nothing for it to scan
http://www.theregister.co.uk/2014/08/04/registryinfecting_rebootresisting_malware_has_no_files/

GCHQ names the Hogwarts for Hackers
Security agency certifies Master of Cyber Security degree at 6 Brit
universities
http://www.theregister.co.uk/2014/08/04/gchq_names_the_hogwarts_for_hackers/

Microsoft hacks out new EMET, spits out Adobe Flash
Version 5.0 of friendly sniffer given more acute nose
http://www.theregister.co.uk/2014/08/04/microsoft_hacks_out_new_emet_spits_out_adobe_flash/


*** Whitepaper ***

5 things you didn't know about cloud backup
IT departments are embracing cloud backup, but there's a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
http://whitepapers.theregister.co.uk/d/cda/9e7f3/788/e067074a?td=week_sec_e



------------------------------------------------------------------------

This email was sent to garn14.tech@blogger.com

To change your email or your email subscriptions

http://account.theregister.co.uk/login/

To unsubscribe from all The Register newsletters

http://account.theregister.co.uk/unsubscribe/649203/acc978a1

The Register and its contents are Copyright © 2014 Situation Publishing.
All rights reserved.