Report: Secret Service investigates possible network breach of Sears

No evidence yet of actual breach, retailer says.

The US Secret Service is investigating a possible attack on the corporate network of Sears Holdings Corp. after high-profile hacks of Target, Neiman Marcus, and possibly other retailers have compromised tens of millions of credit cards, Bloomberg News reported.

"There have been rumors and reports throughout the retail industry of security incidents at various retailers and we are actively reviewing our systems to determine if we have been a victim of a breach," a Sears spokesman said in a statement, according to a report published Friday. "We have found no information based on our review of our systems to date indicating a breach."

Neither the Bloomberg report nor the statement from Sears said when the investigation began or provided other details. KrebsOnSecurity reporter Brian Krebs, who originally broke news of the Target breach, cautioned that there's reason to believe there may be no breach at Sears.

Read 3 remaining paragraphs | Comments

How to turn a phone into a covert bugging device? Infect the printer

James Bond-style attack underscores growing vulnerability of embedded software.

Security researchers have designed a stealthy eavesdropping attack that sounds like it's straight out of a James Bond movie. It starts with a booby-trapped document that compromises an unpatched laser printer, which in turn converts a popular Internet phone into a covert bugging device.

The proof-of-concept attack exploits currently unpatched vulnerabilities in the Avaya one-X 9608, a popular model of phone that uses the Internet rather than a standard phone line to make and receive calls. Researcher Ang Cui, a Ph.D. candidate at Columbia University and chief scientist at Red Balloon Security, declined to provide many details on the vulnerabilities until users have had time to install a patch that Avaya is expected to release soon. He did say the weaknesses allow devices on the same local network to remotely execute code that causes the device to surreptitiously record all sounds within earshot and transmit them to a server controlled by attackers. He demonstrated a similar bugging vulnerability last year in competing Internet phones designed by Cisco Systems, which has since patched the underlying bugs.

Cui, who is scheduled to present his research Friday at the RSA security conference in San Francisco, said the attack underscores the growing susceptibility of phones, routers, and other embedded devices to the types of malware attacks that once threatened only computers. He and Salvatore Stolfo, who is a Columbia University professor of computer science and a Red Balloon director, have devised software dubbed Symbiote, which runs on Internet phones and other embedded devices and alerts users whenever changes are made to the firmware. Symbiote is part of a larger defense the pair has developed called AESOP, short for the Advanced Embedded Sec Ops.

Read 4 remaining paragraphs | Comments

Sochi Olympics Terrorism Fears Used as Bait for Targeted Darkmoon Campaigns

While the Sochi Winter Olympics may now be over without incident, considering all of the media attention and fears surrounding a potential terrorist attack at the event, it should come as no surprise that cyberattackers were preying on these uncertainties to target potential victims of interest.

During the games, Symantec saw multiple targeted email campaigns that used Sochi Olympics themes to bait potential victims. These observed email campaigns were blocked by our Symantec.Cloud service. In one such campaign, we saw that targets were being sent the following email.

figure1_0.jpg

Figure 1. Email purporting to relate to a terrorist threat at the Sochi Olympics

In this campaign, attackers were using the social engineering ploy of a terrorist threat at the Sochi Olympics to lure in their victims. While the email does not look professional, the curiosity for the content can still be enough to persuade an individual to open the attachment. If a victim fell prey to opening the attachment, their computer became infected with Backdoor.Darkmoon. Darkmoon is a popular remote access Trojan (RAT) which is often used in targeted attacks, as seen in a recent Symantec blog about how the G20 Summit was used as bait in targeted emails and in the 2011 Symantec whitepaper, The Nitro Attacks.  

In another targeted campaign using the Sochi Olympics theme, we observed the following email that was being sent by an attacker to targets of interest.

figure2.jpg
Figure 2.
Email purporting to relate to military co-operation at the Sochi Olympics

Again, as seen in the email, the attackers used the social engineering ploy of military co-operation around the Sochi Olympics. This time, the payload was Trojan.Wipbot. This Trojan is associated with another similar targeted attack campaign, which included an attack that used a Windows zero-day elevation of privilege vulnerability.

These attacks highlight the ongoing need for vigilance when receiving any unsolicited emails. They also reinforce what is already known — targeted attackers are quick to make use of the latest news or events to enhance the chances of success for their social engineering ploy. The campaigns also highlight how targeted email attacks are showing no sign of dissipating anytime soon.

As always, we advise customers to use the latest Symantec technologies and incorporate the latest Symantec consumer and enterprise solutions to best protect against attacks of any kind.

While the Sochi Winter Olympics may now be over without incident, considering all of the media attention and fears surrounding a potential terrorist attack at the event, it should come as no surprise that cyberattackers were preying on these uncertainties to target potential victims of interest.

During the games, Symantec saw multiple targeted email campaigns that used Sochi Olympics themes to bait potential victims. These observed email campaigns were blocked by our Symantec.Cloud service. In one such campaign, we saw that targets were being sent the following email.

figure1_0.jpg

Figure 1. Email purporting to relate to a terrorist threat at the Sochi Olympics

In this campaign, attackers were using the social engineering ploy of a terrorist threat at the Sochi Olympics to lure in their victims. While the email does not look professional, the curiosity for the content can still be enough to persuade an individual to open the attachment. If a victim fell prey to opening the attachment, their computer became infected with Backdoor.Darkmoon. Darkmoon is a popular remote access Trojan (RAT) which is often used in targeted attacks, as seen in a recent Symantec blog about how the G20 Summit was used as bait in targeted emails and in the 2011 Symantec whitepaper, The Nitro Attacks.  

In another targeted campaign using the Sochi Olympics theme, we observed the following email that was being sent by an attacker to targets of interest.

figure2.jpg
Figure 2.
Email purporting to relate to military co-operation at the Sochi Olympics

Again, as seen in the email, the attackers used the social engineering ploy of military co-operation around the Sochi Olympics. This time, the payload was Trojan.Wipbot. This Trojan is associated with another similar targeted attack campaign, which included an attack that used a Windows zero-day elevation of privilege vulnerability.

These attacks highlight the ongoing need for vigilance when receiving any unsolicited emails. They also reinforce what is already known — targeted attackers are quick to make use of the latest news or events to enhance the chances of success for their social engineering ploy. The campaigns also highlight how targeted email attacks are showing no sign of dissipating anytime soon.

As always, we advise customers to use the latest Symantec technologies and incorporate the latest Symantec consumer and enterprise solutions to best protect against attacks of any kind.

McAfee Releases Security Bulletin for Host DLP

Original release date: February 27, 2014

McAfee has released a security bulletin to address multiple vulnerabilities in the Autonomy KeyView component of McAfee Host Data Loss Prevention software versions 9.1 and 9.2. Some of these vulnerabiliti…

Original release date: February 27, 2014

McAfee has released a security bulletin to address multiple vulnerabilities in the Autonomy KeyView component of McAfee Host Data Loss Prevention software versions 9.1 and 9.2. Some of these vulnerabilities could allow a remote attacker to take control of an affected system.

Users and administrators are encouraged to review McAfee Security Bulletin SB10024, CERT/CC Vulnerability Note VU#126159, and take appropriate actions to mitigate this risk.


This product is provided subject to this Notification and this Privacy & Use policy.