New virus can spy on online banking transactions

The latest cyber threat to target users in the Middle East could steal browser passwords and online banking account credentials, according to security firm Kaspersky Lab.

The Moscow-based firm announced on Thursday that it has discovered the cyber surveillance virus, which it calls “Gauss,” in personal computers in Lebanon.

Kaspersky Lab said Gauss is capable of stealing data from the clients of several Lebanese banks and it has also targeted Citibank and PayPal users.

It’s estimated that the virus was deployed around September 2011.

Researchers discovered Gauss due to its strong resemblance to Flame, a cyber virus that infiltrated computers in Iran and was believed to have targeted the country’s nuclear program.

Kaspersky Lab described Gauss as a “complex cyber-espionage toolkit,” which was created by the same individuals behind Flame.

“Gauss bears striking resemblances to Flame, such as its design and code base, which enabled us to discover the malicious program,” said Kaspersky Lab chief security expert Alexander Gostev.

Kaspersky Lab was helping the United Nations' International Telecommunications Union search for destructive malware when it came across Flame.

However, Gostev said that Gauss’ purpose was different than Flame’s.

“Gauss targets multiple users in select countries to steal large amounts of data, with a specific focus on banking and financial information.”

Flame, on the other hand, targeted specific software vulnerabilities and was selective in the computers it attacked.

In a posting on its website, Kaspersky Lab said the detailed data from the infected computers is sent to the attackers.

 “Since late May 2012, more than 2,500 infections were recorded by Kaspersky Lab’s cloud-based security system,” said the company, estimating the total number of victims of Gauss to be in the tens of thousands.

Gauss has since been blocked and remediated by Kaspersky Lab.

H1N1 flu shots likely linked to increase in Guillain-Barre cases: study

The Canadian Press

TORONTO -- The flu vaccine used during the 2009 pandemic may have led to a slight increase in cases of Guillain-Barre syndrome in Quebec, a new study from the province suggests.

The study, published Wednesday in the Journal of the American Medical Association, suggests that use of the vaccine may have led to a doubling of the rate of cases of the rare neurological condition.

But the authors of the article said that even with an increase in Guillain-Barre cases, the benefits of the vaccination probably outweighed the risk for Quebecers.

"Obviously there is a risk. But there are benefits," said first author Philippe De Wals, a professor of community health at Laval University in Quebec City. De Wals also works for Quebec's provincial public health agency.

Guillain-Barre syndrome is a progressive but generally reversible paralysis which begins at the feet and works its way upwards. A small percentage of people who develop the condition die; most make a full recovery.

GBS, as it is sometimes called, can be caused by a number of things, including some infections. For instance, it's known that Campylobacter jejuni, a bacteria that causes gastroenteritis, can trigger Guillain-Barre syndrome.

For years there have been questions about whether getting a flu shot increases one's risk of developing the condition.

In 1976, when an outbreak of human cases of swine flu in the United States led authorities to fear a pandemic was in the offing, a mass vaccination campaign there was mounted. But the campaign was halted when a higher-than-expected number of cases of GBS were seen in people who got the vaccine, and the pandemic failed to materialize.

Since then, numerous studies have been done to try to answer the question. But the findings have been conflicting. And the same is true with studies into whether the 2009 pandemic vaccination campaigns led to an increase in Guillain-Barre cases.

In Quebec, at least among people over the age of 50, the answer appears to be yes, according to De Wals's study.

"Your baseline risk to get Guillain-Barre during a particular month is two per million. If you are vaccinated with the pandemic vaccine, your additional risk is two per million. So basically you are doubling your risk," he said.

But an influenza expert from the University of Michigan said this study, though well done, can't provide a definite answer.

"It's new wine in old bottles or the reverse," said Dr. Arnold Monto.

"It confirms what we have suspected all along, that there may be a low risk.... And the low risk, if present, is no different with adjuvanted than non-adjuvanted vaccine.

"The questions still remain."

An adjuvant is a compound that boosts the immune response triggered by a vaccine, allowing smaller doses to be used for each person.

Canada used adjuvanted flu vaccine for the first time during the 2009 pandemic. In the United States, officials opted for an unadjuvanted vaccine. But a study from the U.S. Centers for Disease Control also found a slight elevation of the rate of GBS cases after that country's pandemic vaccination campaign.

A study in Britain, where adjuvanted vaccine was used, found no increased risk.

"Sometimes you see it and sometimes you don't," said Monto. "Which to me means that there may well be a small effect but it's so small that it's hard to get statistical significance (in studies)."

In a related development, the journal also published a study looking at whether use of the pandemic vaccine in pregnant women led to increased rates of birth defects, pre-term births or other related problems.

Researchers from Denmark looked at the health records of roughly 6,500 children born to women who received H1N1 flu shots during the pandemic. They compared the children to a similarly sized group of children born during that period whose mothers hadn't taken the flu shot.

They saw no evidence of an increased risk of major birth defects, pre-term birth or fetal growth restriction.

Denmark used an adjuvanted vaccine during the pandemic, one that contained the same boosting compound -- called AS03 -- used in that Canada's pandemic vaccine.

Even though pregnant women are at elevated risk of becoming severely ill from flu infection -- particularly during pandemics -- getting them to agree to get a flu shot has been a hard sell.

In 2009, Canadian officials made a late-stage decision to make some vaccine without the adjuvant in a bid to persuade more pregnant women to get an H1N1 shot.

An editorial in the journal suggests the Danish study should assuage concerns about use of adjuvanted pandemic flu vaccine in pregnant women.

Researcher: CIA, NSA may have infiltrated Microsoft to write malware

Did spies posing as Microsofties write malware in Redmond? How do you spell 'phooey' in C#? 0 32 0Reddit1Submit2Email

By Kevin Fogarty

A leading security researcher has suggested Microsoft's core Windows and application development programming teams have been infiltrated by covert programmer/operatives from U.S. intelligence agencies.

If it were true it would be another exciting twist to the stories of international espionage, sabotage and murder that surround Stuxnet, Duqu and Flame, the most successful cyberwar weapons deployed so far, with the possible exception of Windows itself.

Nevertheless, according to Mikko Hypponen, chief research officer of antivirus and security software vendor F-Secure, the scenario that would make it simplest for programmers employed by U.S. intelligence agencies to create the Stuxnet, Duqu and Flame viruses and compromise Microsoft protocols to the extent they could disguise downloads to Flame as patches through Windows Update is that Microsoft has been infiltrated by members of the U.S. intelligence community.

Having programmers, spies and spy-supervisors from the NSA, CIA or other secret government agencies infiltrate Microsoft in order to turn its technology to their own evil uses (rather than Microsoft's) is the kind of premise that would get any writer thrown out of a movie producer's office for pitching an idea that would put the audience to sleep halfway through the first act.

Not only is it unlikely, the "action" most likely to take place on the Microsoft campus would be the kind with lots of tense, acronymically dense debates in beige conference rooms and bland corporate offices.

The three remarkable bits of malware that attacked Iranian nuclear-fuel development facilities and stole data from its top-secret computer systems – Flame Duqu and Stuxnet – show clear signs of having been built by the same teams of developers, over a long period of time, Hypponen told PC Pro in the U.K.

Flame used a counterfeit Microsoft security certificates to verify its trustworthiness to Iranian users, primarily because Microsoft is among the most widely recognized and trusted computer companies in the world, Hypponen said.

Faking credentials from Microsoft would give the malware far more credibility than using certificates from other vendors, as would hiding updates in Windows Update, Hypponen said.

The damage to Microsoft's reputation and suspicion from international customers that it is a puppet of the CIA would be enough to keep Microsoft itself from participating in the operation, even if it were asked.

That doesn't mean it didn't happen.

"It's plausible that if there is an operation under way and being run by a US intelligence agency it would make perfect sense for them to plant moles inside Microsoft to assist in pulling it off, just as they would in any other undercover operation,” Hypponen told PC Pro. "It's not certain, but it would be common sense to expect they would do that."

The suggestion piqued the imaginations of conspiracy theorists, but doesn't have a shred of evidence to support it.

It does have a common-sense appeal, however. Planting operatives inside Microsoft would probably be illegal, would certainly be unethical and could have a long-range disadvantage by making Microsofties look like tools of the CIA rather than simply tools.

"No-one has broken into Microsoft, but by repurposing the certificate and modifying it with unknown hash collision technologies, and with the power of a supercomputer, they were able to start signing any program they wanted as if it was from Microsoft," Hypponen said. "If you combine that with the mechanism they were using to spoof MS Update server they had the crown jewels."

Hypponen is one of a number of security experts who have said Stuxnet and Duqu have the hallmarks of software written by traditionally minded software engineers accustomed to working in large, well-coordinated teams.

After studying the code for Duqu, security researchers at Kaspersky Labs said the malware was most similar to the kind of work done by old-school programmers able to write code for more than one platform at a time, do good quality control to make sure the modules were able to install themselves and update in real time, and that the command-and-control components ahd been re-used from previous editions.

"All the conclusions indicate a rather professional team of developers, which appear to be reusing older code written by top “old school” developers," according to Kaspersky's analysis. "Such techniques are normally seen in professional software and almost never in today’s malware. Once again, these indicate that Duqu, just like Stuxnet, is a 'one of a kind' piece of malware which stands out like a gem from the large mass of “dumb” malicious program we normally see."

Earlier this month the NYT ran a story detailing two years worth of investigations during which a range of U.S. officials, including, eventually, President Obama, confirmed the U.S. had been involved in writing the Stuxnet and Flame malware and siccing them on Iran.

That's far from conclusive proof that the NSA has moved its nonexistent offices to Redmond, Wash. It doesn't rule it out either, however.

Very few malware writers are able to write such clean code that can install on a variety of hardware systems, assess their new environments and download the modules they need to successfully compromise a new network, Kaspersky researchers said.

Stuxnet and Flame are able to do all these things and to get their own updates through Windows Update using a faked Windows Update security certificate.

No other malware writer, hacker or end user has been able to do that before. Knowing it happened this time makes it more apparent that the malware writers know what they are doing and know Microsoft code inside and out.

That's still no evidence that Microsoft could be or has been infiltrated by spies from the U.S. or from other countries.

It does make sense, but so do a lot of conspiracy theories.

Until there's some solid indication Flame came from inside Microsoft, not outside, it's probably safer to write off this string of associative evidence.

Even in his own blog, Hypponen makes fun of those who make fun of Flame as ineffective and unremarkable, but doesn't actually suggest moles at Microsoft are to blame.

In the end it doesn't really matter. The faked certificates and ride-along on Windows Update demonstrate the malware writers have compromised the core software development operations at Microsoft. They don't have to live there to do it; virtual compromise on the code itself would do the job more effectively than putting warm bodied programmers in the middle of highly competitive, highly intelligent, socially awkward Microsofties with a habit of asking the wrong question and insisting on an answer.

The risk of having any such infiltration discovered is far too high to expose the cyberwar version of Seal Team Six to the perils of Redmond.

Latest viruses could mean ‘end of world as we know it,’ says man who discovered Flame

Eugene Kaspersky: We’re at the mercy of cyberterrorists, armed with weapons more serious than any previous IT security threat

By David Shamah

The Flame virus, whose existence was announced several weeks ago by Eugene Kaspersky, is not just any old virus. It’s so sophisticated that it represents a new level of cyber threat, one that could be “the beginning of the end of the [interconnected] world as we know it,” Kaspersky said at a press conference Wednesday. “I have nightmares about it.”

Information security expert Kaspersky, whose team of researchers uncovered Flame’s existence, was a featured speaker at Wednesday’s second annual cyber-security conference sponsored by the Tel Aviv University’s Yuval Ne’eman Workshop for Science, Technology and Security. The conference comes at a time when interest in cybersecurity is at a peak, as a result of speculation about who was behind the Flame attack and the earlier Stuxnet virus attack that is thought to have damaged, or at least delayed, progress by Iran on its nuclear program.

Also speaking at the conference were a host of top security and government officials, including Defense Minister Ehud Barak, Israel Space Agency chairman Yitzhak Ben-Yisrael, former Shin Bet director Yuval Diskin, and others.

While many companies — including Kaspersky’s — advertise sundry solutions for computer viruses and Trojans, they won’t help when it comes to Flame and other still undiscovered viruses of similar or even greater strength that are likely out there, he said. “Right now we have no way to defend against these global attacks.”

The term “cyber-war” is used by many to describe the situation, but that term — which implies that there are two equal, known enemies duking it out — is outmoded, he said. “With today’s attacks, you are clueless about who did it or when they will strike again. It’s not cyber-war, but cyberterrorism.”

Flame, which has stealthily stolen large chunks of data during the months or perhaps years it has been on the loose, is especially scary because of its many sophisticated tools, said Kaspersky. Besides being able to quickly replicate itself on networks and break up data into very small segments, making it almost impossible to trace as it is sent onwards, the virus has many unique features. “It can of course be spread very quickly via a disk-on-key, when one is plugged into a network,” but in addition, it can use bluetooth, wifi, and other communications protocols to propagate, he said.

The Russian-born Kaspersky, 46, whose company is the world’s largest privately held vendor of software security products, described the process by which his team discovered Flame, saying that he got interested in the matter when he heard that Iran had actually accused his company of designing the attack tool. “We thought that maybe our internal system was compromised, so we conducted a thorough investigation.”

It was this investigation, which entailed contacts with IT personnel in Iran itself, that yielded the data on Flame. “Dealing with what we discovered was too big a job for a company,” so Kaspersky took what he knew to the UN’s International Telecommunications Union, which was just as shocked as he was. “We worked out an arrangement where we would gather the data, and they would take care of the other issues.”

Data-gathering is a technical issue, not a political one, Kaspersky said, so he could not speculate on who invented Flame, or why. But anyone and everyone is a suspect. “There are many countries with hackers and experts who are sophisticated enough to pull something like this off.”

The US, Israel, China, and Russia are on that list, but so is Romania, “which has many talented hackers.”

But even countries without a staff of their own could kidnap the scientists they need or hire “hacktivists” to do their dirty work, and there is no shortage of willing and capable people, Kaspersky said.

Still, any country thinking of stockpiling cyber-weapons of these magnitudes should think twice, Kaspersky said, as they have a way of getting out of control.

“It’s like biological weapons; when you set one off in one place, it affects many others.” Cyber-weapons of the magnitude of Flame are just as destructive. “The world is just so interconnected today, and the viruses that attack one power plant puts them all at risk,” Kaspersky said.

Governments must work together to, for example, order a complete rewrite of software for essential systems to protect them against attacks — “there are still many systems out there using MS-DOS,” Kaspersky said — to agreeing to pool information and act jointly when an attack occurs.

The alternative, Kaspersky said, is a world in which cyberterrorists have a free hand – something like the world in the movie Die Hard 4 (also known as Live Free or Die Hard). That movie’s plot involves hackers causing blackouts, blowing up government buildings, and trying to shut down America’s computer system.

“We at Kaspersky Labs have been aware for a long time that such a scenario was possible, but until that movie came out in 2007, we forbade anyone inside the organization from using the term ‘cyber-terrorist.’ Now that the cat is out of the bag, we routinely use that word to describe what is going on.”

He, and other researchers like him, are hard at work coming up with the solutions as the problems arise. What’s at stake, he said, is nothing less “than life as we know it today. Let’s hope and pray we can keep the cyber world safe for our kids and grandkids.”

Powerful ‘Flame’ cyberweapon tied to popular Angry Birds game

By Catherine Herridge

The most sophisticated and powerful cyberweapon uncovered to date was written in the LUA computer language, cyber security experts tell Fox News -- the same one used to make the incredibly popular Angry Birds game.

LUA is favored by game programmers because it’s easy to use and easy to embed.  Flame is described as enormously powerful and large, containing some 250,000 lines of code, making it far larger than other such cyberweapons. Yet it was built with gamer code, said Cedric Leighton, a retired Air Force Intelligence officer who now consults in the national security arena.

“The people who developed the malware … found an ingenious way to use a code not part and parcel of a hacker’s normal arsenal, and that made it harder to detect,” he told Fox News.

But this new weapon is twenty times the size of earlier cyberbombs and far more powerful, making it practically an army on its own, said Roel Schouwenberg, a senior security researcher with Kaspersky Labs.

“Flame is a cyberespionage operation,” he told FoxNews.com.

The reconnaissance virus variously called “Worm.Win32.Flame” or simply “Flame” resembles some of its predecessors, notably DUQU. DUQU was like a computer advance team for the Stuxnet virus that ravaged the Iranian nuclear program at Natanz in 2009. Flame is likewise a form of spyware that enters a computer system, though exactly how is unclear.

“A thumb drive is one way of introducing Flame,” Leighton told Fox News. “But once you know the email address or computer IP address … they can introduce Flame remotely.”

Cyber experts tell Fox News that once in a computer network, Flame is powerful enough to initiate webcams, microphones, and Bluetooth connections in order to extract contact lists, record conversations and more.

It was likely built by the same nation-state responsible for the Stuxnet virus that targeted Iran’s nuclear power plant. One of the leading candidates, is Israel, because Flame has been found in Saudi Arabia, Palestinian territories, Syria, Iran and Hungary.

Israeli Vice Premier Moshe Ya'alon on Tuesday hinted to a local radio station that his country was indeed responsible for it.

"Whoever sees the Iranian threat as a serious threat would be likely to take different steps, including these, in order to hurt them," Ya’alon said.

The spyware has been seen in Israel as well – something that could be a red herring, Leighton said.

Flame came to light when the U.N. International Telecommunications Union (which oversees cyberactivities for the body) received reports of unusual activity.  A Russian security firm first identified it, noting that the virus has apparently existed in these networks for several years undetected.

The U.N. body is expected to release a warning Wednesday that Flame is a significant threat.