Mozilla Caught in a Bad Romance with Add-On

Ok, i know the title of this post is kinda funny but that's what this news is all about, one of the greatest internet browsers of this time Mozilla Firefox and with other products also. This have been spread in the form of Add-on’s.

 

 

These aren't just add-on’s the real problem is that they are infected with Malwares and they have downloaded by many of the people worldwide.

 

According to the researchers “Two Firefox add-on’s available for months on Mozilla’s website infected users with malware that stole passwords and opened a backdoor on Windows machines, the open-source browser maker has confirmed.”…

 

According to Mozilla, version 4.0 of So think Web Video Downloader is infected with password sniffer Win32.LdPinch.gen and Master Filer is infected with the backdoor trojan Win32.Bifrose.

 

Which is worst for a popular web browser company as it would spread rapidly and would be more dangerous. But this is where it gets embarrassing for Mozilla – the infected add-ons have been available from the official download site for several months and, according to Mozilla, have together been downloaded around 4,600 times.

 

These were discovered about on the days between 25th of Jan to somewhat near and sure they have removed them and working on it to remove them fast as many of the antivirus software's have already recognized and are removing them.

 

That script, designated HTML.Xorer also appears to have slipped past Mozilla's anti-virus scanner. As a result, Mozilla developers announced that the add-on directory would in future be checked for malware on a daily basis.

 

So, What do you think ? Is it just mozilla or Google Chrome would be next ?

Read More

Apple Security Standards [Pic]

Read More

BlackBerry Smoked at ShmooCon : Spyware

Just few days ago the big ShmooCon 2010 took place at the Washington DC from 5th to 7th of this month. It was obvious that some new would come from the con, and yes, one security researcher have done it.

BlackBerry phones have been hit this time with a new spyware which can do alot of stuff like the ability to access and dump the BlackBerry's contacts, email messages, phone logs, the device's current location and the recording made by the BlackBerry's microphone….

 

And the program which hacks the blackberry is called txsBBSPY written by Tyler Shields, a senior security researcher at Veracode, Well it seems that the engineers would be working on it.

 

The great thing about this software is that we don't need to make it hidden on some firmware or something its an application for the BlackBerry phones. Just install it and you can monitor the stuff you want to do.

 

“ The application was built using the controlled APIs that Research In Motion, the BlackBerry's maker, makes available to developers. In order to sign a BlackBerry application developed using these APIs, the developer has to apply for the signing keys and pay a small fee.

 

Once he has the keys, he can sign the application and a hash of the code is sent to RIM. However, RIM doesn't get the full source code of the application. ”

 

"Finally, it should be noted that while we chose BlackBerry for our proof-of-concept, this is not just a BlackBerry problem. All mobile platforms provide similar mechanisms for writing applications that have access to the user’s personal, potentially sensitive information," Eng writes.

 

 

TXSBBSpy Demo from Veracode on Vimeo.

 

 

Here is the video which they have used to demonstrate the idea behind this spyware. Hope you guys enjoy it and there are some good news too which adds fire to this thing is that these guys have also released the spyware source code.

 

Here are the source codes and the slides of this demonstration which you will need more then me.

Slides: Blackberry Mobile Spyware — The Monkey Steals the Berries
Source: txsBBSpy.java

Conclusion

This brings me to a conclusion that its not necessary that the official App stores are always safe as the if i could make this application and distribute in the open then anybody can do that.

 

Well that's what they also want to prove with this spyware to the industry and it makes sense to me as they have also said this can be done to many of the other mobile phones like iPhones etc.

 

Happy Hacking @hackerthedude

Read More