iOS 10.1.1 fixes Health data bug

Fix for iOS 10.1 health data bug:

https://macviruscom.wordpress.com/2016/10/31/fix-for-ios-10-1-health-data-bug/

David Harley

SANS, Signatures, Next-Gen and DIY Testing

An article by me for IT Security UK that examines how, while SANS has done some good work in security, its forthcoming webcast on next-gen product evaluation is based on fallacies.

SANS, Signatures, Next-Gen and DIY Testing

David Harley

'Expiring AppleID' phish

Graham Cluley describes a 'smishing' campaign (phishing via SMS texts) targeting Apple iOS users, trying to persuade them to access a malicious URL by telling them that 

     'Your AppleID is die to expire Today'.

As the clocks go back, UK Apple users targeted by smishing campaign - Think before you click, and you too can avoid phishers.

Flagged by Simon Rae-Scott: 

David Harley

Support Scam that Threatens to Delete Hard Drive

Article also posted to AVIEN: Support Scam Threatens to Delete Hard Drive 

Siddhesh Chandrayan, for Symantec, reports on a particularly vicious example of social engineering designed to scare a victim into ringing a fake support line:

Tech support scams increasing in complexity - Tech support scammers have begun using code obfuscation to avoid detection.

The pop-up fake alert claims that the victim's system is infected with 'Exploit.SWF.bd' and that the hard drive will be deleted if he or her tries to 'close this page'. It displays a fake ‘hard drive delete timer’ complete with audio effect.

Don't panic! In principle, Javascript like this isn't able to do any such thing: that's a security feature of the language. (There are, of course, other ways of accessing and changing the contents of a client-side disk, but there's no suggestion that any of those mechanisms are at play here.)

The obfuscated script also includes code to ascertain whether the system is running Windows, 'MacOS', UNIX or Linux, so that the alert can be tailored accordingly.

Commentary by David Bisson, writing for Graham Cluley's blog: Scare tactics! Tech support scam claims your hard drive will be deleted - Scammers tries to frighten you into phoning them up.

David Harley

Dumb scammers, smart suppliers

The sophisticated instant scam packages behind low-grade fake helpline scammers.

• Malwarebytes: Scamming As A Service - seriously 
• Commentary by me for AVIEN: Support Scams - the Supply Chain

David Harley

Trust me, I'm Facebook: I have standards...

Facebook has inconspicuously announced that it intends 'to begin allowing more items that people find newsworthy, significant, or important to the public interest — even if they might otherwise violate our standards.'

More commentary here. 

David Harley

Security Essentials or Support Scam? - AVIEN article

An article for AVIEN, where I run an information resource focused on tech support scams (and another focused on ransomware).

Security Essentials or Support Scam? is about a malicious program flagged by Microsoft. It passes itself off as Security Essentials, but is used to manipulate victims into ringing a fake tech support line in order to fix a fake Blue Screen of Death.

David Harley

Interest rates down, bitcoin stockpiles up

Blog article for AVIEN: Financial institutions amassing bitcoin in anticipation of extortion attacks: avien.net/blog/2163-2/

David Harley

Fighting fire with fire and hoaxes with hoaxes

NewsThump apparently attempts to reduce the number of Facebook hoaxes by generating a hoax of its own. Where would the internet be without satire?

Mark Zuckerberg to give everyone $1000 to stop sharing stupid Facebook hoaxes 

I thought of sharing this article on Facebook, but was torn between not wanting to mislead people who lack the hoax/satire recognition gene, and not wanting to offend people who would see right through it anyway by explaining that NewsThump isn't a real news site...

David Harley

Support Scams - victim demographics

Interesting statistics regarding the relative proportions of tech support scam victims in various parts of the world:

• Microsoft: Youngsters more likely to be scam victims than pensioners, study reveals
• Sophos: Tech support scammers preying on young Americans, study finds

David Harley

Machine Learning: Nextgen Hit or Myth?

For the Kaspersky blog, Alexey Malanov explodes some myths about the Machine Learning buzzword.

Commentary by me: Machine Learning: Hot or Hype?

David Harley

Do businesses really pay up ransom?

Can’t Pay, Won’t Pay?

Pointer on AVIEN to an article suggesting not. Katherine Richards is talking about businesses rather than home users: a reasonably good generalist article, though, with commentary from big names such as Ryan Naraine and Paul Vixie.

David Harley
ESET Senior Research Fellow

Decrypters Info added to AVIEN resources

An article by Charlie Osborne for ZDnet/Zero Day includes an alphabetical list of ransomware families for which decrypters are available, with links. It’s not, of course, a complete list (either of remediable ransomware or of reputable sources of decrypters) but the sources it does list are indeed reputable. As we’re seeing an increasing number of less reputable sources misusing SEO, blog comments and so on, that’s not a small consideration. Added to the Specific Ransomware Families and Types and Ransomware Recovery and Prevention pages.

More info in Decrypters info on the AVIEN page. 

David Harley
ESET Senior Research Fellow

Backup, PR Pressure and Ransomware

Blog article for AVIEN on Backup, PR Pressure and Ransomware.

David Harley