Webcam sextortion perve gets 6 years

Hacked girls' PCs and blackmailed them to pose



A Peeping Tom webcam sextortionist has been jailed for six years after targeting several young women.
Luis Mijangos, 32, a resident of Santa Ana, California, was imprisoned on Thursday after he was convicted of hacking into more than 100 computers, using stolen personal information, to blackmail his young female victims into posing for sexually explicit videos and pictures.

Mijangos, a freelance computer consultant who is confined to a wheelchair, used malware to compromise victims' machines. In one case he posted naked photos of a woman on her friend's MySpace page. In another he posed as a victim's boyfriend in order to trick her into posing for revealing pictures.

Mijangos used modified versions of remote access tools, such as Poison Ivy or SpyNet, which he planted onto file-sharing networks or sent to victims disguised as video clips or songs so that he could gain compromised access to their PCs, Computerworld reports.

The case is the latest in a long list of prosecutions of voyeurs who used computing technology to abuse victims. For example, Adrian Ringland of Ilkeston, Derbyshire, was jailed for 10 years back in 2006 after he was convicted of using spyware to take explicit photos of kids using compromised access to computer webcams. In 2008, a 47-year-old Cypriot got four years for taking illicit snaps of a teenager after he planted Trojan horse spyware to gain remote control of the 17-year-old's webcam. More discussion on the issue and advice on possible countermeasures (use anti-malware and, if in doubt, disable webcams) can be found in a blog post by Sophos here. ®

[The Register]

One Million Web Sites Infected At End of 2010

There was a sharp jump in the prevalence of malicious Web advertisements in the final quarter of 2010, with loosely monitored "remnant" ad networks responsible for an increasing share of the attacks, according to a report from the firm Dasient. The Dasient Q4 Malware Update reported that more than one million Web sites were infected in the last quarter of 2010. That period saw a 25% growth in malicious advertisements from the previous quarter, as attackers found ways to sneak malicious code into widely used syndicated online ad networks. Its a trend that security experts see accelerating in 2011, as malicious advertisements, sometimes referred to as 'malvertisements,' crop up on high profile sites, said Neil Daswani, Chief Technology Officer at Dasient.

Daswani said that, overall, his company saw a 100% increase in the amount of malicious advertising from the third- to fourth quarters, 2010. However, much of that was due to an expansion of the sites Dasient monitored, with an increasing focus on so-called 'remnant' ad networks, which aggregate 'remnant' advertisements from direct marketers, who often have little oversight about where the ads appear.

Though most remnant ad networks are legitimate businesses, many are also susceptible to manipulation. Malicious hackers have found a variety of ways to insert malicious content into their legitimate ad streams: either compromising the ad network's ad server and replacing a legitimate ad with a malicious one, or by submitting a legitimate ad image, then replacing it with a malicious image after a set period of time, Daswani said.

Those images can find their way even to high value sites, because top tier online ad networks often syndicate ads from other publishers to fill in gaps in their own service, Daswani said. In recent weeks, well-ranked sites such as Autotrader.co.uk, cinema site Myvue.com and londonstockexchange.com were reported to have served up malicious advertisements. Malicious ads are commonly used to display pop up messages with links that will take users to a drive by download Web site download rogue anti virus programs or other threats.

Daswani said that  firms that serve advertisements need to do a better job vetting the content of the images they serve for malicious code, and detecting Web based attacks, including malicious ads, when they appear.

Malicious ads are, by no means, limited to remnant ad networks. In January, major ad networks DoubleClick and MSN were duped into serving malicious ads from attackers who registered a malicious site that masqueraded as AdShuffle.com, an online advertising technology firm.

[ThreatPost]

Malvertising attacks surge

Malvertising is on a significant rise, having doubled from Q3 to Q4 2010, according to Dasient.

Based on Q4 estimates, three million malvertising impressions were served per day, an increase of 100% as compared to 1.5 million malvertising impressions per day in Q3 2010.



The increase in the estimate from the previous quarter comes from a growth in malvertising incidents from networks monitored last quarter, plus malvertising incidents from additional “remnant” ad networks that Dasient started monitoring in Q4.

More than one million web sites were estimated to be infected in Q4 2010. As compared to data from one year prior (Q4 2009), web malware infections have nearly doubled and are a growing threat that needs to be abated.

The probability that an average Internet user will hit an infected page after three months of web browsing is 95%.

The top attacker domain was ipq.co, a free DNS forwarding service. Cybercriminals are abusing DNS forwarding services in an effort to hide and reduce the cost of executing their attacks.

Dasient found that most social media networks are prone to being used as distribution platforms for malware. They conducted some safe, benign experiments on various social networking sites, and found that infections can occur relatively easily through them via user-generated-content (UGC) interactions and advertisements.

[Net-Security]

Britons caught out by booby-trapped web ads

The website of the London Stock Exchange was one that displayed the booby-trapped ads

Tens of thousands of people could have been caught out by cyber criminals who put booby-trapped adverts on popular webpages.

The criminals racked up the victims by compromising the computers used by ad firm Unanimis to display adverts to popular websites.

The ads appeared on the websites of the London Stock Exchange, Autotrader, the Vue cinema chain and six other sites.

Unanimis said it moved quickly to pull the adverts once they were discovered.


Victim count
It said it was now investigating how the criminals managed to inject their booby-trapped ads into its feed.
David Nelson, operations and IT director at Unanimis, told the BBC that security alerts revealed the existence of the booby-trapped adverts at 1800 GMT on 27 February.

Clearing out the adverts took about three hours, said Mr Nelson.

A preliminary investigation revealed that "unauthorised access" to the ad servers allowed the criminals to inject their malicious code.

Mr Nelson said Unanimis was still investigating how the criminals got access as the firm has security systems in place that check adverts are safe before they are distributed.

"The [adverts] they chose to modify were not being widely distributed," said Mr Nelson. This, coupled with the attack taking place on a Sunday evening, limited how many people fell victim.

"We have to count ourselves lucky in some respects," he said.

The infection kicked off warnings from a fake security program

The bad ads exploited vulnerabilities in software used on Windows PCs to make it look like a machine had been hit by a virus.

Then it displayed a bogus diagnostic screen telling users that their PC was infected. It asked for payment to remove the "infection".

Mr Nelson said it was still trying to work out how many people had seen the booby-trapped ads.
He speculated that a "few percent" of Unanimis audience would have been hit. He declined to identify all the sites that had shown the adverts but said all those affected had been informed.

Patrik Runald, senior research manager at Websense, said its analysis suggested a lot of people had been caught out.

"We believe that quite a large number of sites were showing these adverts," he said, adding that the number of victims could be in the "tens of thousands".

The criminals behind the bad ads typically loaded their attack tools with code that exploited many different vulnerabilities in Windows programs.

Java and software from Adobe was becoming a favourite among hi-tech criminals, he said.

Mr Runald said cyber criminals liked to subvert advertising systems because it was a good way to get their malicious code put on popular sites with only a little effort on their part.

"Such malvertising is reasonably common," said Mr Runald. "It does not happen every day but it does happen every month or so."

[BBC]