TechBlog

Sophos Labs: There are two stories that have been the focus of much speculation that have come to some closure today. New information confirming many peoples suspicions about Aurora and Stuxnet have been reported by Wikileaks.org and Reuters. As has been widely reported Wikileaks began releasing over 250,000 previously secret diplomatic cables that it is assumed they received from PFC. Bradley Manning. Most of the cables are as uninteresting as reading your friends Yahoo! mail. ...

You might want to steer clear of the following fake security program, being promoted as a “Windows Trojan Removal Kit” but actually hijacking your PC in the form of the ThinkPoint rogue with a mixed (24/43) detection rate. The file is currently being offered up by your typical “fake security scan” pages, such as microsoftwindowssecurity152(dot)com. Those familiar with this particular rogue will be aware that it tends to stick with domains similar to the one above. ...

CNN – Mashable: Today, users can start connecting with all their favorite social causes in one online sphere, as Facebook co-founder Chris Hughes has launched his much-buzzed-about social network, Jumo. Hughes, who left Facebook in 2007 to become the Obama campaign’s director of online organizing, soft-launched Jumo last March. At that time the site existed merely as a homepage featuring a rather intriguing survey box that asked the site visitor an array of questions from, “If you had a daughter tomorrow, which would you name her?” to “Would you say the world is getting better or worse?” ...

Mashable: Controversial whistleblower website WikiLeaks is reporting that it’s under a “mass distributed denial of service attack” just as its much-hyped leak of secret embassy cables has been leaked early on Twitter. According to a tweet from the website’s official Twitter account, WikiLeaks is experiencing a DDoS attack. The reported attackers are not yet known. Several reports state that the website has been experiencing intermittent downtime. We are currently attempting to verify that WikiLeaks is indeed under attack. ...

SophosLab: Once again, a rogue application is spreading virally between Facebook users pretending to offer you a way of seeing who has viewed your profile. As we’ve described a couple of times before, plenty of Facebook users would *love* to know who has been checking them out online.. but unfortunately scammers are aware of this, and use the lure of such functionality as a way to trick you into making bad decisions. ...

Over the last few days, some news organizations have been saying that Stuxnet source code is available on the black market, and that clearly therefor there is an impending Internet Armageddon. This is patently silly, on a number of levels, but silly none-the-less. First thing is that I flat-out don’t believe Stuxnet source is available for sale on the black market or anywhere. Remember how often I say that if something sounds too good to be true, it’s not true? Well, the opposite applies too. If something sounds too bad to be true, it’s not true either. We really don’t know who built Stuxnet, or who the intended target was, be we may rest assured that whoever put that much work into it, isn’t selling it, at any price. It’s actually more probable that some no-honor-among-thieves bad guy is scamming fellow bad guys. “Sure, this is Stuxnet source code. Prove otherwise.” ...

Thomas Wegele, Virus Researcher from Avira wrote: In this month’s ITW malware set from the Wildlist organization two new variants of W32/Ramnit appeared. W32/Ramnit is a Worm spreading via infected executable files and infected HTML Files. It is a quite widespread malware – which is why we decided to dig deeper into it. Upon execution the malware creates a new file in the directory where it was started. This file is named “mgr.exe”. It then gets executed and creates a copy of itself in “C:%ProgramDir%\Microsoft\WaterMark.exe” which also gets executed after creation and in turn infects the EXE, DLL and HTML files found on the system and tries to connect to a server. ...

The Swedish Appeals Court upheld the conviction and jail sentences of three co-founders behind the infamous The Pirate Bay service. Peter Sunde, Fredrik Neij and Carl Lundstrom all received one-year jail sentences and $4.2 million in fines from a Swedish lower court earlier in the year. After the court ruling, Neij has been given a 10-month sentence, Sunde received an eight-month sentence, and Lundstrom was given a four-month sentence. A different defendant will be sentenced at a later date because he was unavailable due to illness. ...

Google Chrome has always supported multiple profiles, but you had to use a command-line flag (–user-data-dir=”c:\path\to\the\profile”) to associate a profile with a folder where the browser will save its state. At some point, Google added an option that allowed you to open a new window and use a separate profile, but it was quickly removed. According to a design document from Chromium’s site, this feature be available again. “The multiple profiles feature will allow the user to associate a profile with a specific set of browser windows, rather than with an entire running instance of Chrome. Allowing different windows to run as different Chrome identities means that a user can have different open windows associated with different Google accounts, and correspondingly different sets of preferences, apps, bookmarks, and so on — all those elements which are bound to a specific user’s identity.” ...

For those who missed this update on Nov 18: In the spirit of releasing early and releasing often – Mozilla bring you version 0.2 of Rainbow – an experimental Firefox add-on from Mozilla Labs that exposes audio and video recording capabilities to web pages. What’s new in this release? It now support both audio and video recording on Windows, and audio recording on Linux. They added preliminary support for writing multiplexed media frames to a websocket. JS callers are now able to specify custom video resolutions, encoding quality, audio sampling rates and channels. Numerous bug fixes, such as behaving correctly on Mac OS X 10.5 (Leopard), and generating correctly encoded OGG files (the audio tracks of which were previously unplayable by Firefox). For a full list of changes, check out their commit logs – or even better – contribute on Github! Also, don’t forget to read the README for additional information. ...