Meldingen door Security Officer XS4ALL
Lees hier het laatste nieuws over veiligheid op internet.
Onze Security Officer* houdt u hier op de hoogte van internet abuse, zoals phishings, virussen en aanvallen op servers.
Let op: Wekelijks ontvangen enkele honderden XS4ALL-klanten weer een (andere) phishing mail. Het is ondoenlijk om al deze varianten hier te publiceren. Belangrijker is dat u phishing leert herkennen, in welke vorm dan ook. Onze medewerkers vragen nooit naar uw wachtwoord, niet via e-mail, telefoon of op andere wijze.
*Onze Security Officer spreekt Engels. Om meldingen snel te kunnen plaatsen, worden zij niet eerst vertaald.
More iPhone worms?
22-01-2010 14:42
We're seeing some evidence that the various updates to the iPhone worm mentioned last year are continuing to let it live on. It was quiet for a while, but new life has been breathed into it and if it is indeed an update/new variant, it shows just how important it is to secure your device!
Browser bingo
21-01-2010 09:13
Over the last few weeks there has been a lot of publicity given to which web browser is the most secure. The French and German governments have even come out with warnings to caution people against using Microsoft's Internet Explorer, especially older versions such as IE6 or IE7.
The choice of which web browser to use is not an easy one to make. Many people have corporate IT policy which controls which version they can use, and require ancient and insecure Explorer versions to support internal web-applications.
Unfortunately, website programmers have an even more difficult task, trying to make a site look and feel the same under all the different browsers out there.
At the moment, the vast majority of web-based targeted attacks are directed against Internet Explorer. That makes sense, because it has a very large market share, and the Bad Guys want to hit as many people as they can with their exploits and attacks.
If you can consider running an alternative browser, such as Apple's Safari (Mac/PC) or Firefox (Mac/PC/Linux) or even Google's Chrome (Mac beta/PC) you should do so.
If you are stuck using IE6 or similar for policy reasons, try to work with your IT department to encourage them to support an alternative browser for public Internet use, but, maintain IE6/IE7 only for internal applications that really need it.
If you really care about security, there are extra plugins and extensions out there to help.
As always, make sure you keep up to date with patches and updates, including to plugins such as Flash and PDF readers!
Norwegian Blue.
24-11-2009 19:29
Update: The iPhone botnet is still alive and well as of the time of this update. There are a few update mechanisms and there was more than one variation out there. The highly publicised controller may well be offline, but there were backups so the risk is still there.
We're still seeing signs of activity by infected systems (well over 150 so far) -- our advice remains the same: If you're infected, do a full system restore from Apple's software.
Avoid jailbreaking unless you really think you understand the risks, and be aware that iPhones and iPod Touches can both be vulnerable if they're jailbroken and did not plug the hole used by this botnet!
A busy few days!
24-11-2009 08:01
The iPhone worm that I discovered last week has made quite a few headlines. Unfortunately, a number of anti-virus firms falsely took credit for the "discovery" which was a shame, but they likely wouldn't have known a thing if XS4ALL didn't tell them.
The good news is that the primary controller for the iPhone botnet seems to have been de-activated. Infected phones are still infected, still attempting to spread the malware, but their ability to phone-home and receive new commands is, for now, stopped.
This worm was merely a sign of things to come. The smarter that devices get, the more valuable the information on them, and the more interest they receive from the bad guys.
Malware on mobile phones has so far been an extremely limited phenomena for many reasons -- but smartphones and netbooks and of course laptops all represent a growing interest and risk. Users of these technologies must be aware of these risks and take appropriate action. Think carefully about the data on your mobile device and about who might be able to access it, both with and without your permission!
Confirmed! New iPhone worm.
20-11-2009 15:53
I've been able to verify my last posting here - there is definitely a new iPhone worm on the loose that attacks Jailbreakers. It has the potential to access your private information and steal your SMS history, as well as phone home to the bad-guys for additional commands to run.
Jailbroken iPhone hacking.
18-11-2009 15:31
As many of you may have read, during the last few weeks there have been a few highly publicised attacks against "jailbroken" iPhones.
A "jailbroken" iPhone is an Apple iPhone which has been hacked with special software that lets the user install software which hasn't been approved, nor is supported, by Apple. Unfortunately, the jailbreaking process is really meant for people with a technical understanding of the process, as well as the risks.
One of the things that most of the jailbreaking tools do is install something known as OpenSSH, which is a programme that lets you remotely access your iPhone using the SSH protocol.
Normal iPhones from authorised resellers do not have this software, and by default there is no way to remotely access the phone. Unfortunately, when you combine the jailbreaking process with a very insecure default password chosen by Apple, the result can be quite damaging to the security of your phone, as well as the privacy of your data.
For the past few days XS4ALL has seen what we believe is possibly a new version of the iPhone worms which have been in the news. A number of customers with jailbroken phones have been found running unknown software on their phones which is trying to compromise other iPhone users at other telecommunications providers. We're working with as many customers as possible to determine the exact malware responsible, but so far none of the known iPhone worms seems to be responsible.
XS4ALL strongly advises caution against jailbreaking if you are not fully aware of the potential risks to your privacy and security. If you decide to do it anyway, make sure that you follow the instructions on the Internet about how to change the default password.