Many popular mobile apps, including Rovio’s ubiquitous Angry Birds, collect and share players’ personal information much more widely than most people realize. Some news reports have begun to scratch the surface of the situation. The New York Times reported on Angry Birds and other data-hungry apps last October. And in January, the newspaper teamed up with public-interest news site ProPublica and U.K. newspaper the Guardian for a series of stories detailing how Read more...
Archive for 'March 2014'
A Little Bird Told Me: Personal Information Sharing in Angry Birds and its Ad Libraries
March 27, 2014 11:30 AM By Jimmy Su, Tao Wei, Jinjian ZhaiFrom Windows to Droids: An Insight in to Multi-vector Attack Mechanisms in RATs
March 18, 2014 4:00 AM By Thoufique Haq, Hitesh Dharmdasani, Vinay Pidathala, Nart Villeneuve
FireEye recently observed a targeted attack on a U.S.-based financial institution via a spear-phishing email. The payload used in this campaign is a tool called WinSpy, which is sold by the author as a spying and monitoring tool. The features in this tool resemble that of many other off-the-shelf RATs (Remote Administration Tools) available today. We also observed a second campaign by a different attacker where the WinSpy payload was implanted in macro documents to attack various Read more...
Spear Phishing the News Cycle: APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370
March 25, 2014 12:01 AM By Ned Moran, Alex Lanstein
While many advanced persistent threat (APT) groups have increasingly embraced strategic Web compromise as a malware delivery vector, groups also continue to rely on spear-phishing emails that leverage popular news stories. The recent tragic disappearance of flight MH 370 is no exception. This post will examine multiple instances from different threat groups, all using spear-phishing messages and leveraging the disappearance of Flight 370 as a lure to convince the target to open Read more...
Android.MisoSMS : Its Back! Now With XTEA
March 31, 2014 4:00 AM By Hitesh Dharmdasani, Vinay Pidathala
FireEye Labs recently found a more advanced variant of Android.MisoSMS, the SMS-stealing malware that we uncovered last December — yet another sign of cybercriminals’ growing interest in hijacking mobile devices for surveillance and data theft. Like the original version of the malware, the new variant sends copies of users’ text messages to servers in China. But the newest rendition adds a few features that make it harder to detect, including a Read more...
A Detailed Examination of the Siesta Campaign
March 12, 2014 7:57 PM By Ned Moran, Mike Oppenheim
Executive Summary FireEye recently looked deeper into the activity discussed in TrendMicro’s blog and dubbed the “Siesta” campaign. The tools, modus operandi, and infrastructure used in the campaign present two possibilities: either the Chinese cyber-espionage unit APT1 is perpetrating this activity, or another group is using the same tactics and tools as the legacy APT1. The Siesta campaign reinforces the fact that analysts and network defenders should remain on the lookout for Read more...
Setting Traps and Going Hunting
March 11, 2014 3:40 PM By Helena BritoAs part of our podcast series, live from the RSA USA Conference, we are digging into the topic of advanced threats, attacks, and best practices to implement on the network. In this podcast, our host, Richard Bejtlich, sits down with Chris Bream, director within Professional Services at Mandiant to discuss the latest trends in attacks, how they are continuing to evolve their tactics, and the shift that is required in the security industry to address the latest threat landscape.
Read more...Investigating with Indicators of Compromise (IOCs) – Part II
March 5, 2014 8:42 PM By Will GibbWritten by Will Gibb & Devon Kerr
Read more...Information Overload Addressed by Next-Gen SOC
March 13, 2014 7:56 PM By Helena BritoOver the past couple of years Big Data has become one of the buzz words for industry and government. Hardly a minute goes by when you don't hear someone talking about it on the conference exhibitor floor. As part of our podcast series, live from the RSA USA Conference 2014, Richard Bejtlich, chief security strategist at FireEye, talks to Ron Bushar, director of Mandiant's SOC/CIRT Services team about managing and analyzing data in today's security operations center (SOC) and what is required to address the exponentially growing amounts of data.
Read more...
Sign up for email update
Get information and insight on today's advanced threats from the leader in advanced threat prevention.
