Free tools to find out if your computer is infected with Hacking Team malware

Rook Security offers Milano, a free tool to scan your PC for any possible Hacking Team malware infection. Facebook offers osquery to detect Hacking Team’s Remote Control System on OS X. Lookout has mobile covered and can detect surveillance malware on Android and iOS platforms.

Are you 100% sure your devices aren’t infected by Hacking Team surveillance malware whether that means you might be a target of some government or a victim of some cyber scum-sucker who re-purposed Hacking Team’s malware? Sure Adobe and Microsoft have issued emergency patches in response to the leaked Hacking Team exploits, but wouldn’t it be wise to scan your computer and make sure it’s not infected? Now you can check if your computer is compromised by Hacking Team’s spyware as Rook Security released a free detection tool, dubbed ‘Milano,’ to help individuals and organizations find out if their machines are infected.

Rook Security has been collaborating with the FBI Indianapolis Cyber Task Force over the “malicious and weaponizable” exploits found in the leaked Hacking Team files. To reduce the potential impact to critical infrastructure, they worked together to identify malicious files that could be weaponized. Their objectives were also to “create IOCs and briefs for the affected vendors, clients, critical infrastructure, FBI, U.S. Secret Service, DHS, ISPs and others;” to examine if any clients were impacted, and to “create a capability that can be used to determine if they were compromised by Hacking Team files.”

The newest version of Milano was improved from 40 file hashes to 312 malicious or weaponizable file hashes, Rook Security’s Tom Gorup said yesterday when announcing the release of Milano v1.0.1. The updated IOC’s (Indicators of Compromise) are bundled with the new Milano version. “It is not necessary to download both Milano and the IOC files. We provided both to allow users to leverage this information with any tool in their arsenal.”

Gorup added:
Up to this point we have focused our efforts on a Windows executable and DLL files. We have completed analysis of over 800 windows, exe, and dll files resulting in 312 total executable files tagged as malicious or that have the ability to be utilized to support espionageware.

Additionally, our analysis continues and is focused on Linux and OSX specific files. We have identified 126 files specific to Linux at this point. As we complete the analysis of these files we will be releasing new IOC files, so please check back here on our blog for more information.

Milano features will be enhanced in the “near future” to include “auto OS detection, auto ICO update, and OpenIOC formatted files as an input. Once released, these features will provide Milano with the ability to run as a script with the functionality to identify which operating system is running and search for the OS specific IOC’s. The auto update feature will update the IOC’s it is hunting for every time it executes. This will ensure that future updates of IOC’s will be automatically applied each time Milano is executed.”

You can use Milano to perform a quick scan or a deep scan to find Hacking Team associated files. Hacking Team’s Unified Extensible Firmware Interface (UEFI) BIOS rootkit is particularly worrisome; it can keep its Remote Control System (RCS) agent installed on its targets’ systems by surreptitiously reinstalling. That's “even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running.” Just in case Milano can catch that, a deep scan would seem like the best option even though it takes a while to run.

After downloading and unzipping Milano v1.01, you will see a document with Rook’s Hacking Team data review as well as a folder called “RookMilano.” Open the RookMilano folder to see:

Rook Security
After extracting the Milano file contents, clicking on milano.exe should run the program...unless you are on a 64-bit machine. Rook Security told me the program is for 32-bit boxes, but Windows 8.1. 64-bit users can run the program by using command prompt and changing directories to where milano.exe is

When Milano opens, you’ll see a logo; press Enter. After you see the legal limitation of liability statement, then press Enter again. After you see a limitation of software services as-is statement, press Enter again. Then you are given the option to select “q” for quick scan or “d” for deep scan; select one and then hit Enter. You may be asked if you would like to use the default path for Windows; you can select either yes or no, but if you don’t know then try “y” for yes and press Enter.

As it scans each item, you will hopefully see “file clean.” After the scan is completed, any files that require review will be marked with A for detected via VirusTotal, B for detected via manual analysis, C for from malicious project, or D for undetermined. The results are saved as a text file. If you don’t see any file marked with the above notations, then happy day for it’s all good and clean.
Rook Security's Milano deep scan results

Rook’s Hacking Team data review includes a table with data from the GitHub HackingTeam Repository; Rook flagged some of the files with a “W” meaning it could be weaponized.

Previously the free surveillance malware detection tool Detekt could find traces of remote control system toolkits created by FinFisher and the Hacking Team. But it was only a matter of time before the spyware was tweaked by the vendors and that tool became obsolete. It would be wise to scan and know for sure that your machines aren’t infected, but if you need convincing to try Milano then consider what Amnesty International said when Detekt was released. “Imagine never being alone. Someone looking over your shoulder, recording every computer keystroke; reading and listening to your private Skype conversations; using your phone’s microphone and camera to monitor you and your colleagues, without you even knowing it.”

If you think that is unlikely, then think again as researcher Collin Mulliner found out the Hacking Team – “scumbags” who “sell to repressive governments”— had taken his open source exploit tools and rolled them into its Android surveillance software which it sold to spy-happy governments worldwide. “I'm pretty angry and sad to see my open source tools being used by Hacking Team to make products to spy on activists,” Mulliner said. In one example, Mulliner pointed at his Android voice call interception tool which Hacking Team took to capture audio such as conversations within earshot of infected Android phones.

Protection from Hacking Team malware for Android and iOS mobile devices
If that makes you concerned about the possibility of your phone being infected with Hacking Team’s surveillance malware, then Lookout sent an email saying its “customers, on both Android and iOS platforms, are protected from all current forms of Hacking Team spyware products.”

Detection of Hacking Team spyware for OS X
Lastly, Facebook released new osquery query packs to detect Hacking Team’s Remote Control System on OS X. “Attackers continue to develop and deploy Mac OS X backdoors. We've seen this with Flashback, IceFog, Careto, Adwind/Unrecom, and most recently, HackingTeam. The OS X-attacks pack has queries that identify known variants of malware, ranging from advanced persistent threats (APT) to adware and spyware. If a query in this pack produces results, it means a host in your Mac fleet is compromised with malware. This pack is high signal and should result in close to zero false positives.”

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Apple Watch: Success by any other product would, for some, smell sweeter

How you measure (and value) the success of a high tech product isn't just about numbers sold or profitability

What does success mean when we’re talking about selling products in the high-tech sector? The answer depends on which criteria you think define success. Some might argue for the number of users, adoption rate, or market share, while others might rely on revenue or profit.

While these are all measures of success they also aren’t the whole story. The fact is that success with high-tech products is always far more complex than a single measure … which brings me to the wave of articles this week declaring that the Apple Watch is becoming a failure.

Driving this wave was a report from Slice Intelligence on Apple Watch sales figures that was widely mis-interpreted, most notably in a Marketwatch article. According to Marketwatch:

Sales of the new Apple Watch have plunged by 90% since the opening week, according to a new market-research report.

Apple … has been selling fewer than 20,000 watches a day in the U.S. since the initial surge in April, and on some days fewer than 10,000, according to data from Palo Alto, Calif.-based Slice Intelligence.

That is a sharp decline from the week of the April 10 launch, when Apple sold about 1.5 million watches, or an average of about 200,000 a day, Slice estimates.

The problem with Marketwatch’s interpretation of Slice’s data lies in assumptions about the accuracy of Slice’s methodology. Here’s the background: Slice has an app that’s a “shopping assistant”; the company explains:

Watching your deliveries is more convenient and beautiful than ever--and now you can know at a glance exactly where your stuff is at all times. … Slice keeps an eye on your purchases for you—watching for price drops, tracking your packages, and alerting you on hazardous product recalls. Never enter a tracking number again! It’s all done automatically with the e-receipts in your email ...

The purchases referred to are only your online purchases and that’s why the reported steep decline in sales should be taken with a big pinch of salt. Marketwatch’s assumption was that the data were representative of the market as a whole, something that Slice points out in its report.

For example, the initial high sales were impressive and driven by people who pre-ordered. On the other hand, those of us who are more cautious, wanted to see the product before we bought it which has definitely resulted in delayed and in-store purchases that Slice knows nothing about. This makes the argument that the Apple Watch is a flop based on Slice’s report a pretty weak one. Sure, sales might be slowing but catastrophically? I don’t think so.

Moreover, the connected watch category is one that Apple now dominates. According to research firm IHS, Apple’s share of the market is around 56% and the company will ship something like 19 million units.

So, if you measure success by market dominance then I’d say the the Apple Watch is a huge success. What we don’t know for sure is whether the Apple Watch is profitable (the real sales figures and margins for the Apple Watch are not broken out in their financials) and from an IHS teardown it looks like the Watch might be a good little earner: “[the] Apple Watch has the lowest hardware costs compared to retail price of any Apple phone IHS Technology has researched.”

And, guess what, even if it were not profitable, it wouldn’t matter. Apple makes so much money on its core products (just under $102B from iPhones; just over $30B from iPads, $24B from Macs; $18B from iTunes and software) that any losses on the Apple Watch would be minimal (as a friend commented, “equivalent to a rounding error in their coffee fund”) and more than offset by the enhanced brand awareness and public relations value.

Now, looking at the Apple Watch from a reviewer’s viewpoint, I’d suggest that the Apple Watch has all the hallmarks of success because it’s pure Apple; outstanding in design, fairly useful (by which I mean considerably more useful than other connected watches I’ve tested), and it has a vibrant and growing third party application market.

So, given what we know about the Apple Watch and its sales and marketplace standing I’d say the product’s success is undeniable. What’s also undeniable is that there are a lot of people out there who’d like to see Apple taken down a peg. That’s something that may eventually happen but it won’t be because of the Apple Watch.

---

Best comptia A+ Training, Comptia A+ Certification at Certkingdom.com

Mozilla to pick up Firefox release pace, ship version 'soon' for Windows 10

Mozilla will accelerate the release of new features for its Firefox browser, dumping its current 18-week development schedule for something nimbler, a company manager told contributors last week.

The firm will also deliver a browser for Windows 10, a reversal of a 2014 decision to stop work on a touch-based version of Firefox for Microsoft's OS.
MORE ON NETWORK WORLD: 3D printing will transform these five industries

In a pair of messages that Dave Camp, director of Firefox engineering, posted to a mail list, as well as a blog post, Mozilla summarized some of the decisions it reached at an all-hands meeting in Whistler, a Canadian ski resort town north of Vancouver, BC, last week.

"Since Firefox began, the industry has continually evolved how it deploys code to users, and today it isn't done on an 18-week cycle," Camp wrote, referring to the current development cycle, which runs new features through three six-week stretches and a trio of browser builds. "We think there are big wins to be had in shortening the time that new features reach users. As Laura Thomson put it in her Whistler presentation -- 'The trains have served us well, but it's time to build a hyperloop.'"

Camp offered few details about the schedule plans, in large part because they haven't yet been worked out. Unlike other browser makers, Mozilla relies not only on paid developers but also on a community of volunteers, and typically holds public discussions with that community before it decides how to proceed.

"Some of these questions are going to take a while to answer, and will involve a bunch of concurrent discussions," Camp said.

Camp also touted a new concept for Firefox development he labeled "Great or Dead." The idea, he said, was that "every feature in the browser should be polished, functional and a joy to use." In instances where engineers can't meet that bar, the feature should be canned or instead passed to a partner.

Mozilla did the latter last month when it baked the Pocket reading list app into Firefox. Some, however, objected to Pocket's integration, while others argued that the service's privacy and licensing policies were contrary to Mozilla's.

In another message to the same development mailing list, Cook said that Mozilla would change how it implements partners' code. "Folks said that Pocket should have been a bundled add-on that could have been more easily removed entirely from the browser," Cook wrote. "We tend to agree with that, and fixing that for Pocket and any future partner integrations is one concrete piece of engineering work we need to get done."

Another high priority, said Cook, was Electrolysis, or "e10s" for short, Mozilla's attempt to bring multiple processes to Firefox by separating page rendering from content to make the browser more secure and more stable. Rival browsers, including Apple's Safari, Google's Chrome and Microsoft's Internet Explorer (IE), already operate with separate processes.

"One of the first things we need to get right is e10s," said Cook. "e10s is the only way to get the kind of snappy experience we need to make Firefox feel great. We're close, but it's going to take some effort to get over the line."

Mozilla recently beefed up the engineering staff working on e10s, a project that originated in 2009 but has long languished.

Mozilla's intent to speed up Firefox's release schedule was reminiscent of the accelerated tempo Microsoft has pledged for Windows 10 and its bundled Edge browser, which will ship later this month. It wasn't a complete surprise, then, that Mozilla teased a release of Firefox for Windows 10, saying that the browser, like the one it's been creating for Apple's iOS, would ship "soon."


In March 2014, Mozilla abruptly abandoned work on a touch-enabled Firefox for Windows 8, citing apathetic adoption of the previews and taking a swipe at Microsoft's bifurcated OS along the way. The cancellation put a match to two years of work by Mozilla's engineers and designers, although the company said it would not discard the code, but mothball it for possible use down the road.

That time has apparently come.

Mozilla did not provide any further information about Firefox for Windows 10 or iOS, other than to say that it planned to provide an "independent and high-performing alternative to the stock browser" on both platforms.

Mozilla's work on Firefox will be crucial to the company. The browser remains its most potent weapon -- efforts in mobile, particularly Firefox OS, have failed to capture the imagination of users -- because search deals cut with the likes of Yahoo are its primary money makers.

Firefox's user share has plummeted in the last two years, declining by 42% during the period. So far in 2015, however, its share has stabilized around 12% of all browsers worldwide, ending June with 12.1%, up slightly from the month prior. Firefox's losses have gone almost entirely to Chrome, which could reach the 30% milestone as early as November.

---

Best comptia A+ Training, Comptia A+ Certification at Certkingdom.com