Written by: Vandita

Did you get an email with attached word document file with the name CHRISTMAS OFFERS.docx? You should thank your stars for not receiving one and even if you did, for not opening it. This Christmas spammers have gone creative and found innovative ideas to infect your PCs. Taking advantage of the festive season, they are infecting computers all over the world by emailing a tempting word document file with the name CHRISTMAS OFFERS.docx. The malware is targeted at shoppers looking for the best deals this time of year.

It might be tempting to open the attachment to know more about the offers; however, those who opened the docx file found it blank. The CHRISTMAS OFFERS.docx requires users to enable macros. Microsoft Word supports the use of macros to allow the automation of frequently performed tasks. Vulnerability exists because an attacker can craft a malicious document that will bypass the macro security model. The malicious macro could add, change, delete data or files, communicate with a website, or format the hard disk. By default, macros are disabled. So those who fell prey to the temptation, clicked on the enable macros button, and got infected.

People with malicious intent could write Visual Basic for Applications code to create macros that can spread virus through e-mail attachments, disks, networks, modems, and the Internet and is extremely difficult to detect. They could then embed these macros in Office documents and distribute them online. The best way to avoid a macros virus is to run the OfficeMalScanner – a forensic tool to scan for malicious traces in a document.

If you trusted the CHRISTMAS OFFERS.docx and opened it, here’s what most probably would have happened: The enabled macros remotely downloaded a file from the URL hxxp://jasoncurtis.co.uk/js/bin.exe and then ran it from your temp folder. What you downloaded onto your PC was a banking Trojan known as Dridex recognized by Malwarebytes. Those who survived the spam email unharmed must have used Malwarebytes Anti-Exploit Premium that would have warned them of the danger of opening the infected file.

The fake Christmas offers by Santa consequently warn you that while you should be aware of emails that carry seemingly harmless Office documents, you should only run macros from sources you trust to avoid any mishap.

____________________________________________________________

Source:

http://hackread.com/santas-fake-christmas-offers-infect-pcs-with-banking-malware/

Written by: Vandita

A few weeks ago when the Swedish government raided torrent download website The Pirate Bay (TPB) “in connection with violations of copyright law” the Internet community the world over went berserk.

After being offline for quite some time, TPB website recently showed some signs of a comeback with a ticking clock, with the Jolly Roger (skull and crossbones Pirate flag) waving in the background. The website has been updated with a hash code on the left corner.  Hash codes can identify a torrent on the Internet and these cannot be blocked even though the parent website is blocked thus making it easier for the user to access a torrent.

TPB has also added a cartoon sketch of North Korea dictator Kim Jong-un probably due to reports that are pointing fingers at North Korea for instigating the hacking of Sony Pictures Entertainment.  The Sony Hack was a substantial security breach with the attackers stealing terabytes of private data including details of employees’ salary and their performance, unreleased movies, e-mails and a print of the controversial movie The Interview. The Interview has been pirated approximately 900,000 times in the first 24 hours after it appeared on various torrent sites, according to Variety.  The Pirate Bay has now released a download link to a full HD print of the film.

TPB has used the hash codes to grant its users access to The Interview. Here’s Techworm’s step-by-step guide to download torrents using hash codes:

• The hash code is seen on the bottom left corner of the website, written from top to bottom.
• Copy this hash code and paste it in your browser.
• Since a magnet URI is needed to access the file, you will need to add “magnet:?xt=urn:btih” as a prefix before the hash code.
• Paste the URL in your browser and the torrent client will open automatically.
• Wait for the Meta data to download and you will have your torrent file.

If you glance at TPB’s website, you will find a string of letters written below Kim’s image. This is a cryptic key that says, “You cannot destroy us, expect the ship to arrive in 20 days”. The Pirate Bay is coming back for sure. Let’s wait and watch when and how…

_____________________________________________________________

Source:

http://www.techworm.net/2014/12/the-pirate-bay-the-interview-download-links.html

Written by: Vandita

The Pirate Bay website is defaced with North Korea’s leader Kim Jong-un’s cartoon.

In November, ‘the galaxy’s most resilient BitTorrent site’ went offline; its servers were shutdown, domain was seized, and its owner Fredrik Neij was arrested by Swedish police. It was back online, well sort of, a few days ago with a black Pirate flag.

Here’s the current status: The Pirate Bay domain has been defaced and left with a funny image of Kim Jong-un, the despotic leader of Democratic People’s Republic of Korea.

A Hackread investigation reveals that the group could be from Algeria going with the handle of ‘Algerian Security Down Team’. It seems the team could upload an image of their choice while keeping the Pirate Flag on.

This was the original Pirate flag waving on main TPB website:

This is the Kim Jong-un cartoon uploaded by the ‘hackers’:

And this is the update of http://thepiratebay.se/ at the time of writing this article:

Last week, The Pirate Bay domain showed a pirate boat with multiple reptile heads, perhaps hinting at Hydra — a Greek mythological figure that grew two heads for every head that was cut off. There could be a possibility, therefore, that TPB is planning to allow users create their own Pirate Bay clone under ‘The Open Bay’ project that lets Netizens put a copy of TPB online without much technical knowledge. This could be inferred from what TPB’s ‘Mr 10100100000’ told Torrentfreak recently: “We’ve always lived by Kopimi. We love being cloned. It would be amazing if, like in the classic movie Spartacus, everyone could stand up and say “I am The Pirate Bay”.

While there is a great probability that TPB wants to create as many clones as possible so that it never goes dark, it is still not clear why the image of hydra was replaced with Kim Jong-un by TPB team. If TPB was to be hacked, the hackers would deface the whole website not just the replacement of an image…

______________________________________________________________________

Source:

http://hackread.com/the-pirate-bay-website-defaced-with-kim-jong-un-cartoon/

http://thehackernews.com/2014/12/the-pirate-bay-showing-nkorea-kim-jong_26.html