‘Insidious and sick’ Fruitfly malware has been spying on Mac users via their computer’s camera for YEARS

A type of malware that has infected hundreds of Macs remained undetected for years

FruitFly malware uses the Mac’s camera to spy on users and log what is happening on screen.

A security firm called Malwarebytes discovered FruitFly earlier this year, but researchers have since found a new strand of it hiding under a slightly different code.

Scroll down for video

FruitFly uses the computer's camera to spy on users and logs what is happening on screen - and it's been infecting computers for years (stock image)

FruitFly uses the computer’s camera to spy on users and logs what is happening on screen – and it’s been infecting computers for years (stock image)

FRUITFLY

FruitFly uses the computer’s camera to spy on users and captures key strokes and what is happening on screen – and it’s been infecting computers for years.

There are multiple strains of FruitFly which rely on different codes, making it particularly hard to detect.

According to security firm Synack, there are around 400 computers known to be infected with FruitFly and likely to be many more.

Although they are not sure when the bug first came around, researchers have found it works on the Mac Yosemite operating system – which was released back in October 2014.

According to security firm Synack, there are around 400 computers known to be infected with FruitFly and likely to be many more.

Although they are not sure when the bug first came around, researchers have found it works on the Mac Yosemite operating system – which was released back in October 2014.

‘Mac users are over-confident’, Patrick Wardle, chief security researcher at security firm Synack told CNN.

‘We might not be as careful as we should be on the internet or opening up email attachments’, he said.

Mr Wardle anaylsed the strain for months and then managed to decrypt it to set up a server that intercepted signals from computers that had been infected.

‘Immediately, tons of victims that had been infected with this malware started connecting to me,’ he said.

There are multiple strains of FruitFly which rely on different codes, making it particularly hard to detect.

It is now known how it first got on computers but Mr Wardle does not believe it is part of state espionage.

MacSpy (pictured) allowed users to monitor an infected system, capture passwords and other sensitive details through the use of key stroke logging, screenshots and clipboard contents

MacSpy (pictured) allowed users to monitor an infected system, capture passwords and other sensitive details through the use of key stroke logging, screenshots and clipboard contents

MACSPY AND MACRANSOM

In June, Mac users were warned to be vigilant after two separate pieces of malware emerged from the dark web – MacSpy and MacRansom.

MacSpy allowed users to monitor an infected system, capture passwords and other sensitive details through the use of key stroke logging, screenshots and clipboard contents.

MacRansom worked in a similar manner to the WannaCry software that plagued computer systems around the world, including the NHS, last month.

It encrypted the contents of a user’s computer and threatens to delete all of the information it contains, unless a ransom of 0.25 Bitcoins, around £530 ($684), is paid.

‘I believe its goals were a lot more insidious and sick: spying on people,’ Mr Wardle said

Apple has been contacted for comment.

In June, Mac users were warned to be vigilant after two separate pieces of malware emerged from the dark web.

The tools were specifically developed to allow would-be hackers to takeover Apple’s desktop and laptop machines, and even ransom their data.

They were being given away for free by their creators, who are believed to be professional software engineers.

The two systems were called MacSpy and MacRansom.

MacSpy allowed users to monitor an infected system, capture passwords and other sensitive details through the use of key stroke logging, screenshots and clipboard contents.

MacRansom worked in a similar manner to the WannaCry software that plagued computer systems around the world, including the NHS, last month.

It encrypts the contents of a user’s computer and threatens to delete all of the information it contains, unless a ransom of 0.25 Bitcoins, around £530 ($684), is paid.

[“Source-dailymail”]

Microsoft 365 Is The Office And Windows Bundle Targeted At Business Users

Microsoft has just unveiled Microsoft 365, which bundles together Office 365, Windows 10, and Enterprise Mobility + Security, giving “a complete, intelligent and secure solution to empower employees.”

Microsoft Announces New Office 365 Plans For Businesses

Essentially, Microsoft 365 is a new way for enterprises to purchase Office and Windows together, bundling the company’s mainline software into a single subscription. In addition, it’ll also offer users Microsoft 365 Business, debuting via public preview come Aug. 2. It includes Office 365 Business Premium and security and management features for Office software and devices running Windows 10.

Microsoft’s CEO Satya Nadella unveiled both types of bundles at its Inspire partner conference, attended by 17,000 people, who were there to hear about Microsoft’s partnerships and other plans.

Microsoft says the workplace is changing, especially by virtue of teams often being distributed globally. From such trends, the company observes a new culture that’s emerging. Its new plans are a reflection of those.

Microsoft 365 Enterprise And 365 Business Plans And Release Date

Microsoft 365 Enterprise will be offered in two plans: Microsoft 365 E3 and Microsoft 365 E5. Both will launch on Aug. 1. Microsoft hasn’t laid the details on pricing yet, but says it’ll depend on the specific plan and “other factors.”

Microsoft 365 Business, meanwhile, will launch its full stable release later this fall following the public preview on Aug. 2. It will cost each user $20 a month.

Ahead of both release dates, Microsoft will let users try three applications coming to both Office 365 Business Premium and Microsoft 365 Business. These applications include Microsoft Connections, an email marketing service; Microsoft Listings, a publishing tool for business information; and Microsoft Invoicing, which is pretty self-explanatory.

The company has also included MileIQ, its mileage tracking app, into Office 365 Business Premium. In addition, Microsoft has also launched Azure Stack, which allows businesses to host their own hybrid cloud. Several companies including HP, Lenovo, and Dell are all building systems to run Azure Stack, the first shipments of which launches September.

Microsoft’s cloud business has been one of its most profitable units in recent years, a sort of saving grace from the tumble of its Windows Phone venture and other less alluring products and services. As the company treads the way of the cloud further, we might see Microsoft approach cloud-based services more extensively going forward.

“We are incredibly enthusiastic about Microsoft 365 and how it will help customers and partners drive growth and innovation,” said Microsoft.

Thoughts about Microsoft new Office 365 bundles? Feel free to sound off in the comments section below!

[“source-techtimes”]

Google to Start Urging SMS Two-Step Verification Users to Shift to Prompts

Google to Start Urging SMS Two-Step Verification Users to Shift to Prompts

There have been plenty of cyber-attacks in the recent past that would make anyone feel the need to add some additional security measures to protect their digital information. Two-step verification (2-SV) aka two-factor authentication is one of these measures being used by tech giants like Google, Microsoft and Apple over the past few years. Google, in particular, tried to make the whole two-step authentication process simpler last year by introducing ‘prompt’, which does not require users to input an SMS code. But there are some users who still prefer the old SMS route, and for them, Google has a plan to shift them to Prompts.

Starting next week, SMS 2-step verification users will see an invitation to try out Google prompts when the try to sign into, say Gmail, so that they are informed about the new alternative. Essentially, Google prompts simplifies the two-step verification process by removing the need to enter an OTP sent as SMS every time a user is trying to sign into a device. The prompt verification, instead, simply brings a pop-up on a user’s phone with a message “Are you trying to sign-in?” Followed by the device and location from where the sign in is taking place. The approval prompt gives a simple “Yes” or “No, It’s Not Me” option, which a lot simpler than having to input a code.

Google says that one of the reasons behind pushing users to shift SMS two-step verification users to prompt is due to security concerns as text messages and one-time codes are more susceptible to phishing attempts by attackers. “By relying on account authentication instead of SMS, administrators can be sure that their mobile policies will be enforced on the device and authentication is happening through an encrypted connection,” Google says.

The tech giant also updated prompt in February to show more information such as the name and location of the device attempting to sign into your account. For those still using SMS codes, expect to see the prompts preview starting next week. The prompt feature is available to Android as well as iOS users, although iOS users will need the Google search app installed to use prompts.

[“source-gadgets.ndtv”]

Microsoft looks to the cloud to make Windows 10 safer for enterprise users

Image result for Microsoft looks to the cloud to make Windows 10 safer for enterprise usersWe already knew that the next version of Windows 10, the Fall Creators Update, will feature a large number of new tools for consumers. While it was always clear that business users would also get their fair share of updates, Microsoft remained pretty quiet about what those would look like. That’s changing this week, as the company today announced a number of new security features for Windows 10 that will launch with the Fall Creators Updates later this year.

Rob Lefferts, the director of program management for Windows Enterprise and Security, told me that the company is obviously aware of the changing security landscape, which now often includes well-funded and supported hackers. To stay ahead of these threats, the company is doubling down on its existing security efforts, but in addition, it’s now also pushing ahead with new initiatives that emphasize cloud intelligence with AI and machine learning.

So while the team is hardening the Windows 10 platform with this new release — just like it has done with all the previous releases — it’s also building up its efforts to use the cloud to analyze security threats and prevent attacks.

As Lefferts noted, 96 percent of the attacks that Microsoft is seeing are distinct attacks. That’s partly because malware is now often polymorphic but also because the company is seeing more custom attacks.

 

One of the main vectors for attacking any desktop operating system is the browser. Back in 2016, Microsoft announced that it was working on a sandboxing technique — the Windows Defender Application Guard — that would allow it to stop attackers from ever getting a foothold on the machine, even if they were able to penetrate the browser’s defenses. It took the company quite a while to get this to market, but the next version of Windows 10 will now ship with support for this feature. Lefferts told me that it took the team a while to figure out the right user experience to enable this feature, which is hard when you start every browser session from zero. The team also had to ensure that it could quickly spin up these micro-containers with the Edge browser fast enough.

In addition, Microsoft is also improving the Windows Defender Exploit Guard with data it gathers from across its users. The Exploit Guard features a large set of intrusion rules and policies and Microsoft says that this feature should now help protect organizations better against quite a few advanced threats, including zero day exploits.

The company has now also built the Enhanced Mitigation Experience Toolkit (EMET), which was previously available as a stand-alone tool, right into Windows 10. Lefferts stressed that this was something that Microsoft’s users had asked for.

 

Microsoft is also extending the Windows Defender Advanced Threat Protection (ATP) feature that allows enterprise security teams to detect and respond to threats to include the Windows Server OS for protection across platforms. What’s more interesting, though, is that ATP is now linked to Microsoft’s cloud-based security services that use advanced analytics and machine learning to understand threats based on the huge number of signals Microsoft receives from across its users. The company is also using this cloud-based protection model to improve Windows Defender Antivirus.

Other new features include an improved version of Device Guard, the company’s service for managing which applications an enterprise user can run on a company-issued machine. Device Guard is now also integrated into Windows Defender ATP, which should make it easier to manage for IT and security teams. In addition, companies that want to opt into this can now use data from the Microsoft Intelligent Security Graph, which combines billions of data points to analyze threats, to automatically allow users to install applications that are most likely safe to install (thing Microsoft Word, Excel, etc.).

Lefferts noted that Microsoft’s goal is to bring together all of its compute, big data and machine learning smarts — combined with data it gathers from its users around the globe and traditional signature-based approaches — to protect its customer’s machines. “We think the Fall Creators update takes full advantage of Windows threat protection and we are pushing forward,” he said.

[“Source-techcrunc”]

Oracle survey: Java EE users want REST, HTTP/2

Oracle survey: Java EE users want REST, HTTP/2

In September and October, Oracle asked Java users to rank future Java EE enhancements by importance. The survey’s 1700 participants put REST services and HTTP/2 as top priorities, followed by Oauth and OpenID, eventing, and JSON-B (Java API for JSON Binding).

“REST (JAX-RS 2.1) and HTTP/2 (Servlet 4.0) have been voted as the two most important technologies surveyed, and together with JSON-B represent three of the top six technologies,” a report on the survey concludes. “Much of the new API work in these technologies for Java EE 8 is already complete. There is significant value in delivering Java EE 8 with these technologies, and the related JSON-P (JSON with Padding) updates, as soon as possible.”

Oracle is pursuing Java EE 8 as a retooled version of the platform geared to cloud and microservices deployments. It’s due in late-2017, and a follow-up release, Java EE 9, is set to appear a year later.

Based on the survey, Oracle considered accelerating Java EE standards for OAuth and OpenID Connect. “This could not be accomplished in the Java EE 8 timeframe, but we’ll continue to pursue Security 1.0 for Java EE 8,” the company said. But two other technologies that ranked high in the survey, configuration and health-checking, will be postponed. “We have concluded it is best to defer inclusion of these technologies in Java EE in order to complete Java EE 8 as soon as possible.”

Management, JMS (Java Message Service), and MVC ranked low, thus supporting Oracle’s plans to withdraw new APIs for these areas from Java EE 8. While, CDI (Contexts and Dependency Injection) 2.0, Bean Validation 2.0, and JSF (JavaServer Faces) 2.3 were not directly surveyed, Oracle has made significant progress on them and will include them in Java EE 8.

JAX-RS (Java API for RESTful Web Services) drew a lot of support for use with cloud and microservices applications, with 1,171 respondents rating it as very important. “The current practice of cloud development in Java is largely based on REST and asynchrony,” the report said. “For Java developers, that means using the standard JAX-RS API. Suggested enhancements coming to the next version of JAX-RS include: a reactive client API, non-blocking I/O support, server-sent events and better CDI integration.” HTTP/2, a protocol for more efficient use of network resources and reduced latency, was rated very important by 1,037 respondents when it comes to cloud and microservices applications.

Respondents also supported the reactive style of programming for the next generation of cloud and microservices, with 647 calling it very important, and eventing, for cloud and microservices applications, was favored by 769 respondents. “Many cloud applications are moving from a synchronous invocation model to an asynchronous event-driven model,” Oracle said. “Key Java EE APIs could support this model for interacting with cloud services. A common eventing system would simplify the implementation of such services.”

In other findings, eventual consistency for cloud and microservices applications was favored by 514 respondents who found it very important and 468 who found it important. Multi-tenancy, critical to cloud deployments, was rated very important by 377 respondents and important by 390 survey takers. JSON-P was rated as very important by 576 respondents, while 781 gave this same rating to JSON-B. Standardizing NoSQL database support for cloud and microservices applications was rated very important by 489 respondents and important by 373 of those surveyed, and  582 respondents thought it was very important that Java EE 9 investigate the modularization of EE containers.

The greatest number of the survey’s respondents — more than 700 — had more than eight years’ experiences developing with Java EE, while 680 had from two to eight years of experience.

 

 

[Source:- JW]

Oracle survey: Java EE users want REST, HTTP/2

Oracle survey: Java EE users want REST, HTTP/2

In September and October, Oracle asked Java users to rank future Java EE enhancements by importance. The survey’s 1700 participants put REST services and HTTP/2 as top priorities, followed by Oauth and OpenID, eventing, and JSON-B (Java API for JSON Binding).

“REST (JAX-RS 2.1) and HTTP/2 (Servlet 4.0) have been voted as the two most important technologies surveyed, and together with JSON-B represent three of the top six technologies,” a report on the survey concludes. “Much of the new API work in these technologies for Java EE 8 is already complete. There is significant value in delivering Java EE 8 with these technologies, and the related JSON-P (JSON with Padding) updates, as soon as possible.”

Oracle is pursuing Java EE 8 as a retooled version of the platform geared to cloud and microservices deployments. It’s due in late-2017, and a follow-up release, Java EE 9, is set to appear a year later.

Based on the survey, Oracle considered accelerating Java EE standards for OAuth and OpenID Connect. “This could not be accomplished in the Java EE 8 timeframe, but we’ll continue to pursue Security 1.0 for Java EE 8,” the company said. But two other technologies that ranked high in the survey, configuration and health-checking, will be postponed. “We have concluded it is best to defer inclusion of these technologies in Java EE in order to complete Java EE 8 as soon as possible.”

Management, JMS (Java Message Service), and MVC ranked low, thus supporting Oracle’s plans to withdraw new APIs for these areas from Java EE 8. While, CDI (Contexts and Dependency Injection) 2.0, Bean Validation 2.0, and JSF (JavaServer Faces) 2.3 were not directly surveyed, Oracle has made significant progress on them and will include them in Java EE 8.

JAX-RS (Java API for RESTful Web Services) drew a lot of support for use with cloud and microservices applications, with 1,171 respondents rating it as very important. “The current practice of cloud development in Java is largely based on REST and asynchrony,” the report said. “For Java developers, that means using the standard JAX-RS API. Suggested enhancements coming to the next version of JAX-RS include: a reactive client API, non-blocking I/O support, server-sent events and better CDI integration.” HTTP/2, a protocol for more efficient use of network resources and reduced latency, was rated very important by 1,037 respondents when it comes to cloud and microservices applications.

Respondents also supported the reactive style of programming for the next generation of cloud and microservices, with 647 calling it very important, and eventing, for cloud and microservices applications, was favored by 769 respondents. “Many cloud applications are moving from a synchronous invocation model to an asynchronous event-driven model,” Oracle said. “Key Java EE APIs could support this model for interacting with cloud services. A common eventing system would simplify the implementation of such services.”

In other findings, eventual consistency for cloud and microservices applications was favored by 514 respondents who found it very important and 468 who found it important. Multi-tenancy, critical to cloud deployments, was rated very important by 377 respondents and important by 390 survey takers. JSON-P was rated as very important by 576 respondents, while 781 gave this same rating to JSON-B. Standardizing NoSQL database support for cloud and microservices applications was rated very important by 489 respondents and important by 373 of those surveyed, and  582 respondents thought it was very important that Java EE 9 investigate the modularization of EE containers.

The greatest number of the survey’s respondents — more than 700 — had more than eight years’ experiences developing with Java EE, while 680 had from two to eight years of experience.

 

[Source:- Javaworld]