U.S. DRONE FLEET HIT WITH COMPUTER VIRUS

Wired is reporting a computer virus has infected the cockpits of America’s Predator and Reaper drones, logging pilots’ every keystroke as they remotely fly missions over Afghanistan and other warzones.

The virus, first detected nearly two weeks ago by the military’s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech’s computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military’s most important weapons system.

“We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.”

Military network security specialists aren’t sure whether the virus and its so-called “keylogger” payload were introduced intentionally or by accident; it may be a common piece of malware that just happened to make its way into these sensitive networks. The specialists don’t know exactly how far the virus has spread. But they’re sure that the infection has hit both classified and unclassified machines at Creech. That raises the possibility, at least, that secret data may have been captured by the keylogger, and then transmitted over the public internet to someone outside the military chain of command.

LULZSEC LEAVES BEHIND ONE LAST PARTING SHOT WITH MALWARE, TROJANS AND VIRII

The small group of hackers known as Lulz Security, or simply “LulzSec,” would never disband without one final round of fun. BGR reported on Monday that the group’s reign of terror was coming to an end after 50 lul-filled days. During that period of time, LulzSec released data stolen in a series of online breaches with targets ranging from Sony to the U.S. Government.

In its coup de grâce, LulzSec released a stash of stolen data from a variety of targets, including AT&T, Disney and the U.S. Navy. But data obtained through online breaches wasn’t the only thing LulzSec stuffed into the file; a directory named “BootableUSB” also contained a variety of malware including trojans and worms. While “LulzSec” is no more and its notorious Twitter account now sits dormant, members of the well-known hacktivism group “Anonymous Operations” have confirmed that LulzSec is gone in name only — the six LulzSec members have been absorbed by Anonymous, according to the group’s official Twitter feed.

APPLE CRACKING DOWN ON MALWARE WITH QUARANTINE LIST

Preconceptions aside, Apple products do occasionally spread viruses, and not just the biological kind, which is why Cupertino saw fit to equip Mac OS X 10.6 Snow Leopard with a quarantine function to safely set malware aside. This week, however, Apple's kicking those digital white blood cells into high gear, updating that quarantine list daily with a new background process.

The company's primarily got its crosshairs on the recent MacDefender scare, of course, but on the off-chance malware starts coming out of the woodwork, it sounds like you won't have to wait for a formal security update to be forewarned of the dangers. If privacy's your primary concern, however, you can also opt-out

APPLE FINALLY ADMITS MALWARE ISSUE; POSTS REMOVAL INSTRUCTIONS FOR 'MAC DEFENDER'

Mac users have recently been targeted by a phishing scam that falsely claimed their computers were infected with a virus. Upon being redirected to an illegitimate website, users were instructed to install “Mac Defender,” which was malware masquerading as an antivirus application.

Until recently, Apple had reportedly instructed its AppleCare support reps to deny any existence of the problem and said reps should “not remove or uninstall any malware” found on a computer. On Tuesday, however, Apple finally acknowledged the issue and posted instructions on its support forums that cover how to avoid and remove the Mac Defender malware.

REMOVAL INSTRUCTIONS:

• Move or close the Scan Window
• Go to the Utilities folder in the Applications folder and launch Activity Monitor
• Choose All Processes from the pop up menu in the upper right corner of the window
• Under the Process Name column, look for the name of the app and click to select it; common app names include: MacDefender, MacSecurity or MacProtector
• Click the Quit Process button in the upper left corner of the window and select Quit
• Quit Activity Monitor application
• Open the Applications folder
• Locate the app ex. MacDefender, MacSecurity, MacProtector or other name
• Drag to Trash, and empty Trash

GOOGLE RESPONDS TO ANDROID APP MALWARE

On March 1, news broke that dozens of malicious applications had made their way to Android Market, each infected with a rootkit that could grant hackers deep access to Android devices that installed them. Google removed the malicious applications from Android Market within a few minutes of being notified, but has otherwise remained silent on the situation.

Google has now confirmed that 58 malicious applications were uploaded to Android Market, and that they were downloaded onto around 260,000 devices before Google removed the apps Tuesday evening. That number sounds alarmingly high, but Google believes that only device-specific information, namely the phone’s IMEI number, was compromised — and that no personal data or account information was ever transferred. Given that these apps were getting root access, this could have been a lot worse. Now the cleanup begins.

Beginning tonight, Google is going to invoke a special ‘remote kill’ function that allows it to remove these malicious applications from any affected Android devices with no action required from the user. Google will also be issuing a fully automated Android Market security update to infected devices that should remove the rootkit (again, no user action will be required). All affected users will be receiving email notifications about the situation as well.

Unfortunately, while Google can remotely fix affected devices, it can’t automatically patch the security hole that made the exploit possible in the first place. That’s because the hole exists on the system level, so it requires a system upgrade to resolve — and it’s up to the carriers and hardware manufacturers to deploy the fix. Google is issuing a patch and informing its partners that it is urgent, but who knows how long it will take the carriers to push it to users.

As if to underscore this problem, Google says that the exploit was actually already fixed in recent versions of Android, and that it only affects version 2.2.1 and lower. Unfortunately the vast majority of Android devices are still running older versions of the OS because of the aforementioned sluggish carrier updates.

Beyond these software updates, Google says that it’s taking steps to try to prevent similar malicious apps from making it onto Android Market.

MORE MALWARE DISCOVERED IN ANDROID MARKETPLACE APPS

We reported yesterday on Google pulling 21 apps from the Android Marketplace due to malware. Now, we are learning additional apps have been pulled for the same reason. Google has removed 29 more apps and more could be pulled. Google discovered the "DreamDroid" virus in the additional apps it pulled yesterday.

Unlike Apple's locked down App Store, Google's Android Marketplace is open for all, which allows for malware, virii and trojans to appear more readily. Google does have a section in its terms of service which addresses this issue, but the company relies on others to police its Marketplace and inform it of any offending apps.

ANOTHER ANDROID TROJAN VIRUS FOUND

On the heels of the Geinimi Trojan, Lookout has discovered a new Android Trojan that is repackaged in popular Android apps and distributed through app markets and forums serving Chinese-speaking users. Called HongTouTou, this malware requests additional user permissions and appears to be executing a set of search-related activities in the background (unknown to the user) including emulating keyword searches and clicks on specific search results.

GEINIMI TROJAN APPEARS IN CHINA; AFFECTS ANDROID DEVICES

A new trojan virus called Geinimi has appeared in China aimed at Android. The trojan is spreading via third party app markets. Geinimi has been repackaged to look like a popular game, but is in fact a trojan virus. The official versions of these games on the Android Market are fine, it’s the repackaged versions on third-party networks that carry the Trojan and need to be avoided. Examples of the games are:

• Monkey Jump 2
• Sex Positions
• President vs. Aliens
• City Defense
• Baseball Superstars 2010

Lookout Mobile Security, who identified the threat, is still looking into what Geinimi can do. This is what they have found it can do so far:

• Send location coordinates (fine location)
• Send device identifiers (IMEI and IMSI)
• Download and prompt the user to install an app
• Prompt the user to uninstall an app
• Enumerate and send a list of installed apps to the server

Lookout also points out this is the most advanced Trojan they have seen yet for Android even if it was quite obvious to spot by the security company. [Geek]

CELL PHONES ARE DIRTY!!!!

A recent Stanford University study has found that if you put a virus on a touchscreen surface about 30% of it will make it onto the fingers of anyone who touches it.  From the fingertips it is easily transferred to the eyes, mouth, nose or any other place that has an itch.  Also of note is an unspecified British study cited in a Sacramento Bee article: "Mobile phones harbor 18 times more bacteria than a flush handle in a typical men's restroom." Ummm...YUCK! [Engadget]