All forms of malicious software plague the web, and one wrong click could cost you.  No matter how careful you are, one of these critters could eventually make its way to your system and wreak havoc.

Let’s look at some of the latest security issues discovered.

Apple releases second Java update

Mid-week, Russian anti-virus vendor Doctor Web stated that an estimated 600,000 Macs were infected by the Trojan  BackDoor.Flashback.39 which  targets an unpatched JavaScript codes, exploiting vulnerabilities within the Mac operating system.

On April 3rd, Apple released a security update that fixes the loophole, and F-Secure offers detailed steps into diagnosing as to whether or not your machine is infected as well as offering a solution to fix the issue.

Intego, the Mac security blog, reported that Apple released a second security update,  Java for OS X 2012-002, but it appears the same as the first security fix, Java for OS X Lion 2012-001.

Intego deducts the existence of a glitch in the first update, causing need for a second.  The first version was for Snow Leopard and Lion, but the second version is for Lion only.

Facebook faces multiple security issues

This is not something new but is highly prevalent in the Facebook community: links shared on Facebook that redirect to a site which would require you to download a plug-in.

Attackers entice Facebookers by spreading links to porn videos which redirects them to a site asking them to download a certain plug-in to be able to watch said video. The plug-in hides malicious code that enables attackers to impersonate the users who downloaded the plug-in and surreptitiously spread the malicious link.

“This is an interesting and quite complex type of scam. In data security lingo, this would qualify as a polymorphic attack, which basically means that the malicious content served can be changed by the attacker thanks to the browser extension installed,” stated Andrei Serbanoiu, Bitdefender Online Threats Analyst Programmer.  “If one user lands on the adult chat page, another may reach the malware downloader or even a whole different web page set up for phishing.”

Trusteer, a privately held computer security firm responsible for the development of Rapport security software, recently identified a new variant of the Ice IX malware which steals credit card, debit card, and/or social security numbers of Facebookers.

According to Trusteer, the attackers use a web injection to present a fake Facebook page in the victim’s browser which includes a form that asks users to provide their cardholder name, credit/debit card number, expiry date, CID and billing address.  The attackers claim the information will be used to verify their identification, and is needed to provide additional security for their Facebook account.  Trusteer also found a video that demonstrates how web injection works.

Trusteer asked Facebook’s thoughts on this and the social networking giant stated the following:

“Facebook actively detects known malware on users’ devices to provide Facebook users with a self-remediation procedure including the Scan-And-Repair malware scan. To self-enroll in this check point please visit – on.fb.me/AVCheckpoint”;
And that “Facebook will never ask for your credit card, social security, or any other sensitive information other than your username and password while logging in.”

And the third security issue Facebook faces is the security holes found on iOS and Android apps.  Gareth Wright wrote that security holes found in iOS and Android apps makes mobile users vulnerable to identity theft.  He stated how Facebook access tokens are easily corrupted just by getting the .plist or property list of the Facebook app, and voila!  All your information is made available and ready to use.  But Facebook stated that only jailbroken, rooted, or modded devices are vulnerable to what Wright described, and there’s no reason for mobile users to worry themselves regarding this matter.

“Facebook’s iOS and Android applications are only intended for use with the manufacturer provided operating system, and access tokens are only vulnerable if they have modified their mobile OS (i.e. jailbroken iOS or modded Android) or have granted  a malicious actor access to the physical device.”

“We develop and test our application on an unmodified version of mobile operating systems and rely on the native protections as a foundation for development, deployment and security, all of which is compromised on a jailbroken device,” Facebook stated.

But an update on Wright’s blog, and supported by The Next Web, proves that jailbroken devices are more vulnerable to hacking, but that doesn’t mean non-jailbroken devices are entirely safe.  Even if your device is not jailbroken, it can still be hacked by using the method that Wright described.

Twitter sues spammers

The microblogging service has had enough of spammers polluting their site, so now they’ll be using the law to end this malicious activity.

Twitter posted on their blog page that aside from their engineers implementing technical solutions to thwart spammers, they “filed suit in federal court in San Francisco against five of the most aggressive tool providers and spammers. With this suit, we’re going straight to the source. By shutting down tool providers, we will prevent other spammers from having these services at their disposal. Further, we hope the suit acts as a deterrent to other spammers, demonstrating the strength of our commitment to keep them off Twitter.”