Security Response

There has been some recent online discussion about games from the Chrome Web Store requesting excessive permissions. These games are extensions for Google Chrome. To access various aspects of Chrome, certain permissions are required; for example, to allow access to the Bookmark manager to update bookmarks. The “Super Mario 2” app is offered by the developer “chromitude”, which is associated with Slice Factory, a company that develops services and browser extensions to remix Web data. The extension requests permissions which seem excessive for simply playing a game. These permissions are:

·         Access to bookmarks

·          Notification of  new tabs being created

·         Access to all URLs

To determine why these permissions are required for the game and what the extension...

Symantec often utilizes honeypots to acquire new samples and observe attacks in the wild. Many threats encountered on honeypots are related to botnets. However, on a rare occasion a honeypot may encounter a targeted attack. In these cases the attacker is after a specific entity, be it a person, corporation, government, or any other such body. When a computer is compromised by such a threat, the behavior can be similar to a bot, connecting to a command and control (C&C) server and awaiting commands. However, the commands received are usually not generic. They are interactive, with the attacker seeking some specific information in real-time.

 We recently encountered one of many such targeted threats on a basic honeypot and logged the activity. The attack was quite straightforward and did not utilize any new techniques. Nonetheless it is a good example of the processes such attackers use. This particular threat was targeting a corporate entity, using a tailored PDF...