Corporate and home users should avoid suspicious PDF documents as well as ensuring they use the latest version of PDF software.  For example, Adobe Reader XI (11.0.02) now offers sandbox security controls, protected mode processing, and other security controls not found in earlier versions.

http://blog.trendmicro.com/trendlabs-security-intelligence/malicious-pdfs-on-the-rise/

QUOTE: Throughout 2012, we saw a wide variety of APT campaigns leverage an exploit in Microsoft Word (CVE-2012-0158). This represented a shift, as previously CVE-2010-3333 was the most commonly used Word vulnerability.  While we continue to see CVE-2012-0158 in heavy use, we have noticed increasing use of an exploit for Adobe Reader (CVE-2013-0640) that was made infamous by the “MiniDuke” campaign. The malware dropped by these malicious PDFs is not associated with MiniDuke, but it is associated with ongoing APT campaigns.

Our research indicates that attackers engaged in APT campaigns may have adapted the exploit made infamous by the MiniDuke campaign and have incorporated it into their arsenal. At the same time, we have found that other APT campaigns seem to have developed their own methods to exploit the same vulnerability.  The increase in malicious PDF’s exploiting CVE-2013-0640 may indicate the start of shift in APT attacker behavior away from using malicious Word documents that exploit the now quite old CVE-2012-0158.

Several protective practices are shared as follows:

http://securitywatch.pcmag.com/security/310959-how-to-protect-your-group-twitter-account
�
QUOTE: Several Twitter accounts belonging to the United Kingdom’s Guardian were hit by the Syrian Electronic Army over the weekend, and last week, Associated Press, CBS News, and BBC were also hacked. SEA threatened to keep up its attacks because Twitter keeps suspending its account. Several of the recommendations fall under basic Security 101 and are tips anyone should follow, for both their personal accounts as well as shared ones.

Twitter encouraged users to change passwords and select strong passwords and be on the lookout for suspicious communications or that may be a part of a spear phishing campaign. All organizations, not just media, should be aware of potential phishing attacks. “These incidents appear to be spear phishing attacks that target your corporate email. Promoting individual awareness of these attacks within your organization and following the security guidelines below is vital to preventing abuse of your Twitter accounts,” the memo said.

Since Twitter uses email for password resets and official communications, users need to keep their email accounts secure, first by selecting strong (and different!) passwords. If two-factor authentication is available on the email account, it should be enabled, Twitter suggested. Users should never send passwords via email, even internally, Twitter warned. That way, attackers can’t find the password of the account through someone else’s archived messages.

Initially, saw this as a POC against simulation software and certainly a wakeup call to promote safety.  However, Hugo’s comments are worth noting below … He noted software exploits and vulnerabilities, that with the right delivery system that could be potentially manipulated.   While there are limitations on what can be accomplished, there are many mitigating controls that make this impractical currently.  Still industrial automation and especially remote control systems must be as secure as possible. 

http://commandercat.com/2013/04/posthitb2013.html

QUOTE: After reading some of the news related to my talk at HITB 2013, I am writing this post with the goal of clarifying some misunderstandings, probably due to the lack of time I had during the talk, because I omitted details or other reason. Some of the most common wrong statements I have seen are related to:

• The Android application: No, the Android application I developed cannot attack an airplane by itself. This application is just a user interface that send commands to the base station and receives feedback. Without the base station, and all the other hardware shown on the slides, the application is by itself useless.

• The flight simulator: I did not found the vulnerabilities in the flight simulator; I found all the vulnerabilities on real software and hardware of on-board aircraft systems.

• ACARS exploitation: No, I did not attack ACARS, neither ADS-B. I just used those protocols to send and receive information to/from the aircrafts. Exploits and payloads are delivered using those protocols but I don’t attack them. That would be like saying that an exploit attacks TCP just because it is delivered via the network.

• Real airplanes: No, none of my tools or code can be used directly against real aircrafts. I did and kept it this way on purpose, but the vulnerabilities I found apply to real aircraft systems and code.

• Old hardware: For my research I targeted both old FMS models (dating back from the 70s) as well as some of the newest ones (two or three years old).

• Exploitability: I understand the skeptical community saying “this is not possible because ACARS does not offer commands for doing X or Y”. Once again, I only used ACARS as a communication channel and my research targeted the FMS. So, have you ever heard of memory corruption? Also, when I mentioned “No rootkit” I was referring to the fact that hiding is currently not necessary so it was not implemented, not that the post-exploitation did not include hooking.

A counter-response is noted in this thread, which documents some key safety controls that make the scenario shared very difficult to achieve (and these type comments, led to the points above)

http://www.askthepilot.com/hijacking-via-android/

Intego security notes benefits of outbound protection where malware attempts to connect to the Internet from an infected computer.  By definition, all firewalls offer in-bound protection, and there are additional benefits in detecting and preventing malware from phoning home 

http://www.intego.com/mac-security-blog/whats-the-difference-between-incoming-and-outgoing-firewall-protection/

QUOTE: The other day, we mentioned that the OS X application firewall provides only inbound protection. I imagine there are some of you who are wondering what exactly that entails, and more specifically, how that differs from what’s in Intego’s products. Well, guess no more! Here’s a handy explanation about the difference between incoming and outgoing firewall protection.

As you may imagine, inbound protection protects you from threats that originate outside of your Mac and try to get in. There are many types of automated or direct attacks that this type of protection is useful to combat, and this is the type of protection that OS X’s application firewall provides.

But arguably the more important component, from an anti-malware perspective, is outbound protection. Outbound protection alerts you to attempts to connect out from your machine. There are a lot of legitimate processes on your machine that do need to connect out (such as to get email, surf the web, get or update settings, etc.) but if there is unknown malware on your machine, you want to be able to prevent it from connecting out to send data or to alert its controller.