Vulnerable Adobe extension downloads covertly to Chrome

In other news:

• Security journalist Brian Krebs believes he has identified the mysterious Anna-Senpai, the author of the Mirai malware strain that create a botnet of IoT devices. Krebs' website, KrebsonSecurity.com, was forced offline for four days in September due to a series of Mirai-powered DDoS attack. Krebs' post details how he found the identity of the Mirai co-author, a man named Paras Jha who lives in New Jersey, as well as the evolution of the Mirai malware. Jha, according to Krebs, created the code for Mirai in 2014 with others -- in a group known as "Lelddos" -- to launch attacks on servers for the online game Minecraft. "Lelddos would launch a huge DDoS attack against a Minecraft server, knowing that the targeted Minecraft server owner was likely losing thousands of dollars for each day his gaming channel remained offline," explained Krebs. Jha's LinkedIn page, interestingly, lists him as the president of a DDoS mitigation company called ProTraf Solutions.
• Google recently let the public see under the hood of the Google Cloud Platform infrastructure. In a paper, Google described its security infrastructure in six layers: Operational security, internet communication, storage services, user identity, service deployment and hardware infrastructure. While most organizations would be worried about letting the public see into their security, Google showed little fear in making the information public. Google discussed its data center security in detail since it builds its own data centers. One of the more interesting facts noted in the paper is that Google designs custom chips, including a "hardware security chip" for both servers and peripherals. "These chips allow us to securely identify and authenticate legitimate Google devices at the hardware level," Google wrote in the paper. Another interesting takeaway is that Google doesn't host all of its servers. "Google additionally hosts some servers in third-party data centers, where we ensure that there are Google-controlled physical security measures on top of the security layers provided by the data center operator," the paper reads. "For example, in such sites we may operate independent biometric identification systems, cameras, and metal detectors."
• Fidelis Cybersecurity Threat Research recently discovered ransomware attacks on Hadoop Distributed File System (HDFS) installations that are eerily similar to the attacks on the MongoDB and Elasticsearch databases; as with the MongoDB attacks, a threat actor was observed erasing HDFS directories and leaving behind a note. "There was no attempt to claim a ransom or any other communication -- the data was simply deleted and that directory name was left as a calling card," Fidelis wrote. "We estimate that the potential exposure of this attack is around 8,000-10,000 HDFS installations worldwide, but precise numbers are difficult to determine." Given the similarities between the HDFS attacks and the MongoDB attacks, the number of attacks on HDFS is likely to grow.
• A new strain of ransomware called Spora has one of the most sophisticated ransom payment systems seen so far, according to experts. The ransomware targets Russian-speaking users and offers tiered payment options: Full Restore ($79); Immunity ($50) [from future attacks]; Removal ($20); and File Restore ($30). The ransomware was first noticed on Bleeping Computer and Kaspersky forums. Spora is also unique because of its encryption, which is a combination of RSA and AES algorithms, and the fact that it can work offline. Spora is spread though spam emails that look like invoices with ZIP files attached. When the user opens the ZIP files, HTML Application files that contain Spora launch and start infecting the system with the malware. Then users can choose one of the payment tiers to either fully restore their system, get immunity from the malware in the future, remove the malware or do a simple file restore. All Spora payments are made with bitcoin.