White House CIO On Leave Amid Scandal At D.C. Technology Office
White House CIO goes on leave after two former subordinates in DC technology office are arrested on charges of corruption
Startup Secures Mashups
Startup rolls out open protocol, technology for securing mashups
dnsmap 0.22 Released - Subdomain Bruteforcing Tool
By Darknet on subdomain bruteforcer
dnsmap is a subdomain bruteforcer for stealth enumeration, you could say something similar to Reverse Raider or DNSenum. Originally released in 2006, dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. During the enumeration stage, the security consultant would...
Read the full post at darknet.org.uk
ProxyStrike v2.0 released
Posted by Christian Martorella on Mar 17
Im please to announce a new version of ProxyStrike, an active Web Application Proxy, is a tool designed to find vulnerabilities while browsing an application. It was created because the problems we faced in the pentests of web applications that heavily depends on Javascript, not many...
Auditors: IRS should scan servers weekly
Posted by InfoSec News on Mar 17
http://fcw.com/articles/2009/03/16/irs-servers.aspx
By Mary Mosquera
FCW.com
March 16, 2009
The Internal Revenue Service should scan all its computer servers each
week to protect against malicious code and software attacks, the
Treasury Inspector General for Tax Administration (TIGTA)...
Broken Engagement Leads IT Worker To Damage Australian Government Data
Posted by InfoSec News on Mar 17
http://www.darkreading.com/insiderthreat/security/attacks/showArticle.jhtml?articleID=215900507
By Tim Wilson
DarkReading
Mar 16, 2009
A man who crashed government computer systems in Australia's Northwest
Territory last year says he did it because he was drunk and upset that
his fiancee...
New DNS trojan taints entire LAN from single box
Posted by InfoSec News on Mar 17
http://www.theregister.co.uk/2009/03/16/dns_hijacking_trojan/
By Dan Goodin in San Francisco
The Register
16th March 2009
Internet security experts are warning of a new rash of malware attacks
that can hijack the security settings of a wide variety of devices on a
local area network, even...
Heartland Data Breach: Visa Sets Deadline for Issuers to File Fraud Claims
Posted by InfoSec News on Mar 17
http://www.bankinfosecurity.com/articles.php?art_id=1277
By Linda McGlasson
Managing Editor
Bank Infosecurity
March 16, 2009
Heartland Payment Systems (HPY) has been removed from Visa's list of
compliant service providers, and banking institutions affected by the
Heartland data breach...
Hackers target Shell customers
Posted by InfoSec News on Mar 17
http://www.news.com.au/story/0,27574,25199207-29277,00.html
By staff writers
NEWS.com.au
March 17, 2009
ONLINE hackers have stolen personal information from almost 6000 Shell
customers in Australia and New Zealand.
Shell spokesman Paul Zennaro confirmed that 4500 Australians were
...
Leaked Comcast User Data Found Online
An alert PC World reader helps uncover a document containing thousands of e-mail addresses and passwords.
Card-sniffing trojans target Diebold ATM software
Innovations in cybercrime
Security researchers from Sophos have discovered sophisticated malware that siphons payment card information out of automatic teller machines made by Diebold and possibly other manufacturers.…
Worm burrows into Church of England email system
Infected bishop loses e-pistles
The Bishop of Manchester has been unable to send or receive email messages for ten days following a computer virus infection.…
Patch Those Internet Printers
By HongZheng Zhou on Web and Internet Safety
When I wrote a scanner plug-in this week for an old directory traversal vulnerability–CVE-2008-4419–I wondered whether there are vulnerable HP LaserJet printers online that can be controlled from the Internet. To find out, I used Google. The search listed almost 50 results, and I found that almost all of these printers are not patched, even [...]
Microsoft Threat Management Gateway has some drawbacks
By Eric Ogren
Microsoft's new gateway lacks policy enforcement integration and does not detect the presence of sensitive data or provide PCI features.
Third QSA firm placed in remediation by PCI SSC
By Robert Westervelt
The PCI Security Standards Council quality assurance program placed three QSA firms into remediation. They could face revocation of their certification to conduct PCI assessments.
Portable security storage device could replace OTP devices
By Erin Kelly
A new USB-like device, hardened with security features, could overtake one-time password devices and give end users flash memory to carry around encrypted data.
Browser add-on locks out targeted advertising
A Harvard University fellow has developed a browser extension that stops advertising networks from tracking a person's surfing habits, such as search queries and content they view on the Web.
Bomb hoax news fed to users after IP analysis
Criminals are trying to trick users into downloading malware by luring them to a website that reports a hoax breaking news' story of a bomb explosion cleverly tailored to their location.
Web inventor Berners Lee conned by fake website
In a classic example of an invention turning on its inventor, web pioneer Sir Tim Berners Lee, has admitted being conned out of his money by an Internet fraudster.
Leaked Comcast User Data Found Online
Comcast has suffered a leak in its user data that went undetected for more than two months. And it was an alert PC World reader who helped uncover the leak, when a document containing 8,000 e-mail accounts and passwords was found on Scribd.com, according to the New York Times.
Kraken the botnet: The ethics of counter-hacking
The Kraken is a huge network of personal computers that have been infected with software that turns them into zombie systems under the control of a master program - a botnet. The Kraken botnet is used by criminals to generate spam.
Survey: Families wise up to importance of online safety
Children admit sneaking in more time online than their parents know about, but families overall are getting more savvy about Internet safety, according to a new survey commissioned by Symantec.
NAC as a compliance tool
NAC is mainly pushed as a risk-mitigation technology that can reduce the likelihood that an endpoint is infected or carrying out unauthorized activity, but its features have been pressed into other duties.
Global Dispatches
U.K. Police Lose Crime-Data Card
Companies get checklist on PCI security rules
The organization that administers the credit card industry's data security rules has released a new set of compliance guidelines -- a move that reinforces the widespread perception that efforts to comply are going slowly at many companies.
Next Symantec CEO to focus on security
In three weeks, Cupertino, Calif.-based Symantec Corp.'s chief operating officer Enrique Salem will assume the role of "CEO designate", and drive the company's focus back to security following a period of strayed focus, he said. "
BBC botnet 'reckless,' may inspire copycats
Security company Sophos has lashed out at the BBC for commandeering some 22,000 computers earlier this month, claiming the move was a reckless breach of privacy that could inspire a wave of vigilante copycats.
Malwarebytes' Anti-Malware Adds a Layer of Protection
If you've got only one piece of anti-malware software on your system, you're not protected well enough. Most anti-spyware programs can't detect and kill all spyware, so it's a good idea to run two on occasion, and sometimes more. Malwarebytes' Anti-Malware (free demo, US$25 to unlock all features) is a worthwhile addition to anyone's anti-spyware arsenal, because unlike some overly complex programs, it's easy to configure and use.
nCircle researcher: Microsoft patch leaves users vulnerable
One of the patches Microsoft Corp. issued last week is nothing of the sort, according to a researcher who Monday accused Microsoft of making functionality a higher priority than security.
Botnet takedown offers peek at private data repository
By jhruska@arstechnica.com (Joel Hruska) on Zeus
The UK security firm Prevx has released details into a major botnet shutdown that netted the firm an unusual find—a command-and-control server loaded with the private details for some 160,000 individual computers and/or persons. Although that server has since been shut down and the appropriate authorities notified, the server's repository of data is a first-rate example of how data from a melting pot of sources ends up indiscriminately fused together.
All eyes on cybersecurity at midpoint of federal review
By julian.sanchez@arstechnica.com (Julian Sanchez) on DHS
Last week was a busy one for cybersecurity mavens as the 60-day review ordered by President Obama reached its halfway point. The House Committee on Homeland Security held hearings on the state of efforts to protect the nation's data infrastructure, even as the Congressional Research Service released a report highlighting the shaky legal foundations of the Comprehensive National Cybersecurity Initiative. The Department of Homeland Security, which came in from many House witnesses, appointed a former Microsoft executive to lead the charge on cybersecurity. And at the annual FOSE conference, former FBI head Louis Freeh weighed in with a contrarian warning that centralization provided an "illusory" solution to the problem.
US Lawmakers Reportedly Drafting Bill to Address Behavioral Advertising Issues (March 16, 2009)
US legislators are drafting a bill that would require Internet companies using targeted advertising technology to notify users that their habits are being tracked for that purpose....
Finnish President Ratifies Law Allowing Employers to Monitor Employees' eMail Activity (March 4 & 14, 2009)
A newly ratified law in Finland allows employers to monitor employees' email messages when they suspect misconduct...
Visa Says RBS WorldPay and Heartland No Longer PCI DSS Compliant (March 13, 2009)
Visa has said that RBS WorldPay and Heartland Payment Systems are no longer compliant with the Payment Card Industry Data Security Standard (PCI DSS)....
PCI Security Standards Council Issues Prioritized Approach for Compliance (March 16, 2009)
The PCI Security Standards Council LLC has issued a list of compliance guidelines it calls the Prioritized Approach to help companies struggling with where to go or even where to begin implementing the controls to protect payment card customer data...
Man Who Deleted Australian Government Computer Accounts to be Sentenced (March 13, 2009)
David Anthony McIntosh, a former IT consultant for the government in Australia's Northern Territories, will be sentenced this week for damage he caused to a government computer system...
Japanese Court Orders ISP to Reveal File Sharer's Identity (March 15, 2009)
A Japanese court has ordered an Internet service provider (ISP) to disclose the identity and address of a customer who allegedly used file-sharing software to expose personally information of 110,000 high school students.......
Report: IRS Malware Response Improved, Prevention Still Needs Attention (March 10 & 16, 2009)
A recently released audit report from the Treasury Inspector General for Tax Administration (TIGTA) says that while the US Internal Revenue Service (IRS) "responded appropriately when malware was detected," it could improve controls to prevent malware from reaching the systems in the first place.......
Kundra On Leave During Probe of Former Office (March 12 & 13, 2009)
Vivek Kundra, who was recently appointed by president Obama as federal chief information officer (CIO), has taken a leave of absence from that position following the arrests of two individuals associated with his former office.......
Iowa Company Agrees to Pay Undisclosed Sum For Unlicensed Software Use (March 12 & 16, 2009)
An Iowa company has agreed to pay the Software & Information Industry Association a six figure settlement for using copies of software without valid licenses.......
Microsoft DNS Patch Does Not Address Core Issue (March 16, 2009)
One of the patches Microsoft released last week for a vulnerability in Windows DNS and WNS servers merely mitigates the issue but does not fix it, according to security engineer Tyler Reguly.......
Comcast Subscriber Info Exposed Online (March 16, 2009)
A list of several thousand Comcast subscriber usernames and passwords was exposed on the Internet for about two months.......
Consultant Who Exposed Coleman Website Flaw Defends Actions (March 13 & 16, 2009)
The IT consultant who exposed the vulnerability on former Minnesota Senator Norm Coleman's campaign website in January says she did so highlight the problem so others could protect themselves from breaches.......
Posts
No comments:
Post a Comment