Symantec study: Norton beats MS Security Essentials
By emil.protalinski@arstechnica.com (Emil Protalinski) on Symantec
When we contacted a few antivirus makers earlier this week to find out their thoughts about the release of Microsoft Security Essentials (MSE), Redmond's free anti-malware solution, some were more prepared than others. Two were fine with Microsoft's foray into the free antivirus market, but two others were not. Symantec was in the latter group, and it went the extra mile by sending us a study titled "Norton Antivirus 2009 Versus Microsoft Security Essentials: A Comparative Anti-Malware Test."
Researchers see through walls with wireless mesh
By jtimmer@arstechnica.com (John Timmer) on wireless signal
Wireless technology is exploding as the hardware becomes cheaper and uses less power. Chances are good that the upward trajectory will continue over the next few years, as companies are betting that smart devices and remote controls that use the short-range IEEE 802.15.4 protocol will find a place on the market. Now, researchers have used one of the features that provides that protocol with robustness against noise in order to track the movements of people around a room they couldn't otherwise see into.
Antivirus makers applaud, mock Microsoft Security Essentials
By emil.protalinski@arstechnica.com (Emil Protalinski) on Symantec
Four antivirus makers have weighed in on the release of Microsoft Security Essentials, and their opinions are all over the place. We asked various security companies for their opinion on MSE, which launched yesterday, and Symantec, ESET, Avast, and AVG responded with their thoughts.
Microsoft claims it is targeting consumers who currently don't have any protection on their Windows PC, but of course MSE will end up on many computers that already have third-party security software installed. Since MSE is free, the software security market is going to get a serious shake-up, and here's what Microsoft's new competitors think about what's about to happen.
First look: Microsoft Security Essentials impresses
By emil.protalinski@arstechnica.com (Emil Protalinski) on Microsoft Security Essentials
After a short three-month beta program, Microsoft is officially releasing Microsoft Security Essentials (MSE), its free, real-time consumer antimalware solution for fighting viruses, spyware, rootkits, and Trojans. MSE is yet another layer of defense the company is offering to help its customers fight the threats that plague Windows PCs.
AV-Comparatives picks seven on-demand antimalware winners
By emil.protalinski@arstechnica.com (Emil Protalinski) on Av-Comparatives
AV-Comparatives is known for the thorough tests it does on security software. Following its May 2009 retrospective/proactive report, the company has released its August 2009 on-demand comparative. Sixteen products, last updated on August 10, were set on the same highest detection settings (except for Sophos and F-Secure) and put to the test.
Traumatic head injury? Weird Science prescribes vodka
By jtimmer@arstechnica.com (John Timmer) on Week in Review
Blow to head? Drink up!: You could probably figure out the topic despite the medicalese in the title: "Positive Serum Ethanol Level and Mortality in Moderate to Severe Traumatic Brain Injury." The study is a retrospective one, based on identifying a set of patients in trauma centers who had been diagnosed with severe brain injuries. Not surprisingly, a number of them had been drinking. The surprise was that the folks with alcohol in the bloodstream had a better survival rate than those who hadn't had a drink, even after correcting for some potential confounding factors. As always, further studies are suggested before we start dispensing vodka shots in the ER.
Balancing the checkbook as a diagnostic tool: Here's another potential medical tool, this one diagnostic. Many elderly adults suffer from mild cognitive impairment, but only some of them progress to full-blown dementia. A year-long longitudinal study suggests a potential diagnostic indicator: basic financial competence. Anyone suffering from mild impairment wound up performing below controls in a test called the Financial Capacity Instrument, but those who wound up diagnosed as suffering from dementia at the end of the year did much worse, and had problems with financial concepts, cash transactions, bank statement management, and bill payment.
Viagra spam brings bulging returns of more than $4,000/day
By jacqui@arstechnica.com (Jacqui Cheng) on study
Pharmaceutical spam can generate more than $4,000 per day in sales, confirming that spam continues to thrive because of those gullible few who click through and ruin it for the rest of us. And that's not just an estimate: a security researcher from Sophos have combed through sales logs as part of his investigation into the growth of spam networks, noting that Russian affiliate partner networks—also known as "partnerka"—are responsible for some of the largest Canadian pharmacy spam businesses.
Dmitry Samosseiko's report, "The Partnerka — what is it, and why should you care?" (PDF) focuses largely on these Russian networks and how they drive traffic, advertising, and more. Not surprisingly, online pharmaceuticals tend to be a very popular affiliate business, with one of the largest being one called GlavMed. GlavMed itself claims to be strongly anti-spam, but it has a sister company called "SpamIt," a private group of e-mail spam affiliates that researchers suspect are also behind the Storm, Waledec, and Con?cker botnets.
CGISecurity - Website and Application Security News
All things related to website, database, SDL, and application security since 2000.
CGISecurity turns 9
By Robert A. on Site News
It's been 9 years since I started this site as an excuse to learn more about web application security. To put this into perspective the following terms hadn't been coined yet CSRF/XSRF/Cross-site Request Forgery XST Web 2.0 AJAX/XMLHTTP Silverlight CRLF Injection SDL/SDLC Firefox Clickjacking Sidejacking HTTP Request Smuggling HTTP Response Splitting...
Reddit XSS worm spreads
By Robert A. on XSS
UPDATE: Reddit has posted a blog entry at http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html addressing this. "Popular social news website Reddit has stopped the spread of a cross-site scripting (XSS) worm that hit the site on Monday. The XSS worm spread via comments on the site, originally from the account of a user called xssfinder. Reddit...
CNET News - Security
Security Essentials fares well in AV-Test trial
By Lance Whitney
Microsoft 's new Security Essentials software has passed at least one exam so far--a review by security testing firm AV-Test.org.
Using the latest version and definition updates of Microsoft Security Essentials (MSSE) downloaded from the Web, AV-Test ran the product through a series of tests on Sept. 29 and ...
Targeted e-mails distribute malware in PayChoice breach
By Elinor Mills
Payroll processor PayChoice said Thursday it is investigating a breach in which customers received targeted e-mails purporting to be from the company but were designed to trick people into downloading malware.
Workers received e-mails last week that directed them to download a browser plug-in or visit a Web site so ...
Originally posted at InSecurity Complex
Students, experts link offline risks with Net safety
By Larry Magid
WASHINGTON--When the Online Safety and Technology Working Group, established via the Protecting Children in the 21st Century Act, last week held a meeting at the U.S. Department of Commerce to discuss how to best protect kids online, members may not have been expecting to talk so much about offline ...
Originally posted at Safe and Secure
Facebook shuts down malicious fake profiles
By Elinor Mills
Facebook on Thursday fended off an attack in which multiple identical profiles were created to spread malware.
Antivirus provider AVG Technologies said users of its LinkScanner service detected numerous profiles that were identical except with different names and each included a link to what was represented as a home video ...
Originally posted at InSecurity Complex
'State of the Internet' assessed
By Lance Whitney
Internet attacks came from 201 different countries in the second quarter, up from 68 countries in the first quarter, according to a report released Thursday.
Akamai Technologies' quarterly "State of the Internet" report compiles data about the online world, from Internet attacks to average connection speeds across the globe.
Among ...
Banking Trojan steals money from under your nose
By Elinor Mills
Researchers at security firm Finjan have discovered details of a new type of banking Trojan horse that doesn't just steal your bank log-in credentials but actually steals money from your account while you are logged in and displays a fake balance.
The bank Trojan, dubbed URLZone, has features designed ...
Originally posted at InSecurity Complex
Misfired e-mail was never viewed by Gmail user
By Elinor Mills
A sensitive e-mail mistakenly sent by a bank to a Gmail address that prompted a court to order Google to deactivate the account was not viewed by the recipient and has been deleted, the bank said on Tuesday.
The e-mail, sent by an employee of Jackson, Wyo.-based Rocky Mountain ...
Originally posted at InSecurity Complex
Malware worldwide grows 15 percent in September
By Lance Whitney
A rise in malware has caused the number of infected PCs worldwide to increase 15 percent just from August to September, says a report released Tuesday from antivirus vendor Panda Security.
Across the globe, the average number of PCs hit by malware now stands ...
Security Essentials graduates to v1.0
By Seth Rosenblatt
Microsoft has released version 1.0 of Security Essentials, the successor to Live OneCare. Originally known as Morro, Security Essentials retains the core features of OneCare, but abandons the additional heft of a firewall, performance tuning, and backup and restore options in exchange for making the program free. Rather than ...
Originally posted at The Download Blog
Mozilla VP: Chrome Frame is the wrong answer
By Stephen Shankland
Mozilla and Microsoft don't always see eye to eye when it comes to browser technology, but they agree broadly on one thing: thumbs down for Google Chrome Frame.
Chrome Frame is a plug-in that puts Google's browser engine under the hood of Microsoft's Internet Explorer, and Google ...
Originally posted at Deep Tech
Google, bank resolve issue over misfired e-mail
By Elinor Mills
A bank that accidentally sent sensitive customer information to a Gmail address and persuaded a judge to order Google to deactivate the account has resolved the issue with Google and the companies have filed a motion to dismiss the case.
Google spokesman Andrew Pederson declined to say exactly how the ...
Originally posted at InSecurity Complex
CounterMeasures
Rik Ferguson blogs about security issues.
Skype “Online Notification” leads to Fake AV
By Rik Ferguson on Skype
In a sneaky bit of social engineering scareware pushers are registering convincing sounding monikers as Skype user names and attempting to lead people to rogue anti-malware sites. The user name that is displayed in the Skype chat window is “Online Notification” and the associated user names appear on many variations of that theme; online.notification.america9, online.notification.america10 etc. [...]
Facebook Colon Cleansing spam via Mobile Web
By Rik Ferguson on web
UPDATE: I should make clear that whilst Facebook believe this attack to be related to earlier account phishing activity, more than one victim has assured me that they have not logged into facebook for some while and are certain they have not fallen for a phishing scam. It is certainly true that code has been [...]
In Security, Reputation Is Key
By Rik Ferguson on testing
That appears to be the conclusion of a pair of independent tests recently released by NSS Labs. Back in June of 2008 you may remember there was some noise in the IT press, as Trend Micro was declining to participate in some of the well known anti-malware tests, such as VB100. Our argument at the time, [...]
Darknet - The Darkside
Ethical Hacking, Penetration Testing & Computer Security
No Emergency Patch For Latest Windows Exploit
By Darknet on windows-vista
Another reason for Windows users to hate the Microsoft Patch Tuesday policy, The exploit isn’t 100% reliable but it’s still fairly significant in my eyes as it is a critical vulnerability and can be used for code execution. Vista isn’t the most popular OS still so perhaps Microsoft don’t the threat being that wide as the [...]
FRHACK OS v1 alpha1 – Pentesting/Security LiveCD
By Darknet on security-livecd
FRHACK OS is an updated/modified version of the latest BackTrack 4 ISO with many updated tools and fixes. This means it’s a fully fledged linux pen-testing/security environment. Some included tools & Updates gcc-4.2 sun-java6-jre sun-java6-plugin spoonwep-wpa-rc3.deb airsnort-0.2.7e.tar.gz wepbuster-1.0_beta_0.6 jbrofuzz-jar-15 wfuzz-1.4 tor-0.2.1.19 privoxy-3.0.8-stable-src ophcrack-3.3.1 vncrack_src-1.21 fuzzgrind_090622 A new version (coming with bug fixes, included rainbow tables, wordlists, extras etc.) will be available for FRHACK 01, [...]
DarkReading - All Stories
DarkReading
Tech Insight: Beating Bots And Scareware On A Budget
Free tools like the Squid Web caching proxy can add extra layers of protection for your users
Databases' Most Serious Vulnerability: Authorized Users
New report says many enterprises overlook common methods of insider data leakage and theft
Factoring Malware Into Your Web Application Design
Web developers need to consider the complexity of their Web app's design, as well as beefing up application monitoring and anti-fraud tools on the back-end
Which Botnet Is Worst? Report Offers New Perspective On Spam Growth
Study says largest botnets are not always the largest producers of spam
New Trojan Evades Banks' Anti-Fraud Systems
'URLZone' calculates just how much money to steal from a victim's account without raising suspicion
Conficker Showdown: No End In Sight
Re-infected machines likely part of the 5.5- to 6 million-strong Conficker headcount
Taming The Threat From Within: Report
New <i>Dark Reading</i> report offers insight on how to keep your network safe from e-business partner risks
New NIST Report Sheds Some Light On Security Of The Smart Grid
First draft of Cyber Security Coordination Task Group report released
PCI DSS Update Could Include Virtualization Security
PCI Virtualization Special Interest Group (SIG) drafting guidelines and a mapping tool for applying PCI to virtualized systems
DarkReading - Security News
DarkReading
SCM Microsystems Ships Smart Card Readers to Support Spanish Government eID Program
General Dynamics Awarded $24 Million to Provide Remote Weapon Systems That Protect Tank Commanders
Futronic Launches FS50 FIPS201/PIV Compliant USB2.0 Two Finger Scanner
eReleases Twitter Contest Winds Down to Final Four Days of Netbook and Release Distribution Prizes
eWeek Security Watch
Facebook Attackers May Have Cracked CAPTCHA
In Virus and Spyware
Researchers at AVG Technologies may have uncovered a scheme where attackers broke Facebook's CAPTCHA protections and automated the creation of bogus Facebook pages. All this in the name of pushing fake anti-virus programs to the public.
Web 2.0 Leaves Browsers Under Constant Siege
In Web 2.0
Emerging Web 2.0 threats are putting even more pressure on issues of browser security, a new Purewire white paper contends.
Worlds of Scamcraft
In video games
Attackers continue to refine their techniques aimed at stealing passwords and hard-earned virtual game assets belonging to users of Worlds of Warcraft.
Twitter Abuse Growing Rampant
In Virus and Spyware
Twitter continues to become an even bigger source of malware activity, according to researchers with Symantec.
Does IT Outsourcing Pose Security Risks?
In Risk Management
An annual survey on security sheds light on a touchy subject in a time of economic difficulty here in the United States: job outsourcing in the tech industry.
Federal Computer Week: Security News
DHS could hire 1,000 more cybersecurity professionals
The Homeland Security Department plans to hire up to 1,000 new employees to work in cybersecurity, officials said today.
DHS establishes office for intelligence-sharing centers
The Homeland Security Department will establish a new office to coordinate its involvement with intelligence-sharing centers that rely on information technology.
When custom software was king
Custom technology used to be the only option for government agencies, but now commercial products address most needs, experts say.
Web 2.0 review could lead to restricted use of social networking in DOD
A review on how social media should be used at the Defense Department will likely lead to a policy that allows the use of Web 2.0 tools with restrictions due to security concerns, according to a DOD spokesman.
NIST readies Smart Grid security architecture
A cybersecurity working group is developing a security architecture and comprehensive set of security requirements to accompany the Smart Grid framework being developed by NIST's office for Smart Grid interoperability. A preliminary report is expected to be released for comment shortly.
Info Security News (isn) Mailing List
Carries news items (generally from mainstream sources) that relate to security.
New Malware Re-Writes Online Bank Statements to Cover Fraud
Posted by InfoSec News on Sep 30
http://www.wired.com/threatlevel/2009/09/rogue-bank-statements/
By Kim Zetter
Threat Level
Wired.com
September 30, 2009
New malware being used by cybercrooks does more than let hackers loot a bank account; it hides evidence of a victim's dwindling balance by rewriting online bank...
2Inmate hacker locks down jail computers
Posted by InfoSec News on Sep 30
http://www.theregister.co.uk/2009/09/29/inmate_hacker/
By John Leyden
The Register
29th September 2009
A UK prison computer system was left in lockdown after jail bosses gave a convicted cybercriminal the task of reprogramming it, the Sunday Mirror reports.
Douglas Havard, 27, an...
Defence officer discloses sensitive info to fake caller
Posted by InfoSec News on Sep 30
http://timesofindia.indiatimes.com/news/india/Defence-officer-discloses-sensitive-info-to-fake-caller/articleshow/5063466.cms
By Rajat Pandit
The Times of India
28 September 2009
NEW DELHI: Believe it or not, a person apparently managed to extract some ``sensitive information'' from a...
Cheapskate SMBs dodge buying security software
Posted by InfoSec News on Sep 30
http://news.techworld.com/security/3202905/cheapskate-smbs-dodge-buying-security-software/
By John E. Dunn
Techworld
29 September 09
Many UK SMBs probably spend as much re-filling the communal water cooler as they do buying security software, a global survey of the sector has found.
...
Linux Advisory Watch - September 28th 2009
Posted by InfoSec News on Sep 30
+----------------------------------------------------------------------+ | LinuxSecurity.com Weekly Newsletter | | September 28th, 2009 Volume 10, Number 40 | | | |...
The PLA on Parade
Posted by InfoSec News on Sep 30
http://online.wsj.com/article/SB10001424052748704471504574439800856344752.html
By DEAN CHENG
The Wall Street Journal
OPINION ASIA
SEPTEMBER 28, 2009, Perhaps the most prominent event marking the 60th anniversary of the founding of the People's Republic of China will be a massive parade...
Chinese checkers
Posted by InfoSec News on Sep 28
http://www.financialexpress.com/news/chinese-checkers/521967/
By Gurmeet Kanwal
Financial Express
Sept 27, 2009
In all the hype and hoopla surrounding China’s incursions across the Line of Actual Control (LAC) into Ladakh, Sikkim and Arunachal Pradesh, a more sinister plan to attack...
Financial Crypto and Data Security 2010: Announcing 3 Co-located Workshops
Posted by InfoSec News on Sep 28
Forwarded from: Conference Mailer <noreply (at) moon.crypto.cs.stonybrook.edu>
Dear Colleagues,
We are glad to announce 3 workshops co-located with the Financial Cryptography and Data Security Conference.
---
Workshop on Real-Life Cryptographic Protocols and Standardization ...
Infected Mac Computers Worth 43 Cents in Cyber-underworld
Posted by InfoSec News on Sep 28
http://www.eweek.com/c/a/Security/Infected-Mac-Computers-Worth-43-Cents-in-Cyber-Underworld-653035/
By Brian Prince
eWEEK.com
2009-09-25
In a talk about the threats posed by Russian malware affiliate networks, a Sophos security researcher reveals an operation offering people 43 cents per...
Denial-of-service-attack worries dominate Cisco patching
Posted by InfoSec News on Sep 28
http://www.gcn.com/Articles/2009/09/25/Cisco-denial-of-service-worries.aspx
By Joab Jackson
GCN.com
Sept 25, 2009
Abandon all hope, ye who get stung by a denial-of-service attacks.
Well, almost all hope. If the latest semiannual round of security advisories from Cisco are any...
S.A. picked for cyber security program
Posted by InfoSec News on Sep 28
http://www.mysanantonio.com/news/local_news/61988062.html
By Brian Chasnoff
Express-News
09/27/2009
The Department of Homeland Security has selected San Antonio as one of two Texas cities to participate in a cyber security-training program that is evolving with the support of a...
InformationWeek Security News
InformationWeek
Beware Hijacked Social Networking Accounts, FBI Warns
By Thomas Claburn
Social networking sites are becoming a more popular attack vector for cybercriminals because people trust those they believe to be friends.
IBM To Launch Web-Based E-Mail Service
By Paul McDougall
LotusLive iNotes puts Big Blue into competition with Google's Gmail service.
IBM To Launch Web-Based E-Mail Service
By Paul McDougall
LotusLive iNotes puts Big Blue into competition with Google's Gmail service.
Mozilla Tests More Secure Firefox
By Thomas Claburn
Versions of Firefox with enhanced cross-site scripting protection have been released for testing.
Mozilla Tests More Secure Firefox
By Thomas Claburn
Versions of Firefox with enhanced cross-site scripting protection have been released for testing.
RIM Patches BlackBerry Phishing Flaw
By Marin Perez
The vulnerability can make the smartphone think a malicious Web site is a trusted one.
RIM Patches BlackBerry Phishing Flaw
By Marin Perez
The vulnerability can make the smartphone think a malicious Web site is a trusted one.
US Agreement With ICANN Leaves Much Undone
By Thomas Claburn
The oversight of the Internet's infrastructure will become more international under a new government agreement with ICANN. But many concerns remain unresolved.
Google's Postini May Shape Wave Security
By Thomas Claburn
Two years after being acquired by Google, Postini is looking to extend its messaging management tools to other Google services.
Internet Has Never Been More Dangerous
By Thomas Claburn
Security experts are raising the alarm about the continued proliferation of malware.
Internet Has Never Been More Dangerous, Report Says
By Thomas Claburn
The Anti-Phishing Working Group reports record levels of fake antivirus software and other malware.
Internet Has Never Been More Dangerous, Report Says
By Thomas Claburn
The Anti-Phishing Working Group reports record levels of fake antivirus software and other malware.
TSA Awards $493 Million Contract To CSC
By J. Nicholas Hoover
The Transportation Security Administration has replaced Unisys with Computer Sciences Corporation as its primary managed services provider.
Global CIO: Accenture Should Start Buying—Here's A Shopping List
By Bob Evans
Column about how Accenture can become a hunter instead of the hunted by acquiring several great IT companies to deliver new value to CIOs.
Record Penalty Against Microsoft Tossed
By Paul McDougall
Ruling overturns jury verdict that would have handed $388 million to Singapore's Uniloc.
Record Penalty Against Microsoft Tossed
By Paul McDougall
Ruling overturns jury verdict that would have handed $388 million to Singapore's Uniloc.
Microsoft Bing Ads Warn About Scams
By Thomas Claburn
As part of its ongoing security push, Microsoft is teaming up with the government and Western Union to run search ads to educate users about potential online fraud.
Microsoft Bing Ads Warn About Scams
By Thomas Claburn
As part of its ongoing security push, Microsoft is teaming up with the government and Western Union to run search ads to educate users about potential online fraud.
Bank Drops Google Suit Over Errant Gmail
By Thomas Claburn
After obtaining information about the Gmail account holder who accidentally received confidential information, Rocky Mountain Bank and Google have agreed to end the bank's lawsuit.
Microsoft Offers Free Security Essentials
By Paul McDougall
New antivirus service could pose threat to paid entrants in the multibillion dollar PC security industry.
Microsoft Offers Free Security Essentials
By Paul McDougall
New antivirus service could pose threat to paid entrants in the multibillion dollar PC security industry.
Is Mac Security Software Necessary?
By Thomas Claburn
Verizon is offering security software to its Internet service customers who use Macs. But is that something Mac users really need?
Is Mac Security Software Necessary?
By Thomas Claburn
Verizon is offering security software to its Internet service customers who use Macs. But is that something Mac users really need?
Wolfe's Den Podcast: Trend Micro Takes Security To The Cloud
By Alexander Wolfe
Eva Chen, CEO and co-founder of Trend Micro, talks about what cloud-computing users should do to secure their data and how her company is itself using the cloud to protect against the explosion of malware.
Wolfe's Den Podcast: Trend Micro Takes Security To The Cloud
By Alexander Wolfe
Eva Chen, CEO and co-founder of Trend Micro, talks about what cloud-computing users should do to secure their data and how her company is itself using the cloud to protect against the explosion of malware.
What CIOs Think About Windows 7
By J. Nicholas Hoover
Most are doing some testing, but many have no firm deployment plans.
What CIOs Think About Windows 7
By J. Nicholas Hoover
Most are doing some testing, but many have no firm deployment plans.
Are Win 7's R2 Server Ties A Blessing Or Curse?
By Michael Healey
Several key desktop features only work if paired with the upgraded server operating system.
Are Windows 7's R2 Server Ties A Blessing Or Curse?
By Michael Healey
Several key desktop features only work if paired with the upgraded server operating system.
Full Disk Encryption Evolves
By Greg Shipley
The Opal standard paves the way for hardware-based encryption.
Coverity Reports Reduction In Code Defects
By Charles Babcock
The company started scanning open source code for reliability and integrity three years ago and has a Department of Homeland Security contract.
InSecurity Complex
Keeping tabs on flaws, fixes, and the people behind them.
Ig Nobel winners: Knuckle cracking to panda poo
By Elinor Mills
Have you ever worried that knuckle cracking will give you arthritis or wondered why pregnant women don't tip over? Me too.
Research into those topics--as well as studies finding that diamonds could be created from tequila and giant panda feces are good for composting--received Ig Nobel Prizes in a ...
Targeted e-mails distribute malware in PayChoice breach
By Elinor Mills
Payroll processor PayChoice said Thursday it is investigating a breach in which customers received targeted e-mails purporting to be from the company but were designed to trick people into downloading malware.
Workers received e-mails last week that directed them to download a browser plug-in or visit a Web site so ...
Facebook shuts down malicious fake profiles
By Elinor Mills
Facebook on Thursday fended off an attack in which multiple identical profiles were created to spread malware.
Antivirus provider AVG Technologies said users of its LinkScanner service detected numerous profiles that were identical except with different names and each included a link to what was represented as a home video ...
Banking Trojan steals money from under your nose
By Elinor Mills
Researchers at security firm Finjan have discovered details of a new type of banking Trojan horse that doesn't just steal your bank log-in credentials but actually steals money from your account while you are logged in and displays a fake balance.
The bank Trojan, dubbed URLZone, has features designed ...
Misfired e-mail was never viewed by Gmail user
By Elinor Mills
A sensitive e-mail mistakenly sent by a bank to a Gmail address that prompted a court to order Google to deactivate the account was not viewed by the recipient and has been deleted, the bank said on Tuesday.
The e-mail, sent by an employee of Jackson, Wyo.-based Rocky Mountain ...
Google, bank resolve issue over misfired e-mail
By Elinor Mills
A bank that accidentally sent sensitive customer information to a Gmail address and persuaded a judge to order Google to deactivate the account has resolved the issue with Google and the companies have filed a motion to dismiss the case.
Google spokesman Andrew Pederson declined to say exactly how the ...
McAfee Avert Labs
Cutting edge security research as it happens.......
Malware and standards – is it possible?
By Igor Muttik on Web and Internet Safety
I am excited to be involved in the joint industry effort of defining an XML format which will allow for the rapid exchange of information between security companies. This work was done by the “Malware Working Group” operating as part of the “Industry Connections Security Group” (ICSG) and under the umbrella of the IEEE. If you Google [...]
Malware Authors Profit From Disasters
By Patrick Comiotto on Web and Internet Safety
McAfee Labs has discovered another attempt by ruthless malware authors to profit from disaster and tragedy. While searching for information on the earthquakes and tsunami that struck the islands of American Samoa on 29 September, I saw the following results from the Google search engine: Clicking on one of the links, which at first sight seem [...]
Rebranded Rogue Anti-Virus Strikes Again
By Avelino Rico Jr on Web and Internet Safety
Recently, we analysed samples of a new fake anti-virus program that brands itself as Alpha Antivirus. This program uses the following filenames: alphaav.exe and msnaoladdon.dll. Alpha Antivirus is a new FakeAlert variant evolved from the Personal Antivirus family of rogue anti-virus software. Like many FakeAlert malware, Alpha Antivirus promotes itself through the use of pop-up web [...]
Blast from the past: Fresh wave of targeted attacks using PowerPoint
By Rahul Mohandas on Web and Internet Safety
The use of social engineering to grab attention of recipients and to deliver malware is not something novel. The latest trend in spreading malware is to manipulate a happening celebrity story, disaster or other high profile news event. The threat could be delivered as emails or poisoned search engine results which leads to malware. In [...]
Network World on Security
The latest security news, analysis, reviews and feature articles from NetworkWorld.com.
Secret Service says Facebook assassination poll posed no threat
The Secret Service has no plans to prosecute the juvenile found responsible for a facebook poll asking: "Should Obama be killed?"
Microsoft's Free AV Looks Good in New Test Results
Microsoft's new free Security Essentials looks like it can get the job done, according to new scanning tests conducted by AV-Test.org.
Fake antivirus overwhelming scanners
Fake antivirus programs are multiplying at such a rate they could start to overwhelm the detection capabilities of signature-based scanners, the latest figures from the Anti-Phishing Working Group (APWG) have hinted.
After a few months' rest, SQL Web attack spreads anew
A botnet network of hacked computers has sprung back to life in the past few days and started infecting Web sites so that they attack PCs of unsuspecting visitors.
House members seek stronger health care data breach notifications
A House committee is voicing concern over a controversial provision in a recently passed health care breach notification bill that gives health care companies considerable discretion on whether to disclose a data breach.
Report: Lack of eHealth standards, privacy concerns costing lives
A new survey of medical executives by PriceWaterhouseCoopers finds the mining of electronic health record information will be the greatest asset to medical facilities over the next five years, but that privacy concerns and a lack of technology is hampering efforts and costing lives.
Microsoft defends its anti-malware software after Symantec piles on
Microsoft is defending the merits of its free Security Essentials anti-malware software after a top Symantec engineer badmouthed the new release.
Large online payroll service hacked
In a somewhat unusual data breach, hackers recently stole the login credentials of an unknown number of customers of payroll processing company PayChoice Inc., and then attempted to use the data to steal additional information directly from the customers themselves.
Microsoft wary as security, identity integration plan lags
Microsoft is on the verge of finally providing some pieces of software to back up its ambitious plan to integrate its security and identity technologies, but the company admits it is moving slower than it had anticipated.
Lawmakers want trusted airline passenger program revived
Lawmakers called upon the Transportation Security Administration and private sector companies to quickly re-establish a nationwide registered traveler program to help frequent travelers get through airport security checkpoints faster.
U.S. Homeland Security wants to hire 1,000 cybersecurity experts
The Department of Homeland Security is looking to hire 1,000 cybersecurity professionals in the next three years according to the agency’s secretary Janet Napolitano.
2009 Women of Influence Award Winners Named
The Women of Influence awards honor accomplished, inspirational women in IT security.
Security researchers ask: Does self-destructing data really vanish?
Researchers this week published a paper describing how they broke Vanish, a secure communications system prototype out of the University of Washington that generated lots of buzz when introduced over the summer for its ability to make data self-destruct.
Cost of IT security breaches jumps 97 per cent
IT security breaches at Canadian firms account for an average annual loss of $834,149, a figure that reflects a 97 per cent increase from the $423,469 average cost reported in 2008, according to a national study released Tuesday.
Omega CE Helps Unearth Stubborn Malware
Omega CE (free beta) helps get rid of files from malware infections that might hide or protect themselves from normal deletion. In the hands of an expert the tool could prove useful, but it may not be of much help to non-gurus.
Independent tester: Security Essentials 'very good'
Microsoft's free Security Essentials antivirus software identified 98% of over half a million malware samples, an accuracy rating an independent testing company called "very good" today.
Microsoft Covers the Basics With Security Essentials
Microsoft has released its free antivirus software, Microsoft Security Essentials (MSE). As the name implies, Microsoft's new security software removes the bloated bells and whistles found in other products, like Microsoft's discontinued Windows Live OneCare, and provides only the essential protection.
Express Scripts: 700,000 notified after extortion
Nearly one year after being hacked by computer extortionists, pharmacy benefits management company Express Scripts now says hundreds of thousands of members may have had their information breached because of the incident.
Defunct airport fast-pass program may be revived
Tens of thousands of subscribers to a registered air traveler program, who were left feeling scammed when the company offering the service abruptly went out of business, may soon get a break.
Rush Windows patch for SMB 2 flaw unlikely, says researcher
Microsoft isn't likely to ship an emergency fix for a critical Windows vulnerability in SMB 2 disclosed earlier this month, a security researcher said yesterday.
Microsoft passes its first SAML 2.0 interoperability test
Microsoft completed its first SAML interoperability test and the results are in: Active Directory Federation Services 2.0 software received a passing grade.
5 Mistakes a Security Vendor Made in the Cloud
Here's the cautionary tale of how one security vendor went astray in the computing cloud, and what customers can learn from it. (Part 3 in a series)
Five top IT budget killers
Did you know there are areas in your business that you're spending more money on than you probably should? IBM Canada's strategic initiatives executive, Chris Pratt, came up with five top IT budget killers for businesses and offers tips on how companies can improve their bottom lines.
Microsoft blackballs pirates from Security Essentials
Microsoft will block users running counterfeit copies of Windows from installing the free Security Essentials antivirus software, the head of the company's anti-piracy group said Tuesday.
BPI alerts BT to 100,000 suspected illegal downloaders
BT has been given 100,000 IP addresses belonging to BT broadband customers suspected of illegally filesharing.
Cheapskate SMBs dodge buying security software
Many UK SMBs probably spend as much re-filling the communal water cooler as they do buying security software, a global survey of the sector has found.
SMBs risk data loss by neglecting backups
Small to medium enterprises (SMEs) are risking the loss of valuable corporate data because they are failing to take enough steps to secure their data and are not backing it up.
Microsoft Security Essentials is Solid
According to Symantec's VP of Engineering Jens Meggers "Security Essentials is a poor product" and "the risk on the Web today is far too high for 'basic.' " Trend Micro's Carol Carpenter said, "It's better to use something than to use nothing, but you get what you pay for."
Facebook warns members about rise in '419' scam
More and more fraudsters are harvesting the log-in data of Facebook members in order to impersonate them and ask their friends for money, according to the social-networking company.
Two Romanians to face phishing charges in U.S.
The U.S. Department of Justice has extradited two Romanians to the U.S., where they face charges in connection with a massive phishing scam.
Report highlights Smart Grid security vulnerabilities
A cybersecurity coordination task force released a report this week that assesses various security and privacy requirements for the U.S. Smart Grid, as well as strategies needed to address them.
New Trojan gives criminals full-service bank theft
Security experts agree that cyber-criminals are getting better, but a new Trojan takes things to a whole new level.
Singapore to form national cyber-security agency
Singapore will set up a government agency, the Singapore Infocomm Technology Security Authority (SITSA), to handle technology-related threats to the city-state's national security, a government minister said Wednesday.
Texas governor blames Web campaign flop on hackers
The kick-off for Texas Governor Rick Perry's 2010 re-election campaign was marred Tuesday by a Web site outage that staffers are now calling a denial-of-service attack.
Applying the science of persuasion to security awareness
Do you ever wonder whether all those security-awareness posters, coffee mugs, pens, mouse pads, and sandwich-bag clips are having any effect at all to improve security?
World of Warcraft players targeted by 'free mounts' phishing scheme
Lawmakers eye bill to make P2P file-sharing safer
The House Committee on Commerce and Energy will hold a markup hearing Wednesday on a bill designed to make it safer for consumers to use peer-to-peer (P2P) file-sharing software.
To fight online scammers, Bing shows warning ads
Look for a way to fix your credit or transfer money on Microsoft's Bing these days and you'll get some friendly advice from the U.S. Federal Trade Commission.
Microsoft's New Free Antivirus Hits the Streets
Microsoft today lifted the curtain on its Microsoft Security Essentials, the free successor to its OneCare security program.
The U.S. Patriot Act has an impact on cloud security
Cloud security includes the obligation to meet regulations about where data is actually stored, something that is having unforeseen consequences for U.S. firms trying to do business in Canada.
Microsoft Security Essentials coming tomorrow
Microsoft's free antivirus software, Security Essentials, will be made publicly available tomorrow.
UK firms spend less than £1,000 a year on security
Most British companies (98 percent) spend less than £1,000 a year on IT security, says Panda Security.
Defining Cloud Security: Six Perspectives
Cloud computing is all the rage these days, but confusion abounds over how best to secure it. Here, six IT security practitioners share their ideas on the key components of a cloud defense (part of an ongoing series).
Microsoft Security Essentials Launches Tuesday
If you can't wait to get your hands on Microsoft's upcoming free antivirus app, and you missed the limited public beta period, you won't have to wait any longer. Microsoft has confirmed that its Security Essentials antivirus software will be publicly available September 29.
Senators want to end telecom immunity for spying program
Four Democratic U.S. senators will introduce a bill to repeal a provision protecting telecommunications carriers from lawsuits targeting their assistance to a controversial U.S. National Security Agency surveillance program.
School boards hit with cash-stealing Trojan
The U.S. Federal Bureau of Investigation is probing a rash of reported online computer intrusions that have resulted in hundreds of thousands of dollars being stolen from school districts in Illinois.
Data Destroyer Disk Wipe Ensures Your Privacy
Simply formatting a drive has never been enough to get rid of data completely; otherwise, data recovery specialists would be out of a job. That's where Data Destroyer Disk Wipe ($14, free demo) comes in. Not only does it erase data on a drive, it writes and rewrites over that data with random bytes, making the wiped data totally unrecoverable.
SMBs need help with disaster recovery planning
Small to medium-sized business (SMB) customers are not as well protected with a disaster recovery (DR) plan as they think, opening the door for ripe channel opportunity, suggests recent findings from a Symantec-sponsored survey.
Special Report: Security Versus the Mob
An in-depth look at the battle against organized crime in the physical and digital worlds, from retail theft to identity theft.
Adobe Lightroom, Camera Raw bug hits PowerPC users
Adobe has highlighted a bug discovered in the latest Photoshop Lightroom and Camera Raw updates that may hit Mac PowerPC users.
Do we need a 'computer driving test'?
In a recent post about ads for fake virus scanners and their propensity for snagging less experienced/more gullible users ("Microsoft declares war on 'scareware'"), I asked the following questions:
Do phishers have more poles in the water?
Are phishing attacks going up or down? The answer depends on who you ask.
Alton is the UK's most spammed town, but why?
Alton is the most spammed town in the UK, according to an analysis by messaging service provider MessageLabs. But why does so much spam head to an innocuous town of 17,000 people in Hampshire?
Adobe, McAfee to combine DRM and data-loss prevention
Adobe Systems and McAfee will jointly develop a product that combines digital rights management capabilities with technology designed to prevent data from leaking outside corporate networks, the companies said Monday.
To Fight Worms, Use Ants
To combat worms, Trojans and other malware, a team of security researchers wants to use ants.
UNC data breach exposes 163,000 SSNs
The University of North Carolina at Chapel Hill today began notifying about 163,000 women about the potential compromise of their Social Security numbers and other personal information after a hacker breached a system containing the data.
Bugs and Fixes: File-Sharing Vulnerability Hits Vista
Windows Vista users (and IT folks taking care of Server 2008 computers) should watch out for a new security hole involving Windows file sharing. A remote attacker could assume full control of a vulnerable computer by exploiting a flaw in the SMB protocol for Windows file and printer sharing. Most home users should already have a firewall in place that blocks attempts to reach the ports that SMB uses (139 and 445). Microsoft may have a patch available by the time you read this, but as of this writing no fix was yet available. For more details, see Microsoft's security advisory.
DHS privacy report: Laptop searches at airports infrequent
The U.S. Department of Homeland Security's annual privacy report card revealed more details on the agency's controversial policy involving searches of electronic devices at U.S. borders.
A security evangelist shares his best practices
Anyone who has the word “evangelist” in his business title must really love his job. This week, John Linkous, Security and Compliance Evangelist at eIQnetworks shares his best practices for information security.
Gartner: Don't let suppliers set your DLP strategy
Businesses should plan a thorough data loss prevention strategy before talking to suppliers, Gartner has advised.
Hackers pay 43 cents per hijacked Mac
A network of Russian malware writers and spammers paid hackers 43 cents for each Mac machine they infected with bogus video software, a sign that Macs have become attack targets, a security researcher said yesterday.
Med students' tweets, posts expose patient info
Future doctors are too frequently putting inappropriate postings and sometimes confidential patient information, on social sites like Facebook and Twitter, according to study published in the Journal of the American Medical Association.
Google barks back at Microsoft over Chrome Frame security
Google hit back at Microsoft today, defending the security of its new Chrome Frame plug-in and claiming that the software actually makes Internet Explorer (IE) safer and more secure.
IRS scam now world's biggest e-mail virus problem
Criminals are waging a nasty online campaign right now, hoping that their victims' fears of the tax collecter will lead them to inadvertently install malicious software.
Russian cybergangs make the Web a dangerous place
Russian cybergangs have established a robust system for promoting Web sites that sell fake antivirus software, pharmaceuticals and counterfeit luxury products, according to a new report from security vendor Sophos.
The Register - Security
Biting the hand that feeds IT
Conficker smites Oxford Brookes network
Former polytechnic gets pwned
Conficker infected communal PCs used by students at Oxford Brookes University on Thursday, leaving sysadmins with a difficult clean-up job.…
Mozilla unveils cure for Web 2.0 world run amok
Putting XSS worms on notice
The Mozilla Foundation has unveiled an early version of its Firefox browser that it says could virtually eliminate one of the most common attack forms now menacing the web.…
Google (finally) adds protection for common Web 2.0 attack
Better late than never
Google has beefed up the security of Gmail and its other services by adding a feature to login pages that blocks one of the more common forms of web attacks.…
Banking Trojans double as scareware runs wild
Interwebs clogged up with crimeware
The prevalence of scareware packages has reached epidemic proportions, with 485,000 different samples detected in the first half of 2009 alone.…
Google results flog millions of compromised webpages
Top billing
Two ongoing scams are tricking Google and other search engines into prominently displaying millions of compromised webpages that attempt to hijack end users' computers or steal their credit card numbers, researchers said.…
Automated attacks push malware on Facebook
More captcha busting suspected
Hackers have figured out how to create computer-generated Facebook profiles and are using them to trick unsuspecting users into installing malware, a security researcher warned Thursday.…
Google Wave search poisoned by scareware scammers
Security Essentials results also rigged
Scareware slingers have poisoned search results for Google Wave in a bid to expose users seeking the communication software to a fake anti-virus scan instead.…
Next-gen Trojan rewrites bank statements
Crooks loot $440K using uber-subtle stealth malware
Black hat hackers have created a new strain of Trojan that rewrites online bank statements to disguise fraud.…
One thumb up for MS Security Essentials in early tests
Detection fair but clean-up lacking, reports AV-Test.org
Independent testing lab AV-Test.org has published one of the first reviews of Microsoft Security Essentials, Redmond's freebie anti-virus package.…
Botnet buries commands in image files
Stego backdoor hub
Security researchers have identified a botnet that borrows an idea from steganography by burying commands in jpg images.…
SSL spoof bug still haunts IE, Safari, Chrome
Thanks to Microsoft
Nine weeks after a hacker demonstrated how to spoof authentication certificates for virtually any website on the internet, users of Internet Explorer and many other applications remain susceptible because Microsoft hasn't patched the underlying vulnerability.…
Malware ecosystem thrives thanks to pay-per-install fees
Booming economy
A report published Wednesday exposes a growing ecosystem that combines the talents of software developers, web marketers, and ordinary grunts to infect millions of end users' machines.…
Man on trial over £600k NatWest phishing scam
Mule in the middle attack
Fraudsters used a sophisticated Trojan to steal online bank login credentials from the compromised PCs of their victims, London's Southwark Crown Court heard on Tuesday.…
Microsoft Security Essentials shakes up consumer antivirus
First impressions
Analysis Early tests with the full version of Microsoft's new free malware scanner software reveals a no-frills security package that does what it says on the tin.…
Researchers unmask two faces of zombie networks
Dr Consumer spam, meet Mr corporate hacking
Botnets are responsible for sending 87.9 per cent of all junk mail messages, according to the latest monthly stats from email security outfit MessageLabs.…
Bank snafu Gmail missive never opened
And never will be
The confidential email at the heart of a roundabout US lawsuit against Google was never opened, according to the bank that accidentally sent the missive to the wrong Gmail account.…
Alleged Romanian phishers (finally) hauled into US courts
Better late than never
Two Romanian men accused of internet scams that defrauded customers of PayPal, Citibank and other financial institutions have been extradited to the United States to face charges.…
Researcher: No emergency patch for critical Windows bug
Redmond defenses neuter exploit code
A security researcher has downplayed the significance of publicly released attack code exploiting a critical vulnerability in newer versions of Windows, saying it isn't reliable enough to force Microsoft to issue an emergency patch.…
Stallman backpedals on Mac OS backdoor claims
Free software advocate still no fan of DRM
Free software activist Richard Stallman has withdrawn an accusation that Apple's Mac OS X contained a backdoor after admitting there was no evidence to substantiate his earlier claims.…
MS opens up Security Essentials downloads from today
Suite intended for 'millions' of unprotected users
Microsoft plans to release the final version of its free-of-extra-charge anti-malware scanner later on Tuesday…
Inmate hacker locks down jail computers
Chaos reigns after cybercrook given programming project
A UK prison computer system was left in lockdown after jail bosses gave a convicted cybercriminal the task of reprogramming it, the Sunday Mirror reports.…
Google shuts down bank snafu Gmail account
Court order snuffs innocent bystander
Google has resolved a lawsuit from a US bank that accidentally sent 1,300 confidential tax IDs to an innocent Gmail account, but not before the web giant complied with a court order to shutdown the account and disclose certain account info.…
Sunbelt buckles up for anti-bloatware drive
Slow, fat rivals taken to task
The anti-virus bloatware problem is getting worse despite what some vendors may claim, according to figures from Sunbelt Software.…
Reddit swiftly squishes XSS worm
WTF comment spam script
Popular social news website Reddit has stopped the spread of a cross-site scripting (XSS) worm that hit the site on Monday.…
Phishing fraud hits two year high
Rumours of the death of email scams wildly exaggerated
Phishing attacks reached a record high during the second quarter of 2009, with 151,000 unique attacks, according to a study by brand reputation firm MarkMonitor.…
Open source code quality improving
Can Microsoft say better?
The quality and security levels of open source code are continuing to improve, according to the latest annual audit by code analysis tools vendor Coverity.…
SIM card hack suspect released on bail
That's an awful lot of credit
An alleged Jamaican phone system hacker who is accused of pinching 10m Jamaican dollars(US$115,000) in call credit from local carrier Digicel has been released on bail.…
Penis pill spam: The hard figures
$1,600 per spam run a day?
The economics of male enhancement pill spammers have been laid bare by security researcher Dmitry Samosseiko.…
SANS Information Security Reading Room
Last 25 Computer Security Papers added to the Reading Room
Cisco Security Agent and Incident Handling
Category: Incident Handling
Paper Added: October 1, 2009
Best Practices in Data Protection: Encryption, Key Management and Tokenization
Categories: Application/Database Sec,Best Practices,Encryption & VPNs
Paper Added: September 29, 2009
Six Ways to Reduce PCI DSS Audit Scope by Tokenizing Cardholder data
Categories: Best Practices,eCommerce,Encryption & VPNs
Paper Added: September 29, 2009
Simple Windows Batch Scripting for Intrusion Discovery
Categories: Auditing & Assessment,Incident Handling
Paper Added: September 29, 2009
Mitigating Insider Sabotage
Categories: Case Studies,Incident Handling
Paper Added: September 28, 2009
SANS Internet Storm Center, InfoCON: green
Samba Security Information Disclosure and DoS, (Sun, Oct 4th)
Samba released several updates to fix some security vulnerabilities. Anyone running Samba should tak ...(more)...
New ISC Feature: One Liner "event notes", (Sun, Oct 4th)
We are going to introduce a new feature this weekend: One liner event notes. These notes ...(more)...
TEST: Soon to come... one liner news stories about outages and other "small events", (Sun, Oct 4th)
------ Johannes B. Ullrich, Ph ...(more)...
Cyber Security Awareness Month - Day 4 - Port 20/21 - FTP-data/FTP, (Sun, Oct 4th)
First proposed in April 1971, the File Transfer Protocol is one of the oldest protocols of the Inter ...(more)...
Cyber Security Awareness Month - Day 3 - Port 5900 - VNC, (Sat, Oct 3rd)
Friendly uses tcp/5900 is used by VNC, a platform independent desktop sharing and remote control ap ...(more)...
Verizon New York area issues, (Fri, Oct 2nd)
A number of readers in the last 20 minutes have been indicating that there has been an outage with V ...(more)...
Cyber Security Awareness Month - Day 2 - Port 0, (Fri, Oct 2nd)
The second day of Cybersecurity Awareness Month is dedicated to the strange, and anomalous port numb ...(more)...
VMware Fusion updates to fixes a couple of bugs, (Fri, Oct 2nd)
VMWare have informed us that an update is available for their Apple Mac version of their VMWare envi ...(more)...
New SysInternal fun for the weekend, (Fri, Oct 2nd)
A whole raft of new SysInternal goodness has been released just before the weekend so we have new ve ...(more)...
New version of OpenSSH released, (Fri, Oct 2nd)
The guys and gals over at OpenSSH have announced that a new version has been released. This is versi ...(more)...
Increase in ssh root access attempts, (Thu, Oct 1st)
We've received a few notes today about a recent increase in attempts to log in as root via ssh. The ...(more)...
Cyber Security Awareness Month - Day 1 - Port 445 - SMB over TCP, (Wed, Sep 30th)
Port 445 provides SMB over TCP. From Microsoft Windows supports file and printer s ...(more)...
To install AV, or Malware - That is the Question, (Wed, Sep 30th)
Yesterday we posted a diary about the official release of Microsoft's new Security Essentials produc ...(more)...
Microsoft Security Essentials AV, (Wed, Sep 30th)
Microsoft Security Essentials (MSE) hit the streets today (Thanks Kia for the heads up). So I ...(more)...
Use Emerging Threats signatures? READ THIS!, (Sun, Sep 27th)
For all you who use the signatures supplied by Emerging Threats within your IDS deployment, time to ...(more)...
Cyber Security Awareness Month , (Sun, Sep 27th)
October is Cyber Security Awareness Month, and as we have done the past two years we plan to use our ...(more)...
Conficker detection hints, (Sat, Sep 26th)
We received some good responses regarding Conficker detection recently. Here are a couple of h ...(more)...
Malware delivered over Google and Yahoo Ad's?, (Fri, Sep 25th)
www.theregister ...(more)...
Conficker Continues to Impact Networks, (Fri, Sep 25th)
It appears that Conficker is still alive and well. www ...(more)...
Categories of Common Malware Traits, (Fri, Sep 25th)
When examining malicious software, the analyst looks for several categories of traits that malware o ...(more)...
SANS NewsBites
All Stories From Vol: 11 - Issue: 77
US Army Data Leaked Through P2P Networks (October 2, 2009)
The Washington Post reports that personal data of US soldiers are being leaked through peer-to-peer (P2P) file-sharing programs.......
Survey: US Consumers Do Not Want Behavioral Advertising (September 30 & October 1, 2009)
A study conducted jointly by the University of Pennsylvania and the University of California, Berkeley Center for Law and Technology found that US Internet users object to behavioral advertising.......
Court Vacates TRO Against Google; Misdirected eMail Was Never Opened (September 29 & 30, 2009)
A court has granted a joint motion to dismiss a case brought by Rocky Mountain Bank against Google.......
PayChoice Breach (October 1, 2009)
The payroll processing company PayChoice has notified its customers that attackers stole login information and passwords of customers and have been using such information in attempts to get more sensitive information from these customers.......
Spammers Break Facebook CAPTCHA (October 1, 2009)
Malware purveyors have managed to break the Facebook CAPTCHA (completely automated public Turing test to tell computers and humans apart), allowing them to automate the creation of Facebook pages.......
BT Resisting BPI's Demand to Act on List of Suspect IP Addresses (September 30, 2009)
The British Phonographic Industry (BPI) has provided UK Internet service provider (ISP) BT with the IP addresses of 100,000 BT customers the BPI suspects of illegal filesharing.......
Peer-to-Peer Legislation Passes in Committee (September 29 & 30 & October 1, 2009)
The House Energy and Commerce Committee this week approved a bill aimed at protecting users from inadvertently sharing information meant to stay private.......
Express Scripts Notifies 700,000 of Data Security Breach (September 30, 2009)
Pharmacy benefits management company Express Scripts says that approximately 700,000 people have been notified that their personally identifiable information was compromised following a data security breach in 2008.......
Microsoft Security Essentials Not Available to Pirates (September 30, 2009)
Users running unlicensed or improperly licensed copies of Microsoft Windows will not be able to install the company's newly-released Security Essentials antivirus software.......
Two Men Extradited to Face Charges in Phishing Case (September 30, 2009)
Two Romanian men have been extradited to the US to face charges in connection with phishing schemes that targeted customers of PayPal, Citibank and other financial institutions.......
URLZone Trojan (September 29 & 30, 2009)
New, sophisticated malware is making it harder to detect some fraudulent online bank transactions.......
Google Case Guest Editor Analysis: William Hugh Murray
The five most beautiful words in the English language are, "Congress shall make no law.......
Judge Orders Google to Deactivate Account (September 24 & 28, 2009)
A US District Court Judge in California has ordered Google to deactivate the Gmail account of a user who was accidentally sent confidential bank information.......
Court Upholds Decision to Revoke Bottle Domains' Registrar Accreditation (September 26 & 28, 2009)
Last week, an Australian court upheld a decision made by the Australian Domain Name Administrator (auDA) to terminate domain registrar Bottle Domains' accreditation after the company failed to disclose a data security breach that occurred in 2007.......
House Subcommittee Approves Cyber Security R&D Bill Amendment (September 25, 2009)
A US House subcommittee has approved legislation aimed at bolstering the Cybersecurity Research and Development Act.......
Cyber Criminals Targeting Foreign Journalists in China (September 28, 2009)
Cyber attackers have been targeting foreign journalists in China with malicious email.......
Reddit Fixes Cross-Site Scripting Hole (September 28, 2009)
Administrators of the Reddit social news aggregator site have fixed a cross-site scripting (XSS) security hole that was being exploited to post spam comments to Reddit threads.......
Inmate Tapped to Help With Computer Program Accessed Hard Drive (September 27, 2009)
Prison officials at Ranby Prison in Nottinghamshire, UK who wanted to create an internal television station at the facility asked an inmate to help create a program to facilitate the process.......
US-CERT Warns of Spam Pretending to be From IRS (September 25 & 28, 2009)
The US Computer Emergency Readiness team (US-CERT) has issued an alert warning of a spam attack in which the messages are spoofed to appear to come from the US Internal Revenue Service (IRS) regarding underreported income.......
UNC Notifying Mammography Research Project Participants of Data Breach (September 25, 2009)
The University of North Carolina at Chapel Hill (UNC) is notifying 163,000 women whose personal information was exposed in a computer security breach.......
FBI Investigating Cyber Theft of School District Funds (September 25 & 28, 2009)
The FBI is looking into a series of cyber attacks across the country including several at public school districts in Illinois.......
Plea Deal for DOD Intelligence Analyst (September 24, 2009)
A US Defense Department intelligence analyst has agreed to a plea deal that clears him of charges of felony hacking.......
Construction Company Sues Bank for Money Lost in Cyber Scam (September 23 & 24, 2009)
A Maine construction company is suing a bank for not taking adequate precautions that could have prevented cyber thieves from stealing more than half-a-million dollars from the company's account.......
Demand Up for Technical Security Skills; Demand Fading for Security Policy and Compliance Skills (September 25, 2009)
GovInfoSecurity published a certification review today that highlights the changing character of hiring interest in security people.......
PCI DSS Compliance Survey (September 23, 2009)
According to the PCI DSS (Payment Card Industry Data Security Standard) Compliance survey, commissioned by Imperva and conducted by the Ponemon Institute, approximately 70 percent of entities that handle payment card transactions view compliance as a box checking exercise rather than as central to their operations.......
"Chat-in-the-Middle" Attack Preys on Online Banking Customers (September 18 & 24, 2009)
In a new twist on phishing, cyber thieves are posing as employees in a bank's fraud detection department in a live chat.......
Cisco Releases 11 Security Advisories (September 23 & 24, 2009)
Cisco has issued eleven security advisories to address vulnerabilities in its IOS router operating system and Unified Communications Manager; seven of the advisories address denial of service issues in the IOS.......
Former Employee Pleads Guilty to SCADA Intrusion and Damage (September 23, 2009)
Mario Azar has pleaded guilty to one count of damaging computer systems for tampering with the Supervisory Control and Data Acquisition (SCADA) system of Pacific Energy Resources in Long Beach, California, after learning he was not going to be offered a permanent position with the company.......
DOD IG Audit Finds Data Sanitization Problems for Decommissioned IT Equipment (September 21 & 23, 2009)
According to an audit report from the US Defense Department (DOD) Inspector General, some organizations within the Department are still disposing of information technology equipment without first scrubbing the data it contains.......
NIST Issues Smart Grid Interoperability Standards Draft (September 24, 2009)
The National Institute of Standards and Technology (NIST) has issued a draft report, the NIST Framework and Roadmap Smart Grid Interoperability Standards.......
Apple Releases iTunes Update (September 23 & 24, 2009)
Apple has issued a security update for iTunes that protects the music player against certain maliciously crafted playlists.......
New Cyber Security Research Center Opens in Belfast (September 24, 2009)
The Centre for Secure Information Technologies (CSIT) opened this week in Belfast, Northern Ireland.......
DOD to Lift USB Ban With Restrictions (September 21 & 22, 2009)
The US DOD plans to lift its ban on USB drives in a very restricted way.......
SearchSecurity: Security Wire Daily News
The latest information security news on IT threats, vulnerabilities and market trends from the award-winning SearchSecurity.com.
Voltage, RSA spar over tokenization, data protection
By Robert Westervelt
Voltage cites performance issues and the creation of a repository of cardholder data an attractive target for attackers. RSA calls Voltage's claims unfounded.
Feds announce 1,000 new security jobs
By Robert Westervelt
The Department of Homeland Security marks the start of National Cybersecurity Awareness month with a budget for 1,000 security pros over three years.
Phishing websites, rogue antivirus skyrocket in 2009
By Robert Westervelt
An Antiphishing Working Group report found phishing websites reaching the second highest level ever recorded. Rogue antivirus is also fueling an increase in malware infections.
Some IT security certifications are overvalued, analyst says
By Carolyn Gibney
Gartner Inc.'s Carsten Casper explains how to choose the right certification and why some security certifications may not be worth the investment.
The search for PCI's holy grail
By Robert Westervelt
Two payment processors have developed separate systems to protect credit card transaction data: Format-preserving encryption vs. in-motion encryption and token technology. Which solution is better?
SMS attacks against BlackBerry certificate flaw possible
By Robert Westervelt
Research In Motion (RIM) is warning that SMS attacks targeting BlackBerry users could take advantage of a certificate handling flaw, tricking users into visiting an attack website.
Experts, vendors search for PCI's holy grail
By Robert Westervelt
The First Data-RSA partnership is pitted against the Heartland-Voltage E3 project in the payment industry race for securing transactions.
University data breach exposes 163,000 women to identity theft
By Robert Westervelt
The women were part of mammography study at the University of North Carolina's School of Medicine. The server could have been breached as far back as 2007, officials said.
Security - RSS Feeds
Security - RSS Feeds
RIM Plugs BlackBerry Security Hole
Research In Motion fixes a security bug it says left BlackBerry users open to phishing attacks.
- Research In Motion has plugged a security hole that left BlackBerry users open to phishing attacks. The bug lies in the BlackBerry browser dialog box, which provides information about Website domain names and their associated certificates. While the dialog box informs users when there is a mismat...
McAfee to Bolster Firewall Technology
McAfee is readying a push to improve its firewall technology with new features designed to help enterprises deal with Web 2.0 applications. The product is expected to be ready by spring 2010.
- McAfee is working on advancements to its enterprise firewall appliances to add a new level of application and policy controls. The enhancements will be around improving visibility, recognition and policy enforcement of over Web 2.0 applications invisible to conventional firewall techn...
Microsoft Security Essentials for Windows: 10 Benefits for Businesses
NEWS ANALYSIS: Microsoft Security Essentials provides some handy security tools for both consumers and small companies, even though Microsoft created the free Windows security software for home users. And there are quite a few reasons why companies and their IT departments should try it out.
- Microsoft's new free Security Essentials pack for Windows it works with XP, Vista and the upcoming Windows 7 is being put through its paces by several security experts. And although they're quick to point out that a free solution like Security Essentials isn't ideal, it's actually doing a fine j...
Department of Homeland Security on Lookout for IT Security Pros
The Obama administration gives the Department of Homeland Security approval to hire as many as 1,000 cyber-security experts during the next three years. According to DHS, officials are aiming to fill a number of different positions in areas such as vulnerability detection and network and systems engineering.
- The Department of Homeland Security has gotten the OK to hire as many as 1,000 new IT pros during the next three years to bolster cyber-security. DHS Secretary Janet Napolitano made the announcement Oct. 1 during remarks tied to the start of National Cybersecurity Awareness Month. The new hiring ...
Accused Romanian Phishers Extradited to U.S. to Face Charges
Two men authorities tied to a phishing scheme pleaded not guilty to charges of identity theft and bank fraud after being extradited to the United States. The phishing scheme targeted customers of well-known financial institutions, including Capital One and Citibank.
- Federal authorities have extradited two Romanian men to the United States to face charges of operating a phishing scheme targeting customers of several financial institutions. Officials at the FBI announced Sept. 29 that Petru Bogdan Belbita, 25, of Craiova, Romania, and Cornel Ionut T...
Researchers Expose Sophisticated Banking Trojan Linked to Thefts
Security researchers at Finjan track a cyber-gang that pilfered German bank accounts in summer 2009. The gang uses a Trojan dubbed URLZone that represents the next generation of banking malware.
- Researchers at Finjan are shining a light on a sneaky banking Trojan behind the theft of roughly $439,000 (300,000 euros) from German bank accounts over a 22-day period. Dubbed URLZone, the Trojan served as a digital lock pick for a sophisticated cyber-gang Finjan tracked from Aug. 11 to Sept. 1...
Microsoft Scores Win in Uniloc Patent Case
In the latest twist in a six-year legal battle, a federal judge overrules a jury's finding that Microsoft violated a Uniloc patent with its anti-piracy technology. The judge also throws out the jury's decision to award $388 million to Uniloc in damages.
- A federal judge has tossed out a $388 million damage award against Microsoft in a patent case that pitted the software giant against a security company called Uniloc. The judge vacated the jurys verdict Tuesday in the U.S. District Court for Rhode Island, marking another twist in a case that...
Small Botnets Cause Big Security Problems for Enterprises
Research from Damballa shows the biggest botnets are not always the most threatening when it comes to swiping corporate data. In a study of more than 600 active botnets, security researchers discovered that the smaller networks were often used in highly targeted, more dangerous attacks, Damballa says.
- While massive botnets such as Rustock and Conficker often make headlines, research from Damballa released in September shows many enterprises are under attack by smaller threats they've likely never heard of. After tracking more than 600 botnets over a three-month period, researchers Gunter O...
New Bill Would Revoke Telco Immunity
Sen. Chris Dodd leads a charge to repeal 2008 legislation that granted immunity to telephone companies that allegedly assisted in domestic spying by U.S. intelligence agencies. The Retroactive Immunity Repeal Act joins the JUSTICE Act introduced by Sen. Russ Feingold.
- Four U.S. senators led by Connecticut Democrat Chris Dodd plan to introduce the Retroactive Immunity Repeal Act, which would repeal the law that Congress passed in July 2008 granting immunity to telephone companies that allegedly assisted in domestic spying by U.S. intelligence agencies. The bi...
Microsoft Security Essentials Available Sept. 29
Microsoft confirms it is releasing Microsoft Security Essentials, its free anti-malware product, on Sept. 29. The slimmed-down solution will replace Microsoft's Windows Live OneCare in the battle against malware.
- Microsoft officials announced Sept. 28 that the company's much-anticipated Security Essentials product will be generally available Sept. 29. The Microsoft Security Essentials freeware is a slimmed-down replacement for Windows Live OneCare, which the company stopped selling retail earli...
Apple iPhone SMS Used as Bait in Rogue Antivirus Scam
Cyber-criminals are using interest in MMS or SMS on the iPhone to trick users into downloading rogue antivirus software. According to security company Websense, attackers are abusing Google's search engine to get users to click on links leading to a malicious page pushing scareware.
- Cyber-criminals are taking advantage of interest in Apple's new Multimedia Messaging Service capability for the iPhone by poisoning some of the top related Google results. According to Websense Security Labs, scammers are abusing Google to lure victims to sites pushing rogue antivirus softwar...
McAfee, Adobe to Integrate Data Loss Prevention and DRM for Enterprise Security
McAfee and Adobe are partnering to combine data loss prevention and digital rights management. The technological alliance has also produced a new security diagnostic tool for people downloading Adobe Reader and Adobe Flash Player.
- UPDATE: McAfee and Adobe Systems are teaming up to bring integrated data loss prevention and digital rights management solutions to market. Details on the new product were scarce, and officials at McAfee said they plan to release more information at Focus 09, its upcoming customer and partner confe...
Infected Mac Computers Worth 43 Cents in Cyber-underworld
In a talk about the threats posed by Russian malware affiliate networks, a Sophos security researcher reveals an operation offering people 43 cents per Apple Mac they infected. Affiliate networks can generate serious profits pushing scareware online.
- New research from Sophos underscores a growing interest in the Mac among cyber-criminals. In a presentation at Virus Bulletin's VB Conference, in Geneva, Sophos Labs researcher Dmitry Samosseiko revealed a malware affiliate network offering 43 cents per infected Mac computer. The offer was the wo...
Symantec Says Idaho Leads U.S. in Spam
According to findings from Symantec's MessageLabs, Idaho tops the list of the most-spammed U.S. states. MessageLabs researchers say states with higher concentrations of small and midsize businesses generally fare the worst when it comes to spam.
- Sometimes being No. 1 isn't all it's cracked up to be. In this case, Idaho is No. 1 in spam. According to a report from Symantec's MessageLabs, Idaho tops the list of states receiving the most spam in September. It's quite a reversal for the state, which in 2008 ranked 44th in spam volume. T...
Security Fix
Brian Krebs on computer and Internet security
DHS Seeking 1,000 Cyber Security Experts
In U.S. Government
The Department of Homeland Security is poised to go on a geek hiring spree. DHS Secretary Janet Napolitano announced Thursday that the agency has been cleared to hire at least 1,000 new cybersecurity professionals over the next three years to fill staffing gaps at various DHS agencies. "This new hiring authority will enable DHS to recruit the best cyber analysts, developers and engineers in the world to serve their country by leading the nation's defenses against cyber threats," Napolitano said. According to Napolitano, the department will look to fill "critical cybersecurity roles," including "cyber risk and strategic analysis, cyber incident response, vulnerability detection and assessment, intelligence and investigation, and network and systems engineering." The DHS secretary made the remarks at a press conference Thursday to kick off National Cybersecurity Awareness Month. Interestingly, Thursday also marks the target date for the launch of the new U.S. Cyber Command (USCYBERCOM), according to
Hackers Breach Payroll Giant, Target Customers
In Web Fraud 2.0
Hackers last week apparently used stolen account information from a New Jersey company that provides online payroll services to target the firm's customers in a scheme to steal passwords and other information. Morrestown, N.J. based PayChoice, provides direct payroll processing services and licenses its online employee payroll management product to at least 240 other payroll processing firms, serving 125,000 organizations. Last Wednesday, a number of PayChoice customers received an e-mail warning them that they needed to download a Web browser plug-in in order to maintain uninterrupted access to onlineemployer.com, the portal for PayChoice's online payroll service. The supposed plug-in was instead malicious software designed to steal the victim's user names and passwords. Unlike typical so-called "phishing" scams -- which are sent indiscriminately to large numbers of people in the hopes that some percentage of recipients are customers of the targeted institution -- this attack addressed PayChoice customers by name in
Stress Testing Microsoft's Free Anti-virus Offering
In Misc.
Microsoft's free new anti-virus product is earning decent marks in preliminary tests, putting it roughly on par with many other stand-alone anti-virus products available today. A number of readers seem keen to try out Microsoft Security Essentials (MSE), but are eager to hear how the program stacks up against other free anti-virus tools in terms of detecting and removing malware. While the results of early testing may not provide that side-by-side comparison, they do offer a glimpse of how effective MSE may be in blocking and tackling some of the most common threats currently in circulation. The MSE performance analysis comes from av-test.org, a group that routinely publishes the results of anti-virus stress tests. AV-Test ran MSE against 3,732 samples of malware that are currently infecting PCs around the world, and found that the program blocked all of them, both when the samples were opened or accessed and when the
Microsoft's Free Anti-virus Tool Now Available
In Safety Tips
Windows users looking for a free anti-virus alternative can now take advantage of an offering from Microsoft, which today began offering its Security Essentials anti-virus program. Microsoft Security Essentials is a real-time and on-demand anti-virus scanner that is free for personal use. It runs on Windows XP, Windows Vista, and Windows 7 (both 32-bit and 64-bit versions). Note that in order to use this software, Windows users will first need to pass Microsoft's Genuine Validation (anti-piracy) check, which checks to make sure that you're running a legitimate, licensed copy of Windows. The version made available today didn't seem to differ too much from the beta I reviewed earlier this summer: The initial install and update were painless, and the default quick scan took about 10 minutes, while using limited resources on my test machine. Only time will tell how this offering stacks up against other free AV choices out there,
New IRS Scam E-mail Could Be Costly
In Latest Warnings
The Department of Homeland Security's Computer Emergency Readiness Team is warning Internet users to be on guard against a convincing e-mail virus scam disguised as a message from auditors at the Internal Revenue Service. According to one victim interviewed by Security Fix, falling for the ruse could cost you or your employer tens of thousand of dollars. An alert issued Monday by the U.S.-CERT states: "The attacks arrive via an unsolicited email message and may contain a subject line of 'Notice of Underreported Income.' These messages may contain a link or attachment. If users click on this link or open the attachment, they may be infected with malicious code, including the Zeus Trojan." The Zeus Trojan is exceptionally good at stealing sensitive data, and it is especially interested in online banking credentials. This fake IRS/Zeus campaign has been ongoing for several weeks now, according to Gary Warner, director of research
Cyber Gangs Hit Healthcare Providers
In Web Fraud 2.0
Organized cyber thieves that have stolen millions from corporations and schools over the past few months recently defrauded several health care providers, including a number of non-profit organizations that cater to the disabled and the uninsured. The victims are the latest casualties of an online crime wave being perpetrated against U.S.-based organizations at the hands of cyber thieves thought to be based out of Eastern Europe. On Sept. 9, crooks stole $30,000 from the Evergreen Children's Association (currently doing business as Kids Co.), a non-profit organization in Seattle that provides on-site childcare for public schools. Kids Co. chief executive and founder Susan Brown said the attackers tried to send an additional $30,000 batch payment out of the company's account, but that her bank blocked the transfer at her request. "Now we're in this battle with our bank, because my staff accountant checks the account every day, and we notified the
Don't Get Web 2.0wned
In Latest Warnings
A recent attack in which tainted banner ads served up rogue software for visitors of popular sites such as drudgereport.com, lyrics.com and horoscope.com is a stark reminder of the importance of keeping up-to-date on software patches. According to Web vulnerability scanning firm ScanSafe, between Sept. 19 and 21, tainted ads that tried to foist malicious software cycled through some of the Web's most popular destinations (drudgereport.com receives more a million visitors per day, according to compete.com). Unlike the attack last week from rogue ads on the New York Times Web site - which heaved bogus anti-virus software onto visitors' systems - this series of bad ads sought to drop a Trojan horse that hijacks the victim's search results, ScanSafe found. The hostile ads tried to exploit several software vulnerabilities in order to drop the search hijackers onto victim PCs. One was a Microsoft Windows/Internet Explorer vulnerability that Redmond issued a
SecurityFocus News
SecurityFocus is the most comprehensive and trusted source of security information on the Internet. We are a vendor-neutral site that provides objective, timely and comprehensive security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
Brief: Firefox feature looks to foil XSS attacks
Firefox feature looks to foil XSS attacks
Brief: Firms most often infected by smaller botnets
Firms most often infected by smaller botnets
Brief: Pharma scams go global, reports find
Pharma scams go global, reports find
TaoSecurity
Richard Bejtlich's blog on digital security and the practices of network security monitoring, incident response, and forensics.
Traffic Talk 7 Posted
By Richard Bejtlich
I just noticed that my 7th edition of Traffic Talk, titled How to deploy NetFlow v5 and v9 probes and analyzers, was posted on 28 September. I submitted it back in mid-August but it's on the Web now.
On a related note, I am tech editing a forthcoming book on NetFlow by Michael Lucas titled Network Flow Analysis. Michael is probably my favorite technical author, so keep an eye open for his book in May 2010.
Copyright 2003-2009 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
6th Issue of BSD Magazine
By Richard Bejtlich
The 6th issue of BSD Magazine is available now. This edition has several great articles. I liked Jan Stedehouder's article on Triple booting Windows 7, Ubuntu 9.04 and PC-BSD 7.1, Christian Brueffer's article on FreeBSD Security Event Auditing, and the Questions and Answer Session of the BSD Certification Group Community with Dru Lavigne and Mikel King.
I've been working with the editor at BSD Magazine to publish my articles on keeping FreeBSD up-to-date, so I expect to see them in print within the next few months.
Copyright 2003-2009 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
Hakin9 Extended Edition in Stores
By Richard Bejtlich
Hakin9 published an "extended edition" magazine recently. This "best of" issue is 218 pages long and contains a nice selection of past articles.
Although the writing isn't as uniformly smooth as one would find in the late, great Sys Admin magazine, I continue to find interesting articles in Hakin9. (By "smooth" I mean that articles written by non-native speakers tend to reflect that English isn't their first language. Hakin9 might consider hiring a native English copyeditor to rework articles prior to publication.)
There's really no other printed security periodical like Hakin9. The technical level is higher than that of 2600 magazine, for example. You don't find articles on security management like you might in Information Security Magazine or SC Magazine, either.
Copyright 2003-2009 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
Yahoo! News: Security News
Security News
Microsoft Covers the Basics With Security Essentials (PC World)
In technology
PC World - Microsoft has released its free antivirus software, Microsoft Security Essentials (MSE). As the name implies, Microsoft's new security software removes the bloated bells and whistles found in other products, like Microsoft's discontinued Windows Live OneCare, and provides only the essential protection.
Judge Overturns $388 Million Ruling Against Microsoft (NewsFactor)
In business
NewsFactor - A U.S. District judge has overturned a $388 million ruling against Microsoft. The ruling came on appeal in a six-year-old case launched against the software giant by Uniloc, a computer-security and copy-protection software company in Irvine, Calif.
New Viruses Target Banks, Social Networks (PC Magazine)
In technology
PC Magazine - Cyber criminals are increasingly focusing their attacks on the hundreds of millions of users of social networks and on loopholes in bank security systems, security software vendors said on Wednesday.
Despite Taunts from Rivals, Microsoft Security Essentials is Solid (PC World)
In technology
PC World - What a shock: Execs from major antivirus makers are expressing doubts about Microsoft's Security Essentials.
Singapore to Form National Cyber-security Agency (PC World)
In technology
PC World - Singapore will set up a government agency, the Singapore Infocomm Technology Security Authority (SITSA), to handle technology-related threats to the city-state's national security, a government minister said Wednesday.
New Trojan Gives Criminals Full-service Bank Theft (PC World)
In technology
PC World - Security experts agree that cyber-criminals are getting better, but a new Trojan takes things to a whole new level.
Microsoft Security Essentials Available for Download (NewsFactor)
In business
NewsFactor - After introducing its antivirus software to 75,000 beta testers in June as Microsoft Security Essentials Beta, Microsoft has made its Security Essentials antivirus software available as a free download.
Microsoft's New Free Antivirus Hits the Streets (PC World)
In technology
PC World - Microsoft today lifted the curtain on its Microsoft Security Essentials, the free successor to its OneCare security program.
Microsoft releases free computer security software (AFP)
In us
AFP - Microsoft on Tuesday released free software that people can use to protect computers against viruses, spyware and other malicious codes in arsenals of cyber criminals.
Microsoft's Free Antivirus Service Ships Today (PC Magazine)
In technology
PC Magazine - Microsoft has announced that its free anti-malware product, Security Essentials, will be available today, September 29.
Microsoft Security Essentials Launches Tuesday (PC World)
In technology
PC World - If you can't wait to get your hands on Microsoft's upcoming free antivirus app, and you missed the limited public beta period, you won't have to wait any longer. Microsoft has confirmed that its Security Essentials antivirus software will be publicly available tomorrow, September 29.
Microsoft to release free antivirus PC software (AP)
In technology
AP - Microsoft Corp. says its new computer security program can be downloaded starting on Tuesday.
Pressure on Microsoft, as Windows Attack Now Public (PC World)
In technology
PC World - Hackers have publicly released new attack code that exploits a critical bug in the Windows operating system, putting pressure on Microsoft to fix the flaw before it leads to a worm outbreak.
Verizon Extends Antivirus, Storage Support to Macs (PC Magazine)
In business
PC Magazine - Verizon on Monday announced that it is offering a Mac version of its Internet security suite and online backup service.
IRS Scam Now World's Biggest E-mail Virus Problem (PC World)
In technology
PC World - Criminals are waging a nasty online campaign right now, hoping that their victims' fears of the tax collecter will lead them to inadvertently install malicious software.
To Fight Worms, Use Ants (PC World)
In technology
PC World - To combat worms, Trojans and other malware, a team of security researchers wants to use ants.
Russian Cybergangs Make the Web a Dangerous Place (PC World)
In technology
PC World - Russian cybergangs have established a robust system for promoting Web sites that sell fake antivirus software, pharmaceuticals and counterfeit luxury products, according to a new report from security vendor Sophos.
Zero Day
Tracking the hackers
MS Security Essentials test shows 98% detection rate for 545k malware samples
By Dancho Danchev on Windows Vista
According to recent tests conducted by AV-Test.org aiming to measure the performance of Microsoft’s Security Essentials, the freeware application achieved 98% detection rate for 545k malware samples including viruses, bots, trojan horses, backdoors and Internet worms, also achieving 90.95% detection rate for 14,222 adware/spyware samples it was tested against. However, AV-Test.org didn’t find any effective “dynamic [...]
New botnet hides commands as JPEG images
By Ryan Naraine on Viruses and Worms
Security researchers have stumbled on a new botnet that uses an interesting technique to mask its nefarious intentions.
RIM plugs BlackBerry phishing hole
By Ryan Naraine on Phishing
Research in Motion (RIM) has shipped a fix for a serious security vulnerability that exposes BlackBerry users to phishing attacks.
Research: Small DIY botnets prevalent in enterprise networks
By Dancho Danchev on Viruses and Worms
Does the size of a botnet really matter? It’s all a matter of perspective. Contrary to the “common wisdom” that based on their size, big botnets are theoretically capable of infiltrating a huge percentage of enterprise networks, a recently presented study entitled “My Bots Are Not Yours! A case study of 600+ real-world living botnets” shows [...]
Chinese hackers launch targeted attacks against foreign correspondents
By Dancho Danchev on Spam and Phishing
According to an assessment published by the Information Warfare Monitor, Chinese hacktivists (politically motivated hackers) have recently launched a targeted malware attack against foreign news correspondents attempting to trick them into executing a malware-embedded PDF attachment (Interview list.pdf), coming from a non-existent editor working for The Straits Times. The attacks coincide with the upcoming nation-wide celebration [...]
Hacker ships tool to circumvent China's Green Dam filter
By Ryan Naraine on Responsible disclosure
A security researcher at the University of Michigan has released a tool that help Chinese computers users disable the censorship functionality of the controversial Green Dam Youth Software.
Windows SMB2 exploit now public; Expect in-the-wild attacks soon
By Ryan Naraine on Windows Vista
Fully functional exploit code for the (still unpatched) Windows SMB v2 vulnerability has been released to the public domain via the freely available Metasploit point-and-click attack tool
Malware affiliate bounty: Infect a Mac, earn 43 cents
By Ryan Naraine on Vulnerability research
A new malware affiliate program has been discovered offering 43c for every infected Mac machine
Posts
No comments:
Post a Comment