Aurora Report

Roseman wrote in with a pointer to a techrepublic blog that points out the well known danger to the ...(more)...

5:16 PM (5 hours ago)

Did your DST rollforward work?, (Mon, Mar 9th)

If you have a Cisco IP phone, your DST rollfoward may not have worked, so you might want to rely on ...(more)...

5:16 PM (5 hours ago)

Yes, the w00tw00t continues., (Mon, Mar 9th)

Every day we get at least one email asking about a string they find in their own weblogs. It'll loo ...(more)...

10:01 AM (12 hours ago)

Foxit Reader update, (Mon, Mar 9th)

With all the talk about Adobe Reader 0-days lately, many people have written into the ISC suggesting ...(more)...

Mar 8, 2009 (yesterday)

Behind the Estonia Cyber Attacks, (Sun, Mar 8th)

Radio Free Europe / Radio Liberty ran a story on Friday that we just discovered. According to ...(more)...

8:41 PM (1 hour ago)

Revisiting Browser v. Middleware Attacks In The Era Of Deep Packet Inspection

from CGISecurity - Website and Application Security News by Robert A.

Dan Kaminsky has just published his latest paper on middleware attacks that I recommend checking out. "For CanSecWest this year, I thought it’d be interesting to take a look at the realm of Deep Packet Inspectors. It turns out we were doing a lot of this around 2000 through 2002, and...

8:41 PM (1 hour ago)

Socket Capable Browser Plug-ins Result In Transparent Proxy Abuse

from CGISecurity - Website and Application Security News by Robert A.

For over a year in my spare time I've been working on a abuse case against transparent proxies at my employer, and have just released my latest paper '"Socket Capable Browser Plugins Result In Transparent Proxy Abuse". When certain transparent proxy architectures are in use an attacker can achieve a partial...

2:36 PM (7 hours ago)

Google Docs suffers serious security lapse

from CGISecurity - Website and Application Security News by Robert A.

"Google confessed to a serious bug in its Docs sharing system over the weekend, but downplayed the security cockup by claiming only a tiny number of users had been affected. The internet search kingpin said that less than 0.05 per cent of Google Docs accounts were hit by a privacy breach...

8:41 PM (1 hour ago)

Building Security In Maturity Model is online

from CGISecurity - Website and Application Security News by Romain Gaucher

"The Building Security In Maturity Model (BSIMM) described on this website is designed to help you understand and plan a software security initiative. BSIMM was created through a process of understanding and analyzing real-world data from nine leading software security initiatives. Though particular methodologies differ (think OWASP CLASP, Microsoft SDL, or...

8:41 PM (1 hour ago)

Dan Bernstein Confirms Security Flaw In Djbdns

from CGISecurity - Website and Application Security News by Robert A.

"Dan Bernstein has just admitted that a security issue has been found in the djbdns software, one of most popular alternatives for the BIND nameserver. As part of the djbdns security guarantee, $1000 will be paid to Matthew Dempsky, the researcher that found the bug. The bug allows a nameserver running...

8:41 PM (1 hour ago)

Firefox 3.0.7 fixes multiple security flaws

from CGISecurity - Website and Application Security News by Robert A.

"Mozilla Corp. today patched eight security vulnerabilities in Firefox, half of them critical memory corruption flaws in the browser's layout and JavaScript engines. Firefox 3.0.7, the second security update this year to the open-source browser, fixes about the same number of bugs that Mozilla patched a month ago. Of the eight...

4:17 PM (6 hours ago)

McAfee Monthly Spam Report for March

from McAfee Avert Labs by David Marcus

The third edition of our monthly spam report was released today. This edition discusses some fascinating topics. Key findings include:

Spam campaigns are taking advantage of “partitioning” to increase their effectiveness and combat the efforts of security tools to reduce their reach.

Replica-watch spam has taken over the number one position for holiday spam.

Business leaders and legislatures have promised to stamp out spam, yet the plague persists. Does reputation-based security hold the key?

Putting a dollar value on productivity lost due to spam.

The topic of lost productivity and bringing quantifiable numbers to the impact of spam on a business is particularly interesting and worth a solid read. Download a copy here.

6:20 PM (4 hours ago)

Feds file new felonies against alleged Sarah Palin hacker

Circular reasoning straightened out

A University of Tennessee student accused of illegally breaking into the email account of Alaska governor Sarah Palin has been hit with three new felony charges in connection with the case.…

4:01 PM (6 hours ago)

FoxIT update defends against PDF peril

Not just an Adobe problem

It's not only Adobe Reader that needs patching against maliciously constructed PDF files. Targeted attacks against an unpatched flaw in Adobe Reader over recent weeks has stimulated interest in alternative PDF viewers, such as FoxIT.…

1:20 PM (9 hours ago)

Scottish hospitals laid low by malware infection

Worm causes appointment bother

Appointments for cancer patients had to be rescheduled after a computer virus infected the networking systems at two Scottish hospitals last week.…

9:20 AM (13 hours ago)

Daily Telegraph hit by SQL hack attack

Middle England pwned

Vulnerabilities on a Daily Telegraph website have been exposed by serial grey-hat hacker Unu.…

8:20 AM (14 hours ago)

Twitter users hit by smut spam hack attack

Wasn't Britney's four foot vagina warning enough...

Poor beseiged Twitter users were hit by a new series of attacks on Friday.…

Mar 8, 2009 (yesterday)

eBay scammers work unpatched weaknesses in Firefox, IE

Other sites also vulnerable to CSS attack

Updated eBay scammers have been exploiting unpatched weaknesses in the Firefox and Internet Explorer browsers to deliver counterfeit pages that try to dupe people surfing the online auction house to bid on fraudulent listings.…

11:43 AM (10 hours ago)

Hackers update Conficker worm, evade countermeasures

from Network World on Security by Gregg Keizer

Computers infected with the Conficker worm are being updated with a new variant that sidesteps an industry effort to sever the link between the worm and its hacker controllers, researchers at Symantec Corp. said Friday.

11:43 AM (10 hours ago)

Excel Bug Will Be Ignored on Patch Tuesday

from Network World on Security by Gregg Keizer

Microsoft last week said that three Windows security updates, including one rated "critical," will be released tomorrow.

11:43 AM (10 hours ago)

Vyatta adds security tools to open source routing platform

from Network World on Security by Stephen Lawson

Open source routing vendor Vyatta is adding SSL VPN, intrusion prevention, Web caching, URL filtering and other features in Vyatta Community Edition 5, the latest version of its software, set to be released Monday.

11:43 AM (10 hours ago)

Rod Beckstrom resigns as director of National Cybersecurity Center

from Network World on Security by Ellen Messmer

Rod Beckstrom, director of the National Cybersecurity Center, resigns his position in a letter to Department of Homeland Security Secretary Janet Napolitano, complaining about the large role of the National Security Agency in the NCSC's efforts.

11:43 AM (10 hours ago)

Federal cybersecurity director quits, complains of NSA role

from Network World on Security by Jaikumar Vijayan

In a move that highlights differences over who should be in charge of national cybersecurity efforts, the director of a federal office set up to protect civilian, military and intelligence networks has submitted his resignation after less than a year in the job.

11:43 AM (10 hours ago)

Job 1 for New Federal CIO: Balance Openness with Security

from Network World on Security by Meridith Levinson

President Barack Obama has repeatedly pledged to make the federal government more open, transparent and accountable to American citizens. After assuming office on January 19, 2009, he immediately took steps to act on his promise, which included issuing new, more open guidelines for the Freedom of Information Act, and more recently, ordering an overhaul of the federal government's contracting system.

5:21 PM (5 hours ago)

What's behind the rash of university data breaches?

from Network World on Security by Jay Cline

Purdue University last month reported its seventh data breach in the past four years. But Purdue is hardly alone. According to my records, over 300 publicized privacy incidents have occurred at U.S. institutions of higher learning since 2001, with at least 53 colleges and universities experiencing multiple breaches.

11:43 AM (10 hours ago)

Data About Presidential Helicopter Leaked via P2P

from Network World on Security by Jaikumar Vijayan

A company that monitors peer-to-peer networks said it found classified information about the systems used onboard the U.S. president's helicopter in a shared folder on a computer in Iran, after a file containing the data was accidentally leaked on a peer-to-peer network last summer.

11:43 AM (10 hours ago)

Visa Backtracks on Breach Disclosure

from Network World on Security by Jaikumar Vijayan

Visa and MasterCard have probably been slow to identify the cause of a breach that they warned banks about in mid-February because they want to complete an investigation into the incident, analysts say.

5:21 PM (5 hours ago)

Foxit PDF viewer also open to attack, say researchers

from Network World on Security by Gregg Keizer

Security researchers Monday warned of several vulnerabilities in Foxit, a free PDF document viewer that many have recommended as an alternative to Adobe Reader, which currently contains an unpatched critical bug of its own.

3:42 AM (18 hours ago)

The last word on federated provisioning...for now

from Network World on Security by Dave Kearns

I'd thought we'd probably had the last word on federated provisioning, but a couple of old friends (and regular readers) had some more information which they've allowed me to share with you.

3:42 AM (18 hours ago)

Take the complexity out of firewall configuration changes

from Network World on Security by Linda Musthaler

As network security infrastructure grows larger and more complex, the likelihood of omissions and misconfigurations that can lead to data breaches and other serious problems is a growing concern. Tufin Technologies has solutions for security lifecycle management that take the human judgment factor out of firewall and router configuration changes. Read about the tools that reduce the risk level that's inherent in security configuration changes.

12:01 PM (10 hours ago)

Brief: Conficker update attempts to foil Cabal

Conficker update attempts to foil Cabal

6:31 PM (4 hours ago)

Panda: ID Theft Trojans Are on 1 in 100 PCs We Scan

Panda says that just over 1 percent of the PCs it scanned last year had ID stealing Trojans on them.

3:30 PM (7 hours ago)

Charges Beefed up Against Alleged Sarah Palin Hacker

David Kernell was arraigned Monday on four felony charges relating to the illegal access of Sarah Palin's Yahoo account last...

9:29 AM (13 hours ago)

Vyatta Adds Security Tools to Open-source Routing Platform

Open-source routing vendor Vyatta is adding security features to Vyatta Community Edition 5, coming Monday.

Mar 8, 2009 (yesterday)

Symantec Warns of Worm's Return

Symantec identifies a third variant of the destructive Downadup/Conficker worm.

Mar 8, 2009 (yesterday)

Security Worries Stall Mobile Shopping

Concern about security still stops consumers from shopping via smartphones or other mobile devices, studies show.

Mar 8, 2009 (yesterday)

Build Security into Every Product, Coders Advised

Security experts suggest security should be "baked into" every software development project.

Other News

Mar 8, 2009 (yesterday)

Data.gov Is Coming — Let's Help Build It

from Wired Top Stories by Alexis Madrigal

Barack Obama and his new Chief Information Officer say they want to make government data more accessible and easier to use. But they'll need your help pointing out which datasets we need the most. Enter the Wired How to Open Up Government Data wiki.

Sunday, March 8, 2009

Around The Horn vol.1,57

Alerts

Mar 7, 2009 (13 hours ago)

Daylight Saving Time Already?, (Sun, Mar 8th)

Yes, readers, it's that time of year already. Hopefully all of our North American readers will ...(more)...

Security News

Mar 7, 2009 (yesterday)

Mahalo CEO who hired convicted botnet leader

from Network World on Security by Jaikumar Vijayan

Jason Calacanis, founder and CEO of search engine start-up Mahalo.com, defends his decision to allow former security researcher John Scheifer to continuing working at his firm even after discovering he was a convicted felon.

Mar 7, 2009 (yesterday)

California's data breach law may get an update

from Network World on Security by Robert McMillan

California's landmark data-breach notification law will get another update, if State Senator Joe Simitian gets his way.

Mar 7, 2009 (yesterday)

Job 1 for New Federal CIO: Balance Openness with Security

from Network World on Security by Meridith Levinson

Mar 7, 2009 (yesterday)

Unpatched PDF bug poses growing threat, say researchers

from Network World on Security by Gregg Keizer

An unpatched bug in popular PDF viewing and editing applications is much more dangerous than first thought, according to security researchers who have created exploits that sidestep Adobe's defensive recommendations.

Mar 7, 2009 (yesterday)

Conficker Worm Strikes Back With New Variant

from Network World on Security by Erik Larkin

The Conficker/Downadup worm managed to slither onto millions of PCs worldwide at its height, but after it initially infected a computer it only really acted to spread itself, and didn't cause further harm. Until now.

Mar 7, 2009 (19 hours ago)

Brief: Cybersecurity chief resigns, dings NSA

Cybersecurity chief resigns, dings NSA

Mar 5, 2009 (3 days ago)

Security admin, botmaster sentenced to four years in prison

from Ars Technica by jhruska@arstechnica.com (Joel Hruska)

One-time security consultant and significant black hat John Schiefer has been sentenced to four years in federal prison after pleading guilty to multiple counts of fraud last April. Schiefer's case began in 2007 when he was charged with having installed malware on computers without the consent of the owner. The responsibilities and permissions granted to Schiefer as a security consultant during his day job afforded him ample opportunity to play black hat on the side; Schiefer and his associates were charged with creating a botnet of up to 250,000 zombies. Both the case and today's ruling are the first of their kind in the United States; presiding Judge Howard Matz apparently wanted to send a strong message to anyone engaged in similar activities.

Mar 5, 2009 (3 days ago)

Opinion: Windows 7's UAC is a broken mess; mend it or end it

from Ars Technica by drpizza@quiscalusmexicanus.org (Peter Bright)

I wrote a few weeks ago about changes Microsoft has made to Windows 7's User Account Control (UAC) that make the component less secure than it was in Vista. Though the company has responded by saying it will change some of the problem behaviors, yet more problems have emerged that indicate that a real fix will be harder than first expected. But more than that, the flaws call into question the entire purpose of the Windows UAC feature, at least in its commonplace "Admin Approval" mode.

Mar 4, 2009 (4 days ago)

'Net scammers go after gullible with fake stimulus offers

from Ars Technica by jhruska@arstechnica.com (Joel Hruska)

Scammers are always on the lookout for sociopolitical events they can craft into a phishing hook; we've seen the thieves try lures flavored with everything from holiday celebrations to information on international assassinations. The various security firms and organizations in the United States have been warning of an uptick in recession-themed spam for the past few months. Families feeling the pinch—particularly those where one or more providers is in their second to third month of unemployment—are more likely to take a chance on an ad that seems too good to be true, even if they logically know the chance of finding a golden ticket is slim indeed.

Mar 6, 2009 (2 days ago)

Cyber Security Czar Quits Amid Fears of NSA Takeover

from Wired Top Stories by Noah Shachtman

Rod Beckström, the Department of Homeland Security's controversial cybersecurity chief, has suddenly resigned, amid allegations of power grabs and bureaucratic infighting.

Mar 7, 2009 (20 hours ago)

Secure Digital Medical Records: Even Possible?

Heath care organizations are crafting an electronic security framework specifically for medical data.

Mar 6, 2009 (2 days ago)

California's Data Breach Law May Get an Update

The California state senator who co-authored the state's breach notification law has proposed updated legislation.

Mar 6, 2009 (2 days ago)

New U.S. CIO Is a Google Apps Fanboy

America's new CIO, Vivek Kundra, believes the recession will drive the move to online apps.

Mar 6, 2009 (2 days ago)

Conficker Worm Strikes Back With New Variant

After infecting and then lying dormant on millions of PCs, a new Conficker/Downadup variant is shutting down antivirus software and security tools.

Mar 6, 2009 (2 days ago)

Obama Appoints First Federal CIO

White House release states that Vivek Kundra will use technology "to improve performance and lower the cost of government operations."

Mar 5, 2009 (3 days ago)

Windows Security Patches Coming Next Week

Microsoft will release one critical Windows update next week. Two important Windows updates are also planned.

Mar 5, 2009 (3 days ago)

Microsoft Releases Vista SP2 RC to Public

Microsoft quietly launched the release candidate of Windows Vista Service Pack 2 (SP2) to the general public this week.

Mar 5, 2009 (3 days ago)

Firefox Update Improves Security

Mozilla released an update for its Firefox Web browser, addressing several issues, including improving the security of the...

Mar 5, 2009 (3 days ago)

Mobile Browsers Bring New Security Headaches

The new generation of mobile Web browsers is going to introduce for enterprise IT departments a rash of security challenges.

Other News

10:45 AM (1 hour ago)

Windows Server will Run in Enterprise Cloud

from Microsoft Security Content: Comprehensive Edition

Microsoft says enterprises will self-host Windows Azure someday, as they now run Windows Server.

Friday, March 6, 2009

Around The Horn vol.1,56

Alerts

Mar 5, 2009 (yesterday)

Microsoft Security Bulletin Advance Notification for March 2009

Revision Note: Advance Notification published

Summary: This advance notification lists security bulletins to be released for March 2009.

Mar 5, 2009 (yesterday)

Microsoft Security Advisory (968272): Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution

from Microsoft Security Content: Comprehensive Edition

Revision Note: V2.1 (March 5, 2009): Removed Open XML File Format Converter for Mac from the affected software listed in the Overview section. The Open XML File Format Converter for Mac is not affected by the vulnerability described in this advisory.Summary: Microsoft is investigating new public reports of a vulnerability in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file. At this time, we are aware only of limited and targeted attacks that attempt to use this vulnerability.

Security News

3:47 PM (5 hours ago)

Twitter SMS spoofing

from CGISecurity - Website and Application Security News by Robert A.

"A fix against an SMS spoofing flaw involving micro-blogging service Twitter offers only partial protection. Tests by Heise Security found that providing a user knew the number of a phone associated with a Twitter account, it would be possible to use an SMS sender faking service to post fake status updates...

1:26 PM (7 hours ago)

WarVOX 1.0.0 Released

from CGISecurity - Website and Application Security News by Robert A.

HD Moore sent the following to bugtraq this morning."WarVOX is a suite of tools for exploring, classifying, and auditingtelephone systems. Unlike normal wardialing tools, WarVOX works with theactual audio from each call and does not use a modem directly. Thismodel allows WarVOX to find and classify a wide range of interestinglines,...

12:48 PM (8 hours ago)

Building Security In Maturity Model is online

from CGISecurity - Website and Application Security News by Romain Gaucher

Mar 5, 2009 (yesterday)

Dan Bernstein Confirms Security Flaw In Djbdns

from CGISecurity - Website and Application Security News by Robert A.

Mar 4, 2009 (2 days ago)

Firefox 3.0.7 fixes multiple security flaws

from CGISecurity - Website and Application Security News by Robert A.

9:12 PM (13 minutes ago)

Conficker gets upgraded with defenses

Anti-cabal resistance

Researchers at Symantec have discovered what could be a significant development in the ongoing Conficker worm saga: a new module that is being pushed out to some infected systems.…

12:11 PM (9 hours ago)

Twitter SMS spoofing still undead

Micro-blogging body-snatching risk

A fix against an SMS spoofing flaw involving micro-blogging service Twitter offers only partial protection.…

8:42 AM (12 hours ago)

Gang jailed over failed Sumitomo cyberheist

Commercial software used in multi-million scam

The gang behind the failed multi-million pound cyberheist at Sumitomo bank were each sentenced to a lengthy spell behind bars on Thursday.…

5:40 AM (15 hours ago)

March patch Tuesday omits Excel fix

Zero-day, nada relief

Microsoft forthcoming patch Tuesday will bring no relief from an unpatched Excel flaw that's the target of active malware attacks.…

Mar 5, 2009 (yesterday)

Suit seeks close of Craigslist's red-light district

Chicago sheriff's resources stretched thin

Chicago's sheriff on Thursday filed a lawsuit against Craigslist, saying the site may be the No. 1 source of prostitution in the United States and is straining his department's ability to enforce the law.…

Mar 5, 2009 (yesterday)

Web maven gives convicted botmaster keys to new kingdom

Mahalo.com embraces Acidstorm

For the past four or five months, Mahalo.com has entrusted its site to a security consultant who stole hundreds of thousands of bank passwords with a massive botnet, which he sometimes administered from his former employer's premisis.…

Mar 5, 2009 (yesterday)

Zero-day Adobe PDF peril goes click free

Thumbnail preview threat

An unpatched flaw in Adobe Acrobat and Reader might be exploited without even needing to trick a surfer into opening a maliciously constructed file.…

Mar 5, 2009 (yesterday)

Firefox went ton up in bugs in 2008

Secunia stats inflame browser beef

Firefox had more vulnerabilities than Internet Explorer last year, but zero-day threats to the Mozilla browser were fixed more quickly than those affecting IE.…

Mar 5, 2009 (yesterday)

One in 20 corporate PCs infested by bots

Zombies, faasands of 'em

Between three to five per cent of corporate systems are infected by bots, according to a study by security firm Damballa.…

Mar 5, 2009 (yesterday)

Firefox update tackles critical memory bugs

We can remember it for you wholesale

Mozilla has released a new version of Firefox in response to the discovery of several security flaws in the browser software.…

3:49 AM (17 hours ago)

Botnet ringleader gets 4 years in prison for stealing data

from Network World on Security by Jaikumar Vijayan

The first person to be charged under federal wiretap statutes for using a botnet to steal data and commit fraud was sentenced to four years in prison this week.

3:49 AM (17 hours ago)

IT pro gets four years for building botnets

from Network World on Security by Robert McMillan

An employee of search engine startup Mahalo has been sentenced to four years in prison for infecting as many as 250,000 computers with malicious botnet computer code.

11:24 AM (10 hours ago)

Security needs to be 'baked in' say experts

from Network World on Security by Tom Jowitt

A panel of security experts agreed that security needs to thought of a lot earlier in the software development lifecycle, and that the IT industry needs to start shipping "hardened" products, especially with the advent of the cloud and visualization making the location of sensitive data even more difficult to locate.

11:24 AM (10 hours ago)

Firefox Update Shores Up Security; Thunderbird Vulnerable

from Network World on Security by Erik Larkin

The latest update to the open-source browser shores up a number of security risks, including some that Mozilla says could be exploited by an attacker to run commands on a vulnerable computer. But the flaws still affect the current Thunderbird release, 2.0.0.19.

11:24 AM (10 hours ago)

Windows security patches coming next week

from Network World on Security by Robert McMillan

Microsoft will release three sets of security updates next Tuesday, fixing at least one critical bug in its Windows operating system.

11:24 AM (10 hours ago)

Microsoft: No patch for Excel zero-day flaw next week

from Network World on Security by Gregg Keizer

Microsoft Thursday said it will deliver three security updates on Tuesday, one of them marked "critical," but will not fix an Excel flaw that attackers are now exploiting.

Mar 5, 2009 (yesterday)

The Internet Protectors

from Network World on Security by M. E. Kabay

Guest writer Pat Bitton: We all know that there is a huge amount of variably accurate security information on the Web. There are many blogs, forums, bulletin boards, white papers, podcasts, and Webinars - some posted by vendors, others by enthusiastic volunteers. The trouble is, there is no coherent resource for all types of computer security information in one place that is appropriate for all levels of expertise. The arrival of social networking on the Internet provided the opportunity I'd been looking for to change this situation.

Mar 5, 2009 (yesterday)

Security Implications of the Humble Computer Clock

from Network World on Security by Simson Garfinkel

Is the clock on every computer system in your organization set to the correct time? If your answer is no, you're not alone. According to a 2007 study by Florian Buchholz and Brett Tjaden, both professors at James Madison University in Virginia, more than a quarter of the Web servers on the Internet have their clocks off by more than 10 seconds. Making sure that computers are set with the correct time is one of those seemingly petty technical things that can unfortunately have big, negative consequences if not done properly. That's because assumptions about time and its flow permeate modern computer systems-including software, hardware and networking. This is true of desktop systems, servers, mobile devices and even embedded systems like HVAC, alarm systems and electronic doorknobs.

Mar 5, 2009 (21 hours ago)

fzem - MUA (Mail User Agent) / Mail Client Fuzzer

from Darknet - The Darkside by Darknet

fzem is a MUA (mail user agent) fuzzer that fuzzes MAIL/MIME email headers as well as how clients handle SMTP, POP and IMAP responses. Purpose fzem’s purpose is to fuzz MUAs as they process email content and handle server reponses. How does it work? fzem has the three main mail protocols implemented as well as mail/mime headers. Using...
Read the full post at darknet.org.uk

Mar 5, 2009 (yesterday)

Twitter Click-Jacking Vulnerability

from Darknet - The Darkside by Darknet

Click-jacking has hit the news a few times recently with most browsers being susceptible to this kind of redirection attack. This time it’s Twitter that’s being hit, as with anything gaining popularity it’s going to become the focus of more attacks and attempts to compromise its security. It seems like click-jacking may well be...
Read the full post at darknet.org.uk

Mar 5, 2009 (yesterday)

What's up with port 445?, (Thu, Mar 5th)

Looking at the DSHIELD data for the port 445 Shows an interesting little trend. Reports ...(more)...

Mar 5, 2009 (yesterday)

Cool combination of tools, (Sun, Mar 1st)

I've mentioned here before that I'm a big fan of Volatility for analyzing memory images. In fa ...(more)...

Mar 5, 2009 (yesterday)

OSSEC Version 2 available!, (Sat, Feb 28th)

A reader wrote in to inform us that OSSEC version 2.0 has been released ...(more)...

2:31 PM (7 hours ago)

Brief: White House to wrap up cyber review in April

White House to wrap up cyber review in April

Mar 5, 2009 (yesterday)

Brief: Bot master sentenced to four years

Bot master sentenced to four years
>> Advertisement <<
Can you answer the ERP quiz?
These 10 questions determine if your Enterprise RP rollout gets an A+.
http://www.findtechinfo.com/as/acs?pl=781&ca=909

Mar 5, 2009 (yesterday)

Brief: Mozilla, Opera plug security holes

Mozilla, Opera plug security holes

11:23 AM (10 hours ago)

Chris Wysopal: Contracting for Secure Code

Contracting for Secure Code

Wednesday, March 4, 2009

Around The Horn vol.1,55

Alerts

12:08 PM (7 hours ago)

Cisco 7600 Series Router Session Border Controller Denial of Service Vulnerability

A denial of service (DoS) vulnerability exists in the Cisco Session Border Controller (SBC) for the Cisco 7600 series routers. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.

12:08 PM (7 hours ago)

Cisco Unified MeetingPlace Web Conferencing Authentication Bypass Vulnerability

Cisco Unified MeetingPlace Web Conferencing servers may contain an authentication bypass vulnerability that could allow an unauthenticated user to gain administrative access to the MeetingPlace application. Cisco has released free software updates that address this vulnerability.

12:08 PM (7 hours ago)

Multiple Vulnerabilities in the Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine

The Cisco ACE Application Control Engine Module and Cisco ACE 4710 Application Control Engine Cisco ACE Module and Cisco ACE 4710 Application Control Engine contain multiple vulnerabilities that, if exploited, can result in any of the following impacts:

12:08 PM (7 hours ago)

Cisco ACE Application Control Engine Device Manager and Application Networking Manager Vulnerabilities

Multiple vulnerabilities exist in the Cisco Application Networking Manager (ANM) and Cisco Application Control Engine (ACE) Device Manager applications. These vulnerabilities are independent of each other. Successful exploitation of these vulnerabilities may result in unauthorized system or host operating system access.

Security News

Mar 3, 2009 (20 hours ago)

Data Security Best Practices - SSL keys for communicating with Virtual Center and other applications (1008166)

from VMware RSS Feed by vmtn@vmware.com (VMTN)

Data Security Best Practices - SSL keys for communicating with Virtual Center and other applications (1008166)

SSL keys are used in the communication between ESX Server, VMware Server, and VMware ACE on one side and management applications like...

5:08 PM (2 hours ago)

FRHack threatens to sue person using screenshots to criticize them

from CGISecurity - Website and Application Security News by Robert A.

I found the following post fairly amusing and had to link it here. "A few days ago I complained about the incredibly awkward IT Security Girl of the Year award that will be dished out later this year at the French IT security conference FRHACK. Apparently the FRHACK organizers did not...

1:09 PM (6 hours ago)

The return of L0phtCrack

from CGISecurity - Website and Application Security News by Robert A.

"More than two years after Symantec pulled the plug on L0phtCrack, the venerable password cracking tool is being prepped for a return to the spotlight. The original creators of L0phtCrack has reacquired the tool with plans to release a new version at next week’s SOURCE Boston conference. A teaser post on...

12:42 PM (6 hours ago)

Renamed Notepad.exe Plagues Removable Drives

from McAfee Avert Labs by Vinoo Thomas

During the last couple of years we have seen malware authors increasingly incorporate the autorun.inf infection vector into malware families–with stunning success. In addition to traditional autorun worms that use this feature, pure-play backdoors, bots, password stealers, and even parasitic viruses that previously required a user to click on an executable file to infect the system have incorporated this technique. While the autorun functionality in operating systems does provide some convenience (it saves a couple of clicks), it has single-handedly revived the 1980s model of hand-carried malware propagation.

3:47 PM (3 hours ago)

Brit pair convicted for high-tech bank heist gone bad

Botched £229m USB stick plot

Two men have been convicted for trying to steal £229m from the London branch of a Japanese bank in an elaborate, high-tech scheme that would have been Britain's biggest bank heist.…

1:46 PM (5 hours ago)

Spotify breach creates password hack risk

Radio ga-ga

Popular online music service Spotify has warned of a security breach that may have exposed user passwords and other sensitive data.…

12:46 PM (6 hours ago)

German cops bust cybercrime forum

Trojan scammer trouncing

German police have arrested several members of a hacking forum linked to the distribution of Trojan horse software that infected 80,000 computers.…

10:46 AM (8 hours ago)

Opera lances 'extremely severe' jpg bug

Norwegian browser update guards against pillaging

Opera has published an update to its flagship browser software that addresses a raft of security bugs.…

8:46 AM (10 hours ago)

MPs told PGP 'incompatible' with Parliament network

Cryptographic conundrum

MPs have been told that although they are free to install PGP on their parliamentary machines the technology is not compatible with Parliament’s remote access software, making its use impractical.…

7:01 AM (12 hours ago)

Social Networking: Latest, Greatest Business Tool or Security Nightmare?

from WindowSecurity.com by deb@shinder.net (Deb Shinder)

The good, the bad and the ugly of using popular social networking tools in the business environment.

7:01 AM (12 hours ago)

Controlling Service Security Using Windows Server 2008 (Part 2)

from WindowSecurity.com by (Derek Melber)

Expanding on the previous article, this time focusing on security settings as well as real time updating of the services and their accounts.

5:07 AM (14 hours ago)

The fantasy and reality of government security

from Network World on Security by Andreas M. Antonopoulos

In the movies the government has always got the best toys, the cutting edge technology and the tightest security standards. Those who have worked on security projects within the government know that in real life government security standards and implementations can vary all across the range from quite serious to laughable.

12:41 PM (6 hours ago)

Secure Electronic Medical Records: Fact or Fiction?

from Network World on Security by Bill Brenner

Healthcare organizations still nursing the scars of HIPAA compliance and data breaches have gotten behind a new security framework to address potential headaches brought on by the American Recovery and Reinvestment Act of 2009.

12:41 PM (6 hours ago)

Catbird tightens security of virtual machines

from Network World on Security by Tim Greene

Catbird is upgrading its virtual security software platform to better track virtual machines as they replicate themselves and to make sure the proper security policies follow them wherever they go.

Security Pros Warm to Web 2.0 Access

from Network World on Security by Joan Goodchild

Facebook, LinkedIn and Twitter, once viewed as high-risk, productivity-sucking applications, seem to have wiggled their way into the hearts of security teams nationwide. In fact, most organizations no longer block the popular web sites and allow employees to access these Web 2.0 applications at work, according to a new survey from the Security Executive Council.

3:09 AM (16 hours ago)

Medusa v1.5 Released - Parallel, Modular Login Brute Forcing Tool

from Darknet - The Darkside by Darknet

Finally an update to Medusa! Version 1.5 of Medusa is now available for public download. Medusa 1.4 was released quite some time back in November 2007 and before that Medusa 1.3 showed up November 2006. You would have thought version 1.5 would have been released in November 2008! Looks like they missed by a few months. What [...]
Read the full post at darknet.org.uk

5:56 PM (1 hour ago)

Firefox Releases version 3.0.7, (Wed, Mar 4th)

http://www.mozilla ...(more)...

4:56 PM (2 hours ago)

Wireshark 1.0.6 Released, (Wed, Mar 4th)

It looks like a new version of Wireshark has been released. In this release they have fixed th ...(more)...

2:11 PM (5 hours ago)

Brief: War dialing gets an upgrade

War dialing gets an upgrade

Tuesday, March 3, 2009

Around The Horn vol.1,54

Alerts

-- Aurora Report says no new alerts today.

Security News

5:44 PM (4 hours ago)

New Gmail Flaw Lets Attacker Control 'Change Password' Function

from CGISecurity - Website and Application Security News by Robert A.

"A researcher today released a proof-of-concept for a vulnerability he discovered in Google Gmail that lets an attacker change a Gmail user's password, wage a denial-of-service attack on the account, or even access other Gmail users' email. The cross-site request forgery (CSRF) flaw -- which researcher Vicente Aguilera Diaz from Madrid-based...

5:44 PM (4 hours ago)

Opera 9.64 Security Updates and Enhancements

from CGISecurity - Website and Application Security News by Robert A.

From Opera's changelog Fixed an issue where specially crafted JPEG images ccould be used to execute arbitrary code, as reported by Tavis Ormandy of the Google Security Team; see our advisory Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by Adam Barth; details will...

7:51 PM (2 hours ago)

Obama releases Dubya's secret anti-terror memos

Warrantless wiretapping? Check

The Obama administration has released nine secret legal opinions penned by Bush Administration lawyers, revealing the scope of executive power the White House sought in fighting domestic terrorism.…

4:51 PM (5 hours ago)

US spy agency gains support for cyber security role

DHS not up to task, Congress told

The United States' top intelligence official argued last week that the National Security Agency should become the nation's cyber defender, adding his voice to the growing murmur of support for the agency's future role in cyberspace.…

2:51 PM (7 hours ago)

Hack-off contestant dubs Apple Safari 'easy pickins'

Pwn2Own's low-hanging fruit

Apple's Safari browser is likely to be compromised multiple times at an annual hacking contest being held later this month because it's "easy pickins as usual," a researcher specializing in Apple security says.…

12:47 PM (9 hours ago)

Oz runs Romero-themed zombie awareness week

Throw another braaaain on the barbie

Australia is running a national zombie awareness week in a bid to educate users about how to stop hackers from taking over control of their PCs.…

10:28 AM (11 hours ago)

Barclays heralds new wave of wallet-waving

Contactless tech going in cards - data-gathering to follow

Barclays Bank is to embed contactless technology into every debit card issued from this day forward, allowing punters to pay for coffee with a wave of the wallet - providing they can find somewhere that accepts the new technology.…

9:28 AM (12 hours ago)

Securing the corporation

The Alpha and Omega of risk management

In the past couple of articles we have considered why security is important and what are the threats faced, both internal and external. Most, if not all organisations will be doing something about IT security, so it isn’t going to be awfully useful to launch into a treatise on how everybody should be implementing IT security. It is perhaps worth revisiting some of the key elements of ‘security done right’, however, so we can consider what’s getting in the way.…

9:28 AM (12 hours ago)

Facebook sues 'Spamford' Wallace over spam scam

Bring in the usual suspects

Facebook has launched a lawsuit against infamous junk mail merchant Sanford "Spamford" Wallace.…

12:40 PM (9 hours ago)

Computer Security Handbook Fifth Edition is ready

from Network World on Security by M. E. Kabay

After three years of labor, the Fifth Edition of the Computer Security Handbook (CSH5) is ready! Senior Editor Sy Bosworth and new Editor Eric Whyne and I are proud to see the two-volume work for sale at last.

12:40 PM (9 hours ago)

Koobface worm to users: Be my Facebook friend

from Network World on Security by Gregg Keizer

A worm that hit Facebook last December has resurfaced, a security researcher said today, and is now hijacking user accounts -- not only for that social networking service, but also for MySpace, Friendster, LiveJournal and others.

12:40 PM (9 hours ago)

Banks, credit unions begin to sue Heartland over data breach

from Network World on Security by Jaikumar Vijayan

In an indication of the legal troubles companies can find themselves in over data breaches these days, several banks and credit unions have begun suing Heartland Payment Systems over its recently disclosed data breach.

12:40 PM (9 hours ago)

Realtors sold on software that ferrets out illicit password sharing

from Network World on Security by Ellen Messmer

Stopping illicit password use is a tough problem to solve but Ray Moore, member of the board at the Mountain Central Association of Realtors, says a little technology combined with a lot of diplomacy has made the difference in stopping unauthorized use of the association's MLS database.

12:40 PM (9 hours ago)

Russian password-cracking software discounted

from Network World on Security by Jeremy Kirk

Russian security vendor Elcomsoft is offering a 20 percent discount for law enforcement and government agencies for some of its password-cracking software.

12:40 PM (9 hours ago)

IBM looks to secure Internet banking with USB stick

from Network World on Security by Jeremy Kirk

IBM's Zurich research laboratory has developed a USB stick that the company says can ensure safe banking transactions even if a PC is riddled with malware.

12:40 PM (9 hours ago)

Cisco debuts e-mail security services

from Network World on Security by Tim Greene

Cisco is wheeling out three flavors of e-mail security services, the first of a series of hosted security services the company plans to announce.

12:40 PM (9 hours ago)

Aussie govt considers quantum leap in secure comms

from Network World on Security by Darren Pauli

Australian governments may soon have the world's most secure data communication system if trials of a locally-developed quantum cryptography technology are successful.

4:17 PM (5 hours ago)

Opera browser security updates, (Tue, Mar 3rd)

Opera has released version 9.64 on various platforms to address security bugs ...(more)...

12:44 PM (9 hours ago)

Iranian cybercriminal shares Marine One specs on Gnutella

from Ars Technica by julian.sanchez@arstechnica.com (Julian Sanchez)

A data security company in Pennsylvania this weekend confirmed that sensitive schematics for the Sikorsky VH-60N helicopter—better known by the call sign "Marine One" when used as personal transport for the President of the United States—had been leaked over the Gnutella peer-to-peer file sharing network, and appeared to be in the possession of a probable cybercriminal in Iran.

The documents—which included the complete avionics package for the VH-60N, describing its electronic systems in detail—were first discovered floating around P2P networks last fall by analysts at Tiversa, a company that specializes in detecting P2P data leaks. The documents are believed to have originated on the network of an unnamed defense contractor based in Bethesda, MD, where an employee had installed a file-sharing client configured to share the contents of the hard drive indiscriminately.

11:07 AM (11 hours ago)

Netbooks May Offer Hackers Private Data Gateway

from Wired Top Stories by By Kelvin Soh

TAIPEI (Reuters) - Netbook web surfers beware. That low-cost netbook you're using could be a high-speed gateway into your life, bank accounts, passwords and other personal data.

Netbooks have made headlines since their 2007 launch, making PCs accessible to millions of non-traditional users. But their cheap cost could also carry a steep price tag due to lax security that makes them easier prey for viruses and hackers.

10:12 AM (12 hours ago)

Too Early to Criticize Obama's Tech Policy?

from Wired Top Stories by Nicholas Thompson

Obama's technology policy has not been as transformative as a lot of Wired readers might have hoped — at least in the first month and a half. Some great things have happened, but the velocity is lower than expected. Obama is supposed to create a wiki white house. Is it too early to take him to task?

7:54 PM (2 hours ago)

Pop Superstar Sting Supports British Pentagon Hacker, Condemns U.S.

from Wired Top Stories by Kevin Poulsen

Former Police singer calls the U.S. prosecution of admitted British hacker Gary McKinnon "a travesty of human rights" and "disproportionate in the extreme." Next week, Boy George calls the prosecutor a karma chameleon.

2:50 PM (7 hours ago)

Critical Fix for the Opera browser, New Winamp Flaw

Grab today's update of the Opera browser to fix a major security flaw, and watch out for a hole in the Winamp media player.

11:28 AM (11 hours ago)

Facebook Hit by Five Security Problems in One Week

Facebook has been the victim of five different security problems in the past week, says Trend Micro.

Other News

11:28 AM (11 hours ago)

Socialtext Collaboration Platform Gains Microblogging

Socialtext will add Twitter-like functionality to its hosted enterprise collaboration platform.

Around The Horn vol.1,53

Alerts

Mar 2, 2009 (14 hours ago)

SB09-061: Vulnerability Summary for the Week of February 23, 2009

from US-CERT Cyber Security Bulletins

Vulnerability Summary for the Week of February 23, 2009

Mar 2, 2009 (13 hours ago)

Cisco Security Advisory, (Fri, Feb 27th)

Yesterday Cisco released a Security Advisory forMultiple Vulnerabilities in the Cisco ACE Appl ...(more)...

Security News

Mar 2, 2009 (18 hours ago)

Protecting Your Web Apps: Two Big Mistakes and 12 Practical Tips to Avoid Them

from SANS Information Security Reading Room

Category: Application/Database Sec

Paper Added: March 2, 2009

Mar 2, 2009 (yesterday)

Caching bugs exposed in second biggest DNS server

from CGISecurity - Website and Application Security News by Robert A.

"For years, cryptographer Daniel J. Bernstein has touted his djbdns as so secure he promised a $1,000 bounty to anyone who can poke holes in the domain name resolution software. Now it could be time to pay up, as researchers said they've uncovered several vulnerabilities in the package that could lead...

Feb 28, 2009 (3 days ago)

Google Bucking the Trend?

from McAfee Avert Labs by Craig Schmugar

The other day I blogged about Google Trends being abused to serve malware. The attackers were not only targeting the most popular search terms, but also manipulating Google’s page rankings to appear high up on search results. It appears that Google may have squashed those attacks, at least at the moment.

The pages that were coming up while searching Google seem to be purged from Google’s index. The pages may still be found on other search engines, though not ranked as high. This is also visible in stats I started gathering yesterday.

I took the top 100 search terms for each day of this week and ran a Google search on each term. I then considered the top 10 search results for each term, looking for poisoned links with high rankings. Admittedly it would have been better to gather the search results on each day, rather then running the test several days after the fact, but none the less the limited results do suggest that Google took some recent actions.

The following graph shows significant activity prior to mid-day yesterday.

Mar 2, 2009 (14 hours ago)

Prime Minister's health records breached in database attack

Scottish rich and powerful victimized

Personal medical records belonging to Scotland's rich and powerful - including Prime Minister Gordon Brown and Holyrood's First Minister Alex Salmond - have been illegally accessed in a breach of a national database that holds details of 2.5 million people.…

Mar 2, 2009 (16 hours ago)

Convicted Romanian hacker is hot commodity in Italy

Companies, authorities fawn over informatics whiz

Software companies and government officials in Italy are falling over themselves to recruit a 22-year-old hacker serving a three-year prison sentence for electronic fraud.…

Mar 2, 2009 (18 hours ago)

Koobface variant worms across social networking sites

Facebook reject 'martial law' app vetting idea

A new strain of the Koobface worm is spreading across social networking sites including Facebook, MySpace and Bebo.…

Mar 2, 2009 (19 hours ago)

AVG finally bothers with behaviour-based defences

And what time do you call this?

AVG has belatedly introduced behaviour-based anti-malware protection to its line of paid-for security products.…

Mar 2, 2009 (21 hours ago)

Conficker call-backs threaten to swamp legit domains

Southwest Airlines faces Friday the 13th horror

The infamous Conficker worm is set to disrupt the operation of at least four legitimate websites this month.…

Mar 2, 2009 (yesterday)

Phishers automate attacks using 'Google hacking'

Why pay when you can pwn?

Three in four phishing sites are hosted on compromised servers, according to a new survey.…

7:26 PM (11 hours ago)

Second rogue Facebook app bewilders users

Poisoned mushrooms and spam

Scoundrels have created another rogue Facebook application, the second to hit the social networking site in less than a week.…

4:36 AM (2 hours ago)

NAC-as-a-service

from Network World on Security by Tim Greene

The recent purchase of Mirage Networks by service provider Trustwave raises questions about whether NAC-as-a-service is a viable business.

Mar 2, 2009 (17 hours ago)

Survey: Most Oracle Shops Don't Mandate Security Patches

from Network World on Security by Jaikumar Vijayan

A lack of corporate mandates to quickly install Oracle Corp.'s security patches may be leaving many Oracle database installations exposed to vulnerabilities for extended periods of time, according to survey results released last week.

Mar 2, 2009 (17 hours ago)

Protecting a business from angry ex-employees

from Network World on Security by Julia King

A senior corporate executive leaves the company, taking with him his framed family photographs, his prized gold pen-and-pencil set -- and the passwords of several hundred employees.

Mar 2, 2009 (17 hours ago)

Surf Anonymously - And More Safely - With IP Privacy

from Network World on Security by Preston Gralla

The Web is full of snoopers, spyware, and people who want to steal your private information. IP Privacy ($40, 3-day free trial) can help protect you against them by helping you surf anonymously--that is, hiding your IP address and other personal information that Web sites can gather about you.

Mar 2, 2009 (17 hours ago)

Downadup worm may hammer Southwest Airlines URL March 13

from Network World on Security by Gregg Keizer

Computers infected by the Downadup worm will "phone home" to several legitimate URLs this month, including one owned by Southwest Airlines , potentially disrupting those sites, a security researcher said Sunday.

Mar 2, 2009 (yesterday)

The other federation technology

from Network World on Security by Dave Kearns

While we've seen, over the past few issues, that federated provisioning still has a long way to go there's another technology, an older technology, which might bear another look.

Feb 28, 2009 (3 days ago)

Hope for a New Cybersecurity Administration

from Network World on Security by Bob Bragdon

Politically, it seems to be a time to be full of hope. Despite the slumping economy and the challenges that lie before us, hope takes on two forms for me this year:

Feb 28, 2009 (3 days ago)

Exposed Web site a reminder for use of multiple passwords

from Network World on Security by Darren Pauli

A Christian singles Web site called Singles.org was infiltrated by hackers last weekend, reportedly absconding with the secret passwords of over 9,000 of its users.

Feb 28, 2009 (3 days ago)

Adventures in data recovery

from Network World on Security by Jennifer Kavur

Russian hackers hold a casino site hostage, a Venezuelan town mistakes disk drives for organ transfers and a Toronto hospital needs ER for RAID array. Three adventure tales from CBL Data Recovery.

Feb 28, 2009 (3 days ago)

Visa: New payment-processor data breach not so new after all

from Network World on Security by Jaikumar Vijayan

Days after Visa Inc. seemingly confirmed that a data breach had taken place at a third payment processor , following on the recent breach disclosures by Heartland Payment Systems Inc. and RBS WorldPay Inc., the credit card company now is saying that there was no new security incident after all.

4:01 AM (2 hours ago)

Koobface Worm Variant Hits Facebook

from Darknet - The Darkside by Darknet

Koobface is computer worm that targets the users of the social networking websites Facebook and Myspace. Koobface ultimately attempts, upon successful infection, to gather sensitive information from the victims such as credit card numbers. A new variation of Koobface has popped up aggressively on Facebook and is attempting to steal login...
Read the full post at darknet.org.uk

4:05 AM (2 hours ago)

SSLstrip - HTTPS Stripping Attack Tool

from Darknet - The Darkside by Darknet

This tool provides a demonstration of the HTTPS stripping attacks that was presented at Black Hat DC 2009. It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. It also supports modes for supplying a favicon which [...]
Read the full post at darknet.org.uk

Mar 2, 2009 (13 hours ago)

Obama's leaked chopper blueprints: anything we can learn?, (Mon, Mar 2nd)

We've been sent all day long pointers to various media outlets regarding the leak of some blueprint ...(more)...

Mar 1, 2009 (2 days ago)

Cool combination of tools, (Sun, Mar 1st)

I've mentioned here before that I'm a big fan of Volatility for analyzing memory images. In fa ...(more)...

Feb 28, 2009 (3 days ago)

OSSEC Version 2 available!, (Sat, Feb 28th)

A reader wrote in to inform us that OSSEC version 2.0 has been released ...(more)...

Mar 2, 2009 (15 hours ago)

Brief: Spy agency gains support for key cyber role

Spy agency gains support for key cyber role

Mar 2, 2009 (12 hours ago)

Conficker-created connections could confound consumers

from Ars Technica - Front page content by jhruska@arstechnica.com (Joel Hruska)

The Conficker worm has yet to eclipse Storm in terms of the total amount of chaos it created at any one time, but the botnet is proving annoyingly hard to kill. What began as an infection that took advantage of a handful of businesses with extremely slow patch validation cycles has become (and maintained itself) as a significant threat.

This has undoubtedly caused much wailing and gnashing of teeth within the halls of Microsoft itself; the company released a security update to resolve the flaw Conficker relies upon (MS08-67) in October, well before Conficker itself appeared. security researchers have examined how Conficker phones home for updates and have determined that at least four legitimate domains are going to be targeted by thousands of botnet systems requesting instructions in the weeks ahead.

Rogue apps raise concerns over Facebook's reactive policies

from Ars Technica - Front page content by david@arstechnica.com (David Chartier)

It's all fun and games in social networking—until Facebook users' personal data start getting ripped off. A couple of malicious applications in the last week were briefly able to dupe users into helping them to spread virally, bringing Facebook's low barriers for development entry and reactive vetting policies into question.

Two applications, "F a c e b o o k—closing down!!!" and "Error Check System," spread virally through Facebook profiles by tricking users into adding them to their accounts. Once users grant the applications access to their profiles, these apps would then scrape their contact lists, rinse, and repeat. There is no word on how many users were affected by these applications or who their developers were, and Facebook did not return Ars' request for comment in time for publication. Still, the incident raises new questions about the state of Facebook's wide open application platform and whether the company needs to do more to protect its users.

7:34 PM (11 hours ago)

Academic Claims to Find Sensitive Medical Info Exposed on Peer-to-Peer Networks

from Wired Top Stories by Kim Zetter

A new report says simple search terms on several filesharing networks uncover files listing thousands of patient names, Social Security numbers, birth dates and codes that reveal specific diseases.

Mar 1, 2009 (2 days ago)

Spam Spiked, then Slowed in February