Around The Horn vol.1,65

White House CIO On Leave Amid Scandal At D.C. Technology Office

White House CIO goes on leave after two former subordinates in DC technology office are arrested on charges of corruption

Startup Secures Mashups

Startup rolls out open protocol, technology for securing mashups

dnsmap 0.22 Released - Subdomain Bruteforcing Tool

By Darknet on subdomain bruteforcer

dnsmap is a subdomain bruteforcer for stealth enumeration, you could say something similar to Reverse Raider or DNSenum. Originally released in 2006, dnsmap is mainly meant to be used by pentesters during the information gathering/enumeration phase of infrastructure security assessments. During the enumeration stage, the security consultant would...
Read the full post at darknet.org.uk

ProxyStrike v2.0 released

Posted by Christian Martorella on Mar 17

Im please to announce a new version of ProxyStrike, an active Web Application Proxy, is a tool designed to find vulnerabilities while browsing an application. It was created because the problems we faced in the pentests of web applications that heavily depends on Javascript, not many...

Auditors: IRS should scan servers weekly

Posted by InfoSec News on Mar 17

http://fcw.com/articles/2009/03/16/irs-servers.aspx

By Mary Mosquera
FCW.com
March 16, 2009

The Internal Revenue Service should scan all its computer servers each
week to protect against malicious code and software attacks, the
Treasury Inspector General for Tax Administration (TIGTA)...

Broken Engagement Leads IT Worker To Damage Australian Government Data

Posted by InfoSec News on Mar 17

http://www.darkreading.com/insiderthreat/security/attacks/showArticle.jhtml?articleID=215900507

By Tim Wilson
DarkReading
Mar 16, 2009

A man who crashed government computer systems in Australia's Northwest
Territory last year says he did it because he was drunk and upset that
his fiancee...

New DNS trojan taints entire LAN from single box

Posted by InfoSec News on Mar 17

http://www.theregister.co.uk/2009/03/16/dns_hijacking_trojan/

By Dan Goodin in San Francisco
The Register
16th March 2009

Internet security experts are warning of a new rash of malware attacks
that can hijack the security settings of a wide variety of devices on a
local area network, even...

Heartland Data Breach: Visa Sets Deadline for Issuers to File Fraud Claims

Posted by InfoSec News on Mar 17

http://www.bankinfosecurity.com/articles.php?art_id=1277

By Linda McGlasson
Managing Editor
Bank Infosecurity
March 16, 2009

Heartland Payment Systems (HPY) has been removed from Visa's list of
compliant service providers, and banking institutions affected by the
Heartland data breach...

Hackers target Shell customers

Posted by InfoSec News on Mar 17

http://www.news.com.au/story/0,27574,25199207-29277,00.html

By staff writers
NEWS.com.au
March 17, 2009

ONLINE hackers have stolen personal information from almost 6000 Shell
customers in Australia and New Zealand.

Shell spokesman Paul Zennaro confirmed that 4500 Australians were
...

Leaked Comcast User Data Found Online

An alert PC World reader helps uncover a document containing thousands of e-mail addresses and passwords.

Card-sniffing trojans target Diebold ATM software

Innovations in cybercrime

Security researchers from Sophos have discovered sophisticated malware that siphons payment card information out of automatic teller machines made by Diebold and possibly other manufacturers.…

Worm burrows into Church of England email system

Infected bishop loses e-pistles

The Bishop of Manchester has been unable to send or receive email messages for ten days following a computer virus infection.…

Patch Those Internet Printers

By HongZheng Zhou on Web and Internet Safety

When I wrote a scanner plug-in this week for an old directory traversal vulnerability–CVE-2008-4419–I wondered whether there are vulnerable HP LaserJet printers online that can be controlled from the Internet. To find out, I used Google. The search listed almost 50 results, and I found that almost all of these printers are not patched, even [...]

Microsoft Threat Management Gateway has some drawbacks

By Eric Ogren

Microsoft's new gateway lacks policy enforcement integration and does not detect the presence of sensitive data or provide PCI features.

Third QSA firm placed in remediation by PCI SSC

By Robert Westervelt

The PCI Security Standards Council quality assurance program placed three QSA firms into remediation. They could face revocation of their certification to conduct PCI assessments.

Portable security storage device could replace OTP devices

By Erin Kelly

A new USB-like device, hardened with security features, could overtake one-time password devices and give end users flash memory to carry around encrypted data.

Browser add-on locks out targeted advertising

A Harvard University fellow has developed a browser extension that stops advertising networks from tracking a person's surfing habits, such as search queries and content they view on the Web.

Bomb hoax news fed to users after IP analysis

Criminals are trying to trick users into downloading malware by luring them to a website that reports a hoax breaking news' story of a bomb explosion cleverly tailored to their location.

Web inventor Berners Lee conned by fake website

In a classic example of an invention turning on its inventor, web pioneer Sir Tim Berners Lee, has admitted being conned out of his money by an Internet fraudster.

Leaked Comcast User Data Found Online

Comcast has suffered a leak in its user data that went undetected for more than two months. And it was an alert PC World reader who helped uncover the leak, when a document containing 8,000 e-mail accounts and passwords was found on Scribd.com, according to the New York Times.

Kraken the botnet: The ethics of counter-hacking

The Kraken is a huge network of personal computers that have been infected with software that turns them into zombie systems under the control of a master program - a botnet. The Kraken botnet is used by criminals to generate spam.

Survey: Families wise up to importance of online safety

Children admit sneaking in more time online than their parents know about, but families overall are getting more savvy about Internet safety, according to a new survey commissioned by Symantec.

NAC as a compliance tool

NAC is mainly pushed as a risk-mitigation technology that can reduce the likelihood that an endpoint is infected or carrying out unauthorized activity, but its features have been pressed into other duties.

Global Dispatches

U.K. Police Lose Crime-Data Card

Companies get checklist on PCI security rules

The organization that administers the credit card industry's data security rules has released a new set of compliance guidelines -- a move that reinforces the widespread perception that efforts to comply are going slowly at many companies.

Next Symantec CEO to focus on security

In three weeks, Cupertino, Calif.-based Symantec Corp.'s chief operating officer Enrique Salem will assume the role of "CEO designate", and drive the company's focus back to security following a period of strayed focus, he said. "

BBC botnet 'reckless,' may inspire copycats

Security company Sophos has lashed out at the BBC for commandeering some 22,000 computers earlier this month, claiming the move was a reckless breach of privacy that could inspire a wave of vigilante copycats.

Malwarebytes' Anti-Malware Adds a Layer of Protection

If you've got only one piece of anti-malware software on your system, you're not protected well enough. Most anti-spyware programs can't detect and kill all spyware, so it's a good idea to run two on occasion, and sometimes more. Malwarebytes' Anti-Malware (free demo, US$25 to unlock all features) is a worthwhile addition to anyone's anti-spyware arsenal, because unlike some overly complex programs, it's easy to configure and use.

nCircle researcher: Microsoft patch leaves users vulnerable

One of the patches Microsoft Corp. issued last week is nothing of the sort, according to a researcher who Monday accused Microsoft of making functionality a higher priority than security.

Botnet takedown offers peek at private data repository

By jhruska@arstechnica.com (Joel Hruska) on Zeus

The UK security firm Prevx has released details into a major botnet shutdown that netted the firm an unusual find—a command-and-control server loaded with the private details for some 160,000 individual computers and/or persons. Although that server has since been shut down and the appropriate authorities notified, the server's repository of data is a first-rate example of how data from a melting pot of sources ends up indiscriminately fused together.

All eyes on cybersecurity at midpoint of federal review

By julian.sanchez@arstechnica.com (Julian Sanchez) on DHS

Last week was a busy one for cybersecurity mavens as the 60-day review ordered by President Obama reached its halfway point. The House Committee on Homeland Security held hearings on the state of efforts to protect the nation's data infrastructure, even as the Congressional Research Service released a report highlighting the shaky legal foundations of the Comprehensive National Cybersecurity Initiative. The Department of Homeland Security, which came in from many House witnesses, appointed a former Microsoft executive to lead the charge on cybersecurity. And at the annual FOSE conference, former FBI head Louis Freeh weighed in with a contrarian warning that centralization provided an "illusory" solution to the problem.

US Lawmakers Reportedly Drafting Bill to Address Behavioral Advertising Issues (March 16, 2009)

US legislators are drafting a bill that would require Internet companies using targeted advertising technology to notify users that their habits are being tracked for that purpose....

Finnish President Ratifies Law Allowing Employers to Monitor Employees' eMail Activity (March 4 & 14, 2009)

A newly ratified law in Finland allows employers to monitor employees' email messages when they suspect misconduct...

Visa Says RBS WorldPay and Heartland No Longer PCI DSS Compliant (March 13, 2009)

Visa has said that RBS WorldPay and Heartland Payment Systems are no longer compliant with the Payment Card Industry Data Security Standard (PCI DSS)....

PCI Security Standards Council Issues Prioritized Approach for Compliance (March 16, 2009)

The PCI Security Standards Council LLC has issued a list of compliance guidelines it calls the Prioritized Approach to help companies struggling with where to go or even where to begin implementing the controls to protect payment card customer data...

Man Who Deleted Australian Government Computer Accounts to be Sentenced (March 13, 2009)

David Anthony McIntosh, a former IT consultant for the government in Australia's Northern Territories, will be sentenced this week for damage he caused to a government computer system...

Japanese Court Orders ISP to Reveal File Sharer's Identity (March 15, 2009)

A Japanese court has ordered an Internet service provider (ISP) to disclose the identity and address of a customer who allegedly used file-sharing software to expose personally information of 110,000 high school students.......

Report: IRS Malware Response Improved, Prevention Still Needs Attention (March 10 & 16, 2009)

A recently released audit report from the Treasury Inspector General for Tax Administration (TIGTA) says that while the US Internal Revenue Service (IRS) "responded appropriately when malware was detected," it could improve controls to prevent malware from reaching the systems in the first place.......

Kundra On Leave During Probe of Former Office (March 12 & 13, 2009)

Vivek Kundra, who was recently appointed by president Obama as federal chief information officer (CIO), has taken a leave of absence from that position following the arrests of two individuals associated with his former office.......

Iowa Company Agrees to Pay Undisclosed Sum For Unlicensed Software Use (March 12 & 16, 2009)

An Iowa company has agreed to pay the Software & Information Industry Association a six figure settlement for using copies of software without valid licenses.......

Microsoft DNS Patch Does Not Address Core Issue (March 16, 2009)

One of the patches Microsoft released last week for a vulnerability in Windows DNS and WNS servers merely mitigates the issue but does not fix it, according to security engineer Tyler Reguly.......

Comcast Subscriber Info Exposed Online (March 16, 2009)

A list of several thousand Comcast subscriber usernames and passwords was exposed on the Internet for about two months.......

Consultant Who Exposed Coleman Website Flaw Defends Actions (March 13 & 16, 2009)

The IT consultant who exposed the vulnerability on former Minnesota Senator Norm Coleman's campaign website in January says she did so highlight the problem so others could protect themselves from breaches.......

Around The Horn vol.1,64

Alerts

More UDP Activity, (Mon, Mar 16th)

Martin I. wrote in a bit ago in response to the diaries from Saturday and Sunday ...(more)...

new rogue-DHCP server malware, (Mon, Mar 16th)

Thanks to Irwin for alerting us about a new version of rogue DHCP server malware he found in his net ...(more)...

SB09-075: Vulnerability Summary for the Week of March 9, 2009

Vulnerability Summary for the Week of March 9, 2009

Security News

Brief: Analyst: Security elusive in the "cloud"

Analyst: Security elusive in the "cloud"

March 9-15, 2009

Report Highlight: Phishers Find Vulnerable New Friends in Social Networks

Authentication with a twist

And now for something completely different. I promise nothing about provisioning and/or federation this week. In this issue, and the next, it's straight-forward, clear-cut authentication we'll discuss, but with a twist.

4 Steps to the Security Industry's Economic Survival

Everyone is focused on clinging to a job or finding a new one in these dark economic times. In doing so, avoiding controversy and risk is usually standard operating procedure. But it shouldn't be, according to several security industry heavyweights who attended the recent SOURCE Boston conference.

AlgoSec puts its firewall analysis software on an appliance

AlgoSec is coming out with an appliance that has its firewall analysis software already installed, giving customers a fourth option for using the company's tools.

BBC in hot water for hiring botnet

The BBC has been come in for sharp criticism over the decision by its Click computing show to hire a live botnet to demonstrate the ease with which spam can bombard e-mail users.

DHS Exec's Exit Raises Red Flags on NSA's Security Role

The abrupt resignation of one of the U.S. government's top cybersecurity officials has exposed widespread -- though not universal -- opposition to the National Security Agency's expanding role in federal security initiatives.

Two start-ups, Egress and SafeMashups, make debut today

Two start-ups, Egress Software Technologies and SafeMashups, each make their debut today with security products that have a crypto-tech edge to make data flowing across the Internet safer.

Securing Your Virtualized Environment

Virtualization promises to make IT departments more flexible, more efficient and -- perhaps most crucial in these tough times -- more frugal. But one advantage the technology doesn't provide is an escape from the need for strong security measures.

Five tips for an effective enterprise mobility strategy

Once upon a time, the IT team at a large U.S. healthcare institution got a call from the shipping department saying that several cases of Wi-Fi-enabled devices had arrived on the loading dock. IT knew nothing of the shipment, since the devices had been ordered by nursing administrators.

Will the real mobile enterprise device please stand up?

In the consumer-centric mobile device world, constant updates and cool features are the norm. But that's not what enterprises are looking for when they choose to standardize on a mobile device.

McAfee Debuts ‘Combating Threats’ Series

By David Marcus on Zero-Day

McAfee Avert Labs will now produce more detailed documentation on prevalent threat families. The “Combating Threats” document series is designed to arm security staff within organizations with more information concerning prevalent threat families as well as to provide additional mitigation steps that can be taken. The first two documents in this series, “W32/Virut Family” [...]

Malware Again Attacks Ichitaro Word Processor

By Shinsuke Honjo on Web and Internet Safety

For years, the Japanese word processor Ichitaro has been attacked by malware authors exploiting flaws in the application. So it is no surprise that in the last week we discovered in the wild specially crafted Ichitaro document files exploiting a new vulnerability. This time, the crafted file (detected as the Exploit-TaroDrop.g Trojan) drops and [...]

Breaking News: Waledac Terror Attack in a City Near You

By Micha Pekrul on Web and Internet Safety

Users should always take care while surfing the Internet and reading mail, and today maybe more than usual: Another spam run from the Waledac botnet is on the loose, this time misusing the good reputation of the news agency Reuters. After the “President Inauguration,” “Valentine Scam,” and the “Economic Crisis,” this time the social-engineering trick [...]

Democrats.org Cans the Spam

By Craig Schmugar on Web and Internet Safety

Last week I blogged about how the community forum of Democrats.org was being abused to help manipulate Google’s search results; to lead people to malware.  It appeared that by the end of last week, Democrats.org began the cleanup process of removing all the bogus posts, which seems to have been completed as of this time.  [...]

New DNS trojan taints entire LAN from single box

One 'sploit pwns all

Internet security experts are warning of a new rash of malware attacks that can hijack the security settings of a wide variety of devices on a local area network, even when they are hardened or don't run on Windows operating systems.…

Web scam hoodwinks web founding father

Berners-Lee burned

Even the inventor of the world wide web isn't immune from online crime.…

Better metrics needed for security, says expert

Awash in bad data

BOSTON — The security industry has done a poor job of finding ways for companies to measure their security, but that does not mean that collecting data is not valuable, the former head of the U.S. Department of Homeland Security's cyber group told attendees at the SOURCE Boston conference on Thursday.…

Geo-located malware appears over the horizon

Dirty bomb ruse used to punt worm

Malware authors have incorporated technology designed to find the geographic location of prospective marks as a tactic to enable more convincing social engineering scams.…

BBC Click paid cybercrooks to buy botnet

Your licence fees at work

BBC Click has admitted paying cybercrooks thousands of dollars to buy access to a botnet as part of a controversial cybercrime investigation, broadcast over the weekend.…

Egress Secures Data Exchange to Prevent Enterprise Data Breaches (E-Week Security)

Other News

Ex-Google, Yahoo Staffers Release Hadoop Distribution

Cloudera has launched its commercial distribution of the large-scale Hadoop computing framework.

Will the economic crisis destabilize Tajikistan?

By Ilan Greenberg on dispatches

VOSAY, Tajikistan—Taking a car from Dushanbe, Tajikistan's easy-going capital city, to the Afghanistan border requires special permission from government authorities. I didn't have it. Which was why I found myself near the border in a town called Vosay, drinking tea and cognac with a local man after we had aborted his harebrained plan to take his special "short cut" over the mountains to a string of border hamlets where the Tajik police rarely go.

Around The Horn vol.1,63

Alerts

CVE-2009-0582 (Natl. Vulnerability Database)

CVE-2008-4316 (Natl. Vulnerability Database)

Security News

Splunk on Competition in the Log Management Space

The main competitors Splunk faces are ArcSight, with its Logger product, and LogLogic, although we have found that customer attitudes toward log management (LM), ESIM and security event
management (SEM) – respectively, log aggregation and archival, correlation of archived and real-time logs to create events, and correlation of real-time events – have changed fairly dramatically over the past year. Customers are considering their stance toward LM/ESIM/SEM, wondering just how much correlation they need, how much archival and forensic analysis and how much blended realtime/archived correlation is necessary after all. We have seen sea changes in the industry, and it is a trend we will report on in further detail in Q1 2009. We also don't discount the competition (still) from home-built log management projects.

ESIM comes from CA Inc, Consul Risk Management (now owned by IBM), Novell, eIQnetworks, RSA, the security division of EMC, ExaProtect, Inspekt Security, Intellitactics, netForensics, NetIQ, NitroSecurity, OpenService, Prism Microsystems, Q1 Labs, Symantec and Tier-3. SEM comes from TriGeo Network Security, Cisco Systems, Check Point Software Technologies and Tenable Network Security. Log management comes from Alert Logic, LogLogic, LogRhythm, RSA, SenSage and, to an extent, products that are moving toward the related space of governance risk and compliance, including Archer Technologies, eIQNetworks, LogRhythm and others. Servicebased companies developing LM/ESIM/SEM content sources and customizing those products to work in harmony with enterprise data sources include Decurity and Vigilant.

Vulnerability Management Payoff Requires Road Map

Posted by InfoSec News on Mar 16

http://securitywatch.eweek.com/flaws/vulnerability_management_payoff_requires_roadmap.html

By Matthew Hines
eWEEK Security Watch
March 15, 2009

Vulnerability management may be the next big thing in terms of IT security strategy, but deriving the maximum value out of your efforts requires...

Re: BBC team exposes cyber crime risk

Posted by InfoSec News on Mar 16

Forwarded from: security curmudgeon <jericho (at) attrition.org>

: http://news.bbc.co.uk/2/hi/programmes/click_online/7932816.stm
:
: Software used to control thousands of home computers has been acquired
: online by the BBC as part of an investigation into global cyber crime.
:
:...

HITB2009 - Dubai: Conference Agenda amp Noteworthy Presentations

Posted by InfoSec News on Mar 16

Forwarded from: Praburaajan Selvarajan <prabu (at) hackinthebox.org>

The agenda for HITBSecConf2009 - Dubai is now online along with details
on both the conference keynote sessions. There are still another 4 more
weeks to grab your seats to the GCC's premier network security event!

...

Worldwide cybercrime police network grows

Posted by InfoSec News on Mar 16

http://www.networkworld.com/news/2009/031209-worldwide-cybercrime-police-network.html

By Jeremy Kirk
IDG News Service
03/12/2009

More countries are joining a network designed to quickly react to
cybercrime incidents around the world, a senior U.S. Federal Bureau of
Investigation official...

Contribute For Cyber Security Policy Of India

Posted by InfoSec News on Mar 16

http://www.mynews.in/fullstory.aspx?storyid=16483

By V.K.Singh
12/3/2009

National security and cyber security in India is passing through a bad
phase. The recent terrorist attacks have unambiguously proved the
deficiencies and weaknesses of Indian defence mechanisms. India failed
to...

Bribery case creates possible IT security nightmare in D.C.

Posted by InfoSec News on Mar 16

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9129663

By Patrick Thibodeau and Jaikumar Vijayan
March 13, 2009
Computerworld

After being arrested on bribery charges yesterday, the District of
Columbia's top information...

Re: Cybercrime-as-a-service takes off

Posted by InfoSec News on Mar 16

Forwarded from: Dave Dittrich <dittrich (at) u.washington.edu>

> http://www.itnews.com.au/News/98524,cybercrimeasaservice-takes-off.aspx
>
> By Ry Crozier
> ITNews
> 12 March 2009
>
> Malware writers that sell toolkits online for as little as $400 will
>...

Tips to Bring Twitter to the Enterprise

Firms are moving from using short messaging service with customers to putting the technology to work inside the company.

Putting Wikis to Work

The wiki may have a silly name, but it's a useful technology for collaborating with customers and employees.

Conficker.C primed for April Fool's activation

By jhruska@arstechnica.com (Joel Hruska) on Conficker.C

We've been tracking the Conficker worm since it launched itself into the wild last November; despite the best efforts of security officials worldwide, the worm still hasn't been completely crushed. The original flavor and its nastier follow-up (Conficker.A and Conficker.B) have been locked down, but the worm's creators have a third version (Conficker.C, naturally) prepared to hit the tubes come April 1. The new "C" twist won't have all of the tools "B" used to replicate, but it will be able to detect and kill certain system processes designed to find and remove it.

Around The Horn vol.1,62

-- Aurora Report says the weather has changed for the better, but with it has come some serious sinus headaches.

You may have noticed the Salvador Dali fine art of the day at the blog site – if not this is how I have been feeling lately. 

I never knew how captivating Dali’s art was, nor how influential on my families artistic pursuits it had been.

I was at my fathers this weekend and saw several pieces my brother had done that are variations on Dali’s themes.

Security News

How to tell, what to do if computer is infected (AP) (Yahoo Security)

…

UDP Ports 54929, 46304, 23010, (Sun, Mar 15th)

Another reader, Tony W. was checking his logs for any activity referenced in Tony Carothers diary on ...(more)...

What's on your network?, (Sun, Mar 15th)

I was looking though my Spam folder this evening to see if there was anything interesting in there. ...(more)...

Social Networks' Risks for Business Security

Corporate social media has many positives, but security issues should not be overlooked.

DC Tech Arrests Raise Security Issues

Federal charges of bribery by IT officials in DC creates a potential tech security nightmare.

Feds File Bribery Charges Against D.C.'s Top Tech Official

The District of Columbia's acting chief security officer and an associate were arraigned.

Around The Horn vol.1,61

-- Aurora Report has been revamping its news sources and attempting to calibrate what has already been reported.  As such we have been delayed in posting for the last several days.

Alerts

New UDP Traffic with a Destination Port of 21713, (Sat, Mar 14th)

Barry B. today submitted a sampling of log files with a series of random source IP's and ports ...(more)...

MS09-008 Protection

By MSRCTEAM

Hi Bill here,

You may have seen reports regarding the effectiveness of Microsoft Security Bulletin MS09-008. I wanted to let everyone know that we have thoroughly reviewed these reports, and customers who’ve deployed this update are protected from the four vulnerabilities outlined in the bulletin. 

We’ve also been collaborating with several researchers regarding the effectiveness of this update, as it is a complex issue, and have released more details about these vulnerabilities and how the Security Update addresses them.

For those that want more information, please review the Microsoft Security Research and Defense blog http://blogs.technet.com/srd/archive/2009/03/13/ms09-008-dns-and-wins-server-security-update-in-more-detail.aspx where there’s detailed information that will help customers better understand how the security update protects systems, clarifies the content of the security update and hopefully answers any questions you may have. Again, I want to assure you that MS09-008 protects from potential attacks that could exploit the vulnerabilities outlined in the bulletin.

Please continue to evaluate and deploy this update at your earliest convenience to help protect your environment.

Thanks, Bill

TA09-069A: Microsoft Updates for Multiple Vulnerabilities

Microsoft Updates for Multiple Vulnerabilities

Kundra takes leave of absence from federal CIO post (NetworkWorld Security)

Ubuntu users, today is a good day to patch, (Fri, Mar 13th)

If you are running Ubuntu systems, then today may be a good day to think about patching. Things bei ...(more)...

Kundra takes leave of absence from federal CIO post

The fallout from Thursday's arrests of a District of Columbia IT security official and contractor quickly raised questions about the fate of Vivek Kundra, the new federal CIO who until recently ran the office now mired in bribery allegations.

Bribery case creates possible IT security nightmare in D.C.

After being arrested on bribery charges Thursday, the District of Columbia's top information security official is being held without bail, partly because of uncertainty about whether he still has the ability to access the district's IT systems.

Security News

Brief: Better metrics needed for security, says expert (SecurityFocus News)

When web application security, Microsoft and the AV vendors all fail, (Fri, Mar 13th)

I just spent some time analyzing yet another incident and I was actually shocked about how the combi ...(more)...

Chris Petersen, Chief Technology Officer, LogRhythm

Chris gives us his vision on the current state of log and event management as well as some specifics about LogRhythm.

Anthony Giandomenico, Security Hero

Anthony Giandomenico weighs in on Data Loss/Data Leakage Protection (DLP).

Application Security Best Practices: A New Maturity Model for Building Security In (March 9 & 10, 2009)

The Building Security in Maturity Model (BSIMM) is "a set of best practices developed by Citigal and Fortify" that draws together data from nine software security initiatives to help software developers build more secure products.......

Romanians find cure for conficker

BitDefender has released what it claims is the first vaccination tool to remove the notorious Conficker virus that infected some 9 million Windows machines in about three months.

Conficker.C variant set for April 1st surprise, CA says

The third Conficker variant is set to activate April 1, says CA, generating 50,000 URLs daily with its download function poised for instructions.

IBM develops Facebook privacy application

IBM on Thursday unveiled an application that guides users toward strong privacy settings in Facebook's online marketplace and could be developed into a management tool for companies or across Web sites for users.

A way to sniff keystrokes from thin air

That PC keyboard you're using may be giving away your passwords. Researchers say they've discovered new ways to read what you're typing by aiming special wireless or laser equipment at the keyboard or by simply plugging into a nearby electrical socket.

Apple fixes security flaws, adds features in iTunes update

Apple Inc. updated iTunes Wednesday, fixing a pair of security vulnerabilities, adding support for the new line of iPod Shuffles and boosting performance when loading large libraries and browsing the online store.

The effects of corporate social media on overall network security

In today's increasingly communicative world, businesses face a dilemma. They have to find ways to be more engaging and communicate more directly to their customers and the public, while retaining close control of sensitive information.

Business process flaws seen posing security risks

Running a secure Web site means more than just guarding against cross-site scripting and SQL injection attacks. Flaws in the business processes that underlie Web sites can also present serious security risks, the CTO of a Web security company said Thursday.

Spot the Tiny Phishing Trick

The TinyURL service allows you to enter a long URL, such as one for a particular Google Maps location, and convert it into a short, easy-to-type or e-mail link. Good for sending links - or as Trend Micro reports, for hiding a malicious Web site URL in a phishing e-mail.

Keeping IT honest

Forrester thinks paid-for blogging is OK but Gibbs disagrees because … well, you’ll have to read it to find out. He also wonders about what you might do if you discover malfeasance in your company …

Foreign Web attacks change security paradigm

Traditional security systems may be ineffective and become obsolete in warding off Web attacks launched by countries, according to Val Smith, founder of Attack Research. New attack trends include blog spam and SQL injections from Russia and China, Smith said during his talk at the Source Boston Security Showcase on Friday.

L0phtCrack returns

By Michael S. Mimoso

Security expert Chris Wysopal explains why the L0phtCrack password cracking tool was unveiled once again after Symantec discontinued sales of L0phtCrack in 2006.

Number-driven risk metrics 'fundamentally broken'

By Michael S. Mimoso

A former national cybersecurity czar says risk models used by security organizations often lead to a faulty understanding of threats and flaws, and a misallocation of resources.

Financial expert sees value in new security firms

By Robert Westervelt

The global economy may be in a steep decline, but VC funding available to new software vendors demonstrates a sound business strategy.

Serious holes in Mac OS X memory, researcher shows

By Robert Westervelt

A demonstration of hacking techniques at the SOURCE Boston conference enables an attacker to execute arbitrary code and take full control of a computer.

Brief: Better metrics needed for security, says expert

Better metrics needed for security, says expert

Safe Mode: A Misnomer

By Nandi Kishore on Web and Internet Safety

Windows offers the useful option of “Safe Mode” to recover from any damage caused by various malfunctions in the system. Booting in Safe Mode loads limited drivers and services that are required for the basic operation of the system, but avoids adding many extras that complicate the environment. In general, Safe Mode is very helpful [...]

BBC cybercrime probe backfires

By Robert A. on IndustryNews

"The BBC hacked into 22,000 computers as part of an investigation into cybercrime but the move quickly backfired, with legal experts claiming the broadcaster broke the law and security gurus saying the experiment went too far. The technology show Click acquired a network of 22,000 hijacked computers - known as a...

The eroding enterprise boundary

Lock Down and Open Up

Businesses today function effectively only when the organisation supports effective collaboration between its staff and external parties, wherever they may be situated. Such is the nature of routine operations that they depend on complex interactions between people and their supporting IT systems that spread far beyond the IT firewall and, indeed, the business itself. Clearly this nature of working has profound implications for those charged with securing the operations of the business and the IT systems they use.

Multi-site bug exposes cloud computing's dark lining

One vuln fits all

More dark linings have been exposed in the cloud computing craze, this time by web security expert Russ McRee, who demonstrates how a flaw in a single provider can spell trouble for numerous customers it serves.

Former employee of Obama CIO pick busted for bribery

Appointee not linked to wrongdoing

An employee who worked for President Obama's pick for federal CIO has been arrested by the FBI and charged in a federal bribery sting, according to news reports.

Where to start with IT Security

Episode 1 Security Webcast Mini Series

In a short series of webcasts The Register's expert panel will be tackling the current state of the security market.

MS security chief becomes DHS cybersecurity boss

Hot seat

A senior Microsoft exec has been placed in charge of protecting the US's computer systems from hacking attacks

Visa yanks creds for payment card processing pair

RBS, Heartland no longer PCI compliant

Visa on Friday alerted the world that RBS WorldPay and Heartland Payment Systems are not on its list of payment card processors who are in good standing with industry-mandated standards for data security.

Kundra Takes Leave, Google Raises Privacy Flags

Well, at least the issue is not unpaid taxes this time -- but Vivek Kundra, the brand-new, first-ever federal CIO after just a...

Cybercrime-as-a-service takes off

Posted by InfoSec News on Mar 13

http://www.itnews.com.au/News/98524,cybercrimeasaservice-takes-off.aspx

By Ry Crozier
ITNews
12 March 2009

Malware writers that sell toolkits online for as little as $400 will now configure and host the attacks as a service for another $50, a security expert has said.

Speaking at the...

Army database may have been breached

Posted by InfoSec News on Mar 13

http://fcw.com/articles/2009/03/12/army-breach.aspx

By Doug Beizer
FCW.com
Mar 12, 2009

An Army database that contains personal information about nearly 1,600 soldiers may have been penetrated by unauthorized users, Army officials have announced.

Soldiers who registered with, or...

D.C.s top IT security official charged with bribery

Posted by InfoSec News on Mar 13

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9129582

By Patrick Thibodeau
March 12, 2009
Computerworld

WASHINGTON  Federal law enforcement officials filed bribery charges today against the District of Columbia's acting...

Microsoft Security Strategist Named Cybersecurity Leader

Posted by InfoSec News on Mar 13

http://www.informationweek.com/news/security/cybercrime/showArticle.jhtml?articleID=215900014

By K.C. Jones
InformationWeek
March 12, 2009

The Department of Homeland Security has announced a new cybersecurity leader.  DHS Secretary Janet Napolitano has appointed Phil Reitinger as deputy ...

BBC team exposes cyber crime risk

Posted by InfoSec News on Mar 13

http://news.bbc.co.uk/2/hi/programmes/click_online/7932816.stm

BBC Click
12 March 2009

Software used to control thousands of home computers has been acquired online by the BBC as part of an investigation into global cyber crime. The technology programme Click has demonstrated just how at...

Kremlin Kids: We Launched the Estonian Cyber War

Posted by InfoSec News on Mar 13

http://blog.wired.com/defense/2009/03/pro-kremlin-gro.html

By Noah Shachtman
Danger Room
Wired.com
March 11, 2009

Like the online strikes against Georgia, the origins of the 2007 cyber attacks on Estonia remain hazy. Everybody suspects the Russian government was somehow behind the...

Kremlin-backed youths launched Estonian cyberwar, says Russian official

Posted by InfoSec News on Mar 12

http://www.theregister.co.uk/2009/03/11/russian_admits_estonian_ddos/

By Dan Goodin in San Francisco
The Register
11th March 2009

Members of a Kremlin-backed youth group spearheaded the cyberattacks that paralyzed Estonia's internet traffic in May of 2007, a Russian government official...

Team Edwards to devote day for network security

Posted by InfoSec News on Mar 12

http://www.edwards.af.mil/news/story.asp?id=123139253

By 1st Lt. William Newby
95th Communications Group
3/11/2009

EDWARDS AIR FORCE BASE, Calif. -- There is an Airman on the frontlines fighting a battle right now, battling an enemy who hides and launches attacks from more than 120...

APWG suggests e-crime reporting system

Posted by InfoSec News on Mar 12

http://www.techworld.com/security/news/index.cfm?newsID=112534

By Jeremy Kirk
IDG News Service
11 March 2009

A group dedicated to fighting phishing scams has developed a way for police and other organisations to report e-crimes in a common data format readable by a web browser or other...

CIA, NSA Adopting Web 2.0 Strategies

Posted by InfoSec News on Mar 12

http://www.informationweek.com/news/internet/web2.0/showArticle.jhtml?articleID=215801627

By J. Nicholas Hoover
InformationWeek
March 10, 2009

While the United States intelligence community may have gotten a lot of publicity for its Wikipedia-like Intellipedia Web site, agencies like the...

NSA Dominance of Cybersecurity Would Lead to Grave Peril, Expert Tells Congress

Posted by InfoSec News on Mar 11

http://blog.wired.com/27bstroke6/2009/03/nsa-dominance-o.html

By Kim Zetter
Threat Level
Wired.com
March 10, 2009

The government's national cybersecurity efforts would be in "grave peril" if they were dominated by the intelligence community, said Amit Yoran, former head of the...

RE: Russia kinda-sorta owns up to Estonia cyberwar

Posted by InfoSec News on Mar 11

Forwarded from: "Denning, Dorothy (CIV)" <dedennin (at) nps.edu>

This is not what RFL reported. RFL reported that Markov said that his assistant was operating on his own. Markov is quoted as saying that the "assistant happened to be in 'one of the unrecognized republics'...

NIST suggests areas for further security metrics research

Posted by InfoSec News on Mar 11

http://gcn.com/articles/2009/03/09/nist-security-metrics.aspx

By William Jackson
GCN.com
Mar 09, 2009

Computer security is a difficult thing to quantify because, if done
right, nothing happens. How, then, do you measure what didn't happen?

Nevertheless, meaningful metrics are necessary so...

British pair charged in industrial espionage row

Posted by InfoSec News on Mar 11

http://business.timesonline.co.uk/tol/business/industry_sectors/engineering/article5876588.ece

By David Brown
Times Online
March 9, 2009

A leading British manufacturer has been caught up in an industrial espionage row after two engineers used a mobile telephone to photograph a secret...

Symantec creates havoc with unsigned Norton patch

Posted by InfoSec News on Mar 11

http://news.cnet.com/8301-1009_3-10192899-83.html

By Elinor Mills
Security
News.com
March 10, 2009

Symantec released a diagnostic patch for some of its older Norton
products on Monday night that did not identify its origin and thus
triggered alerts on user firewalls, the company said...

Outlaws and terrorists amplify security challenges, Motorola security chief says

Posted by InfoSec News on Mar 11

http://www.networkworld.com/news/2009/031009-infosec-motorola-boni.html

By Ellen Messmer
Network World
03/10/2009

ORLANDO -- The current era is marked by tumultuous change, high speed and huge danger, said Motorola's corporate security officer Bill Boni, based on his perspective of...

DDoS attack damaged public civil service for the first time

Posted by InfoSec News on Mar 11

http://english.etnews.co.kr/news/detail.html?id=200903100005

2009/03/10 By Jang, Dong-joon, Kim, In-soon

Interne attack has caused unprecedented incident in which on line civil service of public agencies suspended for 5 days before restoration.

On March 4, the home page of Game Rating Board...

Feds file new felonies against alleged Sarah Palin hacker

Posted by InfoSec News on Mar 10

http://www.theregister.co.uk/2009/03/09/palin_hacker_recharged/

By Dan Goodin in San Francisco
The Register
9th March 2009

A University of Tennessee student accused of illegally breaking into the email account of Alaska governor Sarah Palin has been hit with three new felony charges in...

NSA Chief Continues Bid to Take Over Cybersecurity

Posted by InfoSec News on Mar 10

http://blog.wired.com/27bstroke6/2009/03/nsa-continues-b.html

By Kim Zetter
Threat Level
Wired.com
March 09, 2009

In the wake of the resignation on Friday of National Cyber Security Center (NCSC) Director Rod Beckstrom over concerns that the National Security Agency plans to take over...

Re: Best attack strategy for a Red Team?

Posted by krymson_at_gmail.com on Mar 10

('binary' encoding is not supported, stored as-is) This likely won't help, but if you can get access to a target server, don't throw that away right away; dig deeper like you mentioned.

I think too often red teams will get all excited about a shell and soon everyone on the team is trying to use...

WarVOX - Wardialing Tool Suite (Explore, Classify & Audit Telephone Systems)

By Darknet on warvox

WarVOX is a suite of tools for exploring, classifying, and auditing telephone systems. Unlike normal wardialing tools, WarVOX works with the actual audio from each call and does not use a modem directly. This model allows WarVOX to find and classify a wide range of interesting lines, including modems, faxes, voice mail boxes, PBXs, loops, [...]

Read the full post at darknet.org.uk

New 'Spam King' Linked to SMS Campaign

New Zealand spammer Brendan Battles is apparently connected to an SMS bulk marketing campaign.

Biggest Worries When Shopping Online

Security firm F-Secure reports that consumers are wary of using credit cards on sites, but like online banking.

New Conficker Expected April 1

The next wave of the Conficker malware attacks are likely as an unpleasant April 1 surprise, say security researchers at Computer Associates.

Russian youth organization cops to 2007 Estonian cyberattacks

By jhruska@arstechnica.com (Joel Hruska) on Russia

In May 2007, the websites of a number of prominent Estonian politicians were attacked and crippled for several weeks. The attacks came at a time when Estonian/Russian relations were already chilly, thanks in part to the Estonian government's plan to move a Russian war memorial statue from the city center and into a cemetery. Ars has covered the issue since the attacks began, including the arrest of an Estonian student last year in connection with the prolonged DDoS siege. The arrest of 20-year-old Dmitri Galushkevich in January, 2008 raised doubts as to whether he was solely responsible for weeks of disruptions. On Wednesday, January 11, the doubters were victorious; comments from Konstantin Goloskokov, a commissar with the Russian youth movement Nashe, has admitted that the group organized and masterminded the Estonian barrage.

Around The Horn vol.1,60

Alert

11:29 AM (9 hours ago)

Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability

9:31 AM (12 hours ago)

Adobe Update is finally out, well, some of them, (Wed, Mar 11th)

from SANS Internet Storm Center, InfoCON: green

Thank you all that wrote in letting us know that the Adobe Update for Reader and Acrobat 9 is finall ...(more)...

Mar 10, 2009 (yesterday)

Massive ARP spoofing attacks on web sites, (Wed, Mar 11th)

from SANS Internet Storm Center, InfoCON: green

Recently Ive been involved in two incidents which had exactly the same modus operandi. The at ...(more)...

 Security News

3:20 PM (6 hours ago)

Kremlin-backed youths launched Estonian cyberwar, says Russian official

from The Register - Security

Mea Culpa without the culpa

Members of a Kremlin-backed youth group spearheaded the cyberattacks that paralyzed Estonia's internet traffic in May of 2007, a Russian government official has admitted.…

11:20 AM (10 hours ago)

BT rebuts database security breach claims

from The Register - Security

The very idea

BT has dismissed the significance of supposed vulnerabilities on its systems detailed by infamous hacker Unu on Tuesday.…

9:50 AM (11 hours ago)

Chinese crackers create counterfeit iTunes racket

from The Register - Security

Talkin' 'bout key generation

Chinese crackers have reportedly cracked the iTunes gift card system.…

7:19 AM (14 hours ago)

Critical kernel fix stars in Patch Tuesday updates

from The Register - Security

Excel 0-day threat remains unpatched

Microsoft released the promised three patches on Tuesday, including one critical, as part of its regular Patch Tuesday update cycle.…

Mar 10, 2009 (yesterday)

Online attackers feed off Norton forum purge

from The Register - Security

Silence isn't golden

Quick-moving attackers took advantage of a glitch in an update for Symantec anti-virus software, using an information vacuum that followed as an opportunity to lure panic-stricken users to websites that tried to install malware on their computers.…

9:20 PM (seconds ago)

No investigation after malware is found on parliamentary PC

from The Register - Security

Hill to climb for new e-crime unit

Police did not investigate when Alun Michael MP reported a PC in his office was attacked with malware, the former minister has revealed.…

9:20 PM (seconds ago)

Eset false alarm puts system files on remand

from The Register - Security

Kryptik cock-up

Slovakian anti-virus firm Eset has confirmed that a misfiring virus definition update wrongly labelled Windows system files as infected with malware.…

8:30 AM (12 hours ago)

Security Zoning for Virtualized Environments

from WindowSecurity.com by tshinder@tacteam.net (Thomas Shinder)

An important consideration when assessing the security of a virtualized environment: network security zoning.

12:42 PM (8 hours ago)

Antiphishing group develops e-crime reporting tool

from Network World on Security by Jeremy Kirk

A group dedicated to fighting phishing scams has developed a way for police and other organizations to report e-crimes in a common data format readable by a Web browser or other application.

4:41 AM (16 hours ago)

Adobe fixes security vulnerability with Acrobat 9, Reader 9

from Network World on Security by Jonathan Seff

Adobe on Tuesday fixed a critical security vulnerability in its Acrobat 9 and Reader 9 applications, which the company said "would cause the application to crash and could potentially allow an attacker to take control of the affected system."

4:00 PM (5 hours ago)

News: Experts: U.S. needs to defend its "cyber turf"

from SecurityFocus News

Experts: U.S. needs to defend its "cyber turf"

Mar 10, 2009 (yesterday)

Brief: Microsoft patches image, DNS flaws

from SecurityFocus News

Microsoft patches image, DNS flaws

Around The Horn vol.1,59

Alerts

4:16 PM (2 hours ago)

TA09-069A: Microsoft Updates for Multiple Vulnerabilities

from US-CERT Technical Cyber Security Alerts

Microsoft Updates for Multiple Vulnerabilities

1:56 PM (5 hours ago)

MS09-008 – Important: Vulnerabilities in DNS and WINS Server Could Allow Spoofing (962238)

from Microsoft Security Bulletins

Bulletin Severity Rating:Important - This security update resolves two privately reported vulnerabilities and two publicly disclosed vulnerabilities in Windows DNS server and Windows WINS server. These vulnerabilities could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker’s own systems.

1:56 PM (5 hours ago)

MS09-007 - Important: Vulnerability in SChannel Could Allow Spoofing (960225)

from Microsoft Security Bulletins

Bulletin Severity Rating:Important - This security update resolves a privately reported vulnerability in the Secure Channel (SChannel) security package in Windows. The vulnerability could allow spoofing if an attacker gains access to the certificate used by the end user for authentication. Customers are only affected when the public key component of the certificate used for authentication has been obtained by the attacker through other means.

1:56 PM (5 hours ago)

MS09-006 – Critical: Vulnerabilities in Windows Kernel Could Allow Remote Code Execution (958690)

from Microsoft Security Bulletins

Bulletin Severity Rating:Critical - This security update resolves several privately reported vulnerabilities in the Windows kernel. The most serious vulnerability could allow remote code execution if a user viewed a specially crafted EMF or WMF image file from an affected system.

Security News

2:06 PM (5 hours ago)

Microsoft Security Bulletin Summary for March 2009

from Microsoft Security Content: Comprehensive Edition

Revision Note: Bulletin Summary published.Summary: This bulletin summary lists security bulletins released for March 2009.

2:06 PM (5 hours ago)

MS09-008 – Important: Vulnerabilities in DNS and WINS Server Could Allow Spoofing (962238) - Version:1.0

from Microsoft Security Content: Comprehensive Edition

Severity Rating: Important - Revision Note: Bulletin published.Summary: This security update resolves two privately reported vulnerabilities and two publicly disclosed vulnerabilities in Windows DNS server and Windows WINS server. These vulnerabilities could allow a remote attacker to redirect network traffic intended for systems on the Internet to the attacker’s own systems.

2:06 PM (5 hours ago)

MS09-007 - Important: Vulnerability in SChannel Could Allow Spoofing (960225) - Version:1.0

from Microsoft Security Content: Comprehensive Edition

Severity Rating: Important - Revision Note: Bulletin published.Summary: This security update resolves a privately reported vulnerability in the Secure Channel (SChannel) security package in Windows. The vulnerability could allow spoofing if an attacker gains access to the certificate used by the end user for authentication. Customers are only affected when the public key component of the certificate used for authentication has been obtained by the attacker through other means.

2:06 PM (5 hours ago)

MS09-006 – Critical: Vulnerabilities in Windows Kernel Could Allow Remote Code Execution (958690) - Version:1.0

from Microsoft Security Content: Comprehensive Edition

Severity Rating: Critical - Revision Note: Bulletin published.Summary: This security update resolves several privately reported vulnerabilities in the Windows kernel. The most serious vulnerability could allow remote code execution if a user viewed a specially crafted EMF or WMF image file from an affected system.

2:06 PM (5 hours ago)

Microsoft Security Advisory (968272): Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution

from Microsoft Security Content: Comprehensive Edition

Revision Note: V2.1 (March 5, 2009): Removed Open XML File Format Converter for Mac from the affected software listed in the Overview section. The Open XML File Format Converter for Mac is not affected by the vulnerability described in this advisory.Summary: Microsoft is investigating new public reports of a vulnerability in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file. At this time, we are aware only of limited and targeted attacks that attempt to use this vulnerability.

12:54 PM (6 hours ago)

Proxy Attack Stupid Buzzword Contest

from CGISecurity - Website and Application Security News by Robert A.

I just released a paper on an attack vector against certain transparent proxy architectures via the use of client side plugins with sockets support. If you've been reading this site for awhile you can probably tell that I frown upon new industry buzzwords and often make fun of new silly sounding...

4:26 PM (2 hours ago)

Democrats.org Blog Spam Contributes to Google Search Poisoning

from McAfee Avert Labs by Craig Schmugar

The other day I blogged about Google Trends being abused to serve malware.  The attackers were not only targeting the most popular search terms, but also manipulating Google’s page rankings to appear high up on search results.   Shortly thereafter it appeared that Google took action against that attack.  In deed a Google spokesperson confirmed that idea.

Today, Brian Krebs blogged on a separate story, but mentioned that while searching for a related term (pifts.exe), Google returned a poisoned link high on the results list.  After doing a little searching I discovered that the relevant term did seem to appear on Google’s top 100 search terms for a brief period.  However, the other terms I checked on Google Trends did not yield high ranked poisoned links as before.  But, I did come across a potential source for the page rank manipulation aspects of these attacks;  www.democrats.org, which is “Paid for by the Democratic National Committee “, and linked to from www.barackobama.com.

4:04 PM (3 hours ago)

The long road to Reader and Flash security Nirvana

from The Register - Security

Critical Adobe updates not easy to come by

Updated Adobe on Tuesday patched a hole in its ubiquitous Acrobat Reader program that allows attackers to remotely install malware without requiring unsuspecting users to do anything more than browse to the wrong website.…

2:04 PM (5 hours ago)

Conspiracy theories fly around Norton forum 'Pifts' purge

from The Register - Security

EXE phones home?

Conspiracy theories are running rampant in the absence of a clear explanation of why Symantec deleted threads expressing concern about a file called pifts.exe from its Norton support forums.…

10:02 AM (9 hours ago)

No investigation after malware is found on parliamentary PC

from The Register - Security

Hill to climb for new e-crime unit

Police did not investigate when Alun Michael MP reported a PC in his office was attacked with malware, the former minister has revealed.…

10:02 AM (9 hours ago)

Eset false alarm puts system files on remand

from The Register - Security

Kryptik cock-up

Slovakian anti-virus firm Eset has confirmed that a misfiring virus definition update wrongly labelled Windows system files as infected with malware.…

9:02 AM (10 hours ago)

Russian politician: 'My assistant started Estonian cyberwar'

from The Register - Security

Dubious DDoS lols

A junior Russian politician has admitted that a Russian government official might have played some part in the infamous cyberattacks against Estonia two years ago - sort of.…

4:50 AM (14 hours ago)

Trademarks as keywords for targeted ads?

from Network World on Security by M. E. Kabay

I've been doing research for my annual review of intellectual property law and have had a great deal of fun learning about all sorts of interesting new developments. Here's a case that might interest readers who work in commercial organizations with valuable trademarks but that raises unexpected questions about freedom of speech.

4:50 AM (14 hours ago)

Business size and NAC needs

from Network World on Security by Tim Greene

As NAC matures, it is becoming clear that the needs of smaller businesses and those of enterprises call for different solutions.

4:50 AM (14 hours ago)

Inexpensive scanners can 'fingerprint' paper, researchers say

from Network World on Security by Robert McMillan

Think two blank sheets of paper are the same? Look closer.

4:50 AM (14 hours ago)

Companies get checklist for complying with PCI standard

from Network World on Security by Jaikumar Vijayan

The organization responsible for administering the Payment Card Industry Data Security Standard is offering new guidance to companies on how to focus their PCI DSS compliance efforts so as to more quickly them in position to meet the rules on protecting credit and debit card data.

12:36 PM (6 hours ago)

France, Ireland to launch e-crime police training programs

from Network World on Security by Jeremy Kirk

France and Ireland are hoping the European Commission will back a plan to create an academically accredited cybercrime training program for law enforcement.

12:36 PM (6 hours ago)

Germany ratifies cybercrime treaty

from Network World on Security by Jeremy Kirk

Germany has become the latest country to ratify the only international treaty concerning computer crime.

12:36 PM (6 hours ago)

Symantec's Altiris 7 boosts Mac, Linux PC management

from Network World on Security by Eric Lai

Symantec Corp. Tuesday announced Version 7.0 of its Altiris client and server management suite. The upgrade, the first released since Symantec's acquisition of Altiris almost two years ago, includes new features for remotely deploying and managing Mac and Linux desktop PCs and, on the server side, improved performance monitoring of physical and virtual machines.

12:36 PM (6 hours ago)

Steps to Communicate Security's Value to Non-security People

from Network World on Security by Joan Goodchild

The biggest challenge security teams face in their organization is one of perception, according to Michael Santarcangelo, founder of Security Catalyst, a New York-based consultancy focused on changing the way people protect information.

4:50 AM (14 hours ago)

Internet Explorer 8: Security Features for Enterprise Users

from Network World on Security by Shane O'neill

Over the past year, Internet Explorer has lost market share while browsers such as Mozilla's Firefox, Apple's Safari and even the nascent Google browser Chrome have made incremental gains.

4:50 AM (14 hours ago)

Mozilla Patches Fastest. NOT!

from Network World on Security by Jeff Jones

If you take away one thing from reading this, I hope that you take away skepticism. The Mozilla team focuses on security and that is a relatively rare thing in the software industry--and I heartily applaud them for their intent and efforts. I wish more would follow their example. However, I think the vulnerability picture for Firefox may not be quite as rosy as some would wish.

4:50 AM (14 hours ago)

Safari's Security Reputation Takes a Beating

from Network World on Security by Tom Kaneshige

Apple's Safari browser has taken some shots lately over its security capabilities compared to those of other popular browsers-but this doesn't mean Safari is a sieve.

1:00 PM (6 hours ago)

VideoJak - IP Video Security Assessment Tool

from Darknet - The Darkside by Darknet

What is VideoJak? VideoJak is an IP Video security assessment tool that can simulate a proof of concept DoS against a targeted, user-selected video session and IP video phone. VideoJak is the first of its kind security tool that analyzes video codec standards such as H.264. VideoJak works by first capturing the RTP port used in a [...]
Read the full post at darknet.org.uk

6:51 PM (39 minutes ago)

Adobe Acrobat 9.1 released, (Tue, Mar 10th)

from SANS Internet Storm Center, InfoCON: green

Gilbert and Robert wrote in to point to the eagerly awaited Adobe Acrobat fix that was released toda ...(more)...

2:13 PM (5 hours ago)

March black Tuesday overview, (Tue, Mar 10th)

from SANS Internet Storm Center, InfoCON: green

Overview of the March 2009 Microsoft patches and their status. # ...(more)...

9:02 AM (10 hours ago)

conspiracy fodder: pifts.exe, (Tue, Mar 10th)

from SANS Internet Storm Center, InfoCON: green

Several readers wrote in with samples of a file PIFTS.exe that seems to be related to a Norton updat ...(more)...

8:01 AM (11 hours ago)

Browser plug-ins, transparent proxies and same origin policies, (Tue, Mar 10th)

from SANS Internet Storm Center, InfoCON: green

First, just a quick reminder: Same origin policy is a way a browser keeps methods from being ...(more)...

6:51 PM (39 minutes ago)

TinyURL and security, (Tue, Mar 10th)

from SANS Internet Storm Center, InfoCON: green

Roseman wrote in with a pointer to a techrepublic blog that points out the well known danger to the ...(more)...

4:49 PM (2 hours ago)

Gmail Down; Outage Could Last 36 Hours for Some People

from PC World Latest Technology News

Gmail is having an outage on Tuesday that may not be fully fixed until late Wednesday.

4:49 PM (2 hours ago)

Lawmaker: New Cybersecurity Regulations Needed

from PC World Latest Technology News

The U.S. Congress should explore new cybersecurity regulations, a lawmaker says.

4:49 PM (2 hours ago)

Microsoft Patches Windows DNS, Kernel Flaws

from PC World Latest Technology News

Microsoft has fixed flaws in its Windows kernel, SChannel and DNS server software.

4:49 PM (2 hours ago)

Microsoft Patches Windows DNS, Kernel Flaws

from PC World Latest Technology News

Microsoft has fixed flaws in its Windows kernel, SChannel and DNS server software.

12:24 PM (7 hours ago)

Hackers Update Conficker Worm, Evade Countermeasures

from PC World Latest Technology News

Computers infected with the Conficker worm are being updated with a new variant that sidesteps an industry effort to sever the link between the worm and its hacker controllers.

12:24 PM (7 hours ago)

Internet Explorer 8: Security Features for Business

from PC World Latest Technology News

Microsoft hopes to return IE to its past glory with Internet Explorer 8.

10:24 AM (9 hours ago)

McAfee Funds E-crime Training in Europe, US

from PC World Latest Technology News

Security vendor McAfee will give grants to a European and a U.S. organization to better train law enforcement and legal...

Other News

2:02 PM (5 hours ago)

Scratch Lowers Resistance to Programming

from Wired Top Stories by Dylan Tweney

MIT Media Lab develops a new programming language called Scratch that makes it easy for kids to develop programs that interact with things in the real world.

7:00 PM (39 minutes ago)

Meet Mikogo: a New Online Collaboration Tool

from PC World Latest Technology News

So if you've ever had to work together with a phalanx of co-workers dispersed across time and space, you may have run into...

12:42 AM (19 hours ago)

HP Expands Virtual Storage Offerings

from PC World Latest Technology News

HP introduced new virtual storage arrays and software aimed at helping enterprises cut costs.