http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2009-10-16 23:40:20 - Threatpost Feed : Consumer Corporate In this episode, Ryan and Dennis discuss the Outlook Web Access phishing attacks, the huge Microsoft and Adobe patch releases and the massive scope of the botnet problem You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/151340.shtmlhttp://www.secuobs.com/revue/news/151340.shtml Secuobs.com : 2009-10-16 23:40:20 - Threatpost Feed - Corporate Oracle has announced plans to ship a Critical Patch Update CPU with fixes for at least 38 security vulnerabilities in a wide range of database and server products The most serious vulnerabilities affect Oracle Core RDBMS, Oracle JRockit and Oracle Network Authentication Read the Oracle advance notice oraclecom http://www.secuobs.com/revue/news/151339.shtmlhttp://www.secuobs.com/revue/news/151339.shtml Secuobs.com : 2009-10-16 19:25:00 - Threatpost Feed - Corporate By Sergey Golovanov Here are some technical details on the Outlook Web Access phishing scheme 1 The Spam According to our preliminary research, the spam emails which attacked OWA users, including Kaspersky, were sent using the pushdo botnet which is based on malware from the BackdoorWin32NewRes family These Trojans spread via spam, social networks in conjunction with the Koobface family and through hacked websites http://www.secuobs.com/revue/news/151266.shtmlhttp://www.secuobs.com/revue/news/151266.shtml Secuobs.com : 2009-10-16 19:25:00 - Threatpost Feed - Consumer Corporate Remember that Microsoft NET Framework Assistant add-on that Microsoft sneaked into Firefox without explicit permission from end users Well, the code in that add-on has a serious code execution vulnerability that exposes Firefox users to the browse and you're owned attacks that are typically used in drive-by malware downloads http://www.secuobs.com/revue/news/151265.shtmlhttp://www.secuobs.com/revue/news/151265.shtml Secuobs.com : 2009-10-15 19:01:02 - Threatpost Feed - Corporate Botnets have become a major problem in the last few years, with massive networks such as Storm, Nugache and others comprising hundreds of thousands of infected machines This video lays out the foundation of the problem and explains the efforts of researchers to take over the Torpig botnet http://www.secuobs.com/revue/news/150904.shtmlhttp://www.secuobs.com/revue/news/150904.shtml Secuobs.com : 2009-10-15 19:01:02 - Threatpost Feed - Consumer Corporate Computerworld's Gregg Keizer brings word that this week's record-setting batch of patches from Microsoft actually closed the book on the vexing ATL code library issues that first surfaced in July 2009 Keizer quotes Ryan Smith, one of the hackers credited with discovering the flaw, as saying that the latest Microsoft Office updates shut the door on the last big attack vector for the ATL vulnerability Read the full story computerworldcom http://www.secuobs.com/revue/news/150903.shtmlhttp://www.secuobs.com/revue/news/150903.shtml Secuobs.com : 2009-10-15 19:01:02 - Threatpost Feed - Corporate The attackers behind the Zeus Trojan have unleashed a new phishing scam that is specifically targeted at users of the popular corporate webmail tool Outlook Web Access The phishing emails include the recipient's actual email address and appear to be an update to the OWA application http://www.secuobs.com/revue/news/150902.shtmlhttp://www.secuobs.com/revue/news/150902.shtml Secuobs.com : 2009-10-15 19:01:02 - Threatpost Feed - Corporate In May, President Obama completed his long-awaited cyberspace policy review, concluding that cyberspace is a strategic asset that must be safeguarded from attack as a national security priority The president promised to appoint a permanent cyber czar who would coordinate the work of federal agencies charged with protecting us But since acting cyber-security czar Melissa Hathaway resigned in August, the post has been unfilled Why Read the full op-ed LA Times James D Zirin http://www.secuobs.com/revue/news/150901.shtmlhttp://www.secuobs.com/revue/news/150901.shtml Secuobs.com : 2009-10-15 19:01:02 - Threatpost Feed - Corporate Just 4pourcents of users of corporate systems abide by IT security policies, even when that system handles very sensitive private information according to an academic survey pdf that has revealed humans to be the main flaw in any security system Researchers at the University of Wisconsin-Madison and IT University, Copenhagen found that just 4pourcents of the people surveyed obey best practice rules for passwords The rest use the same passwords for different systems or use words that appear in the dictionary or write their passwords down on post-it notes beside the computer Read the full story out-lawcom http://www.secuobs.com/revue/news/150900.shtmlhttp://www.secuobs.com/revue/news/150900.shtml Secuobs.com : 2009-10-15 19:01:02 - Threatpost Feed - Consumer Corporate Since moving to a monthly schedule in October 2003, Microsoft has released about 400 security bulletins based on an informal count of releases in its bulletin archives The bulletins address about 745 vulnerabilities across almost every Microsoft product About 230, or more than half of the bulletins, addressed security vulnerabilities that were described by Microsoft as critical This definition is what Microsoft typically uses for vulnerabilities that allow attackers to take full administrative control of a system from a remote location Read the full story Jaikumar Vijayan Computerworld http://www.secuobs.com/revue/news/150899.shtmlhttp://www.secuobs.com/revue/news/150899.shtml Secuobs.com : 2009-10-14 21:00:44 - Threatpost Feed - Consumer Corporate Antispam vendors, browser makers and Internet service providers have been on the front lines in the battle to contain phishing attacks, but the cybercriminals behind phishing campaigns are getting savvy at defeating technologies and tricking victims into giving up their credentials and other data Read the full story SearchSecuritycom http://www.secuobs.com/revue/news/150518.shtmlhttp://www.secuobs.com/revue/news/150518.shtml Secuobs.com : 2009-10-14 21:00:44 - Threatpost Feed - Consumer Corporate By Jason Miller Microsoft has released 13 new security bulletins in the October 2009 version of Patch Tuesday Eight bulletins have a severity rating of Critical The remaining five security bulletins have a severity rating of Important For the first time, Windows 7 and Windows 2008 R2 are affected by security bulletins The sheer volume of bulletins and subsequent patches this month will likely give administrator fits http://www.secuobs.com/revue/news/150517.shtmlhttp://www.secuobs.com/revue/news/150517.shtml Secuobs.com : 2009-10-14 21:00:44 - Threatpost Feed - Consumer The parade of large-scale data losses is continuing unabated The latest incident involves an unencrypted Flash drive containing the personal information of more than 100,000 adult education students in Virginia http://www.secuobs.com/revue/news/150516.shtmlhttp://www.secuobs.com/revue/news/150516.shtml Secuobs.com : 2009-10-14 16:31:09 - Threatpost Feed - Consumer Corporate On the same day that Microsoft unleashed a torrent of 34 patches on its customer base, Adobe on Tuesday published patches for 29 vulnerabilities in its Acrobat and Reader products as part of its new quarterly patch release program http://www.secuobs.com/revue/news/150432.shtmlhttp://www.secuobs.com/revue/news/150432.shtml Secuobs.com : 2009-10-13 21:42:13 - Threatpost Feed - Corporate By Michael Molsner Today I got a 'Anti-virus notification message' from our mail server protected by kav4lms so naturally I was interested in what the content was Examining the quarantined mail on the server revealed some interesting details starting from the mail header itself http://www.secuobs.com/revue/news/150085.shtmlhttp://www.secuobs.com/revue/news/150085.shtml Secuobs.com : 2009-10-13 21:42:13 - Threatpost Feed - Consumer Corporate Microsoft today released its largest ever batch of Patch Tuesday updates to fix a whopping 34 security holes in a wide range of widely deployed software products The latest patch batch covers critical vulnerabilities in software products that are bundled with Microsoft's dominant Windows operating system Internet Explorer and Windows Media Player -- and several known security problems SMB v2 and FTP in IIS for which functioning exploit code has already been publicly released http://www.secuobs.com/revue/news/150084.shtmlhttp://www.secuobs.com/revue/news/150084.shtml Secuobs.com : 2009-10-13 16:58:28 - Threatpost Feed - Corporate Google is making a significant change in the way that it handles legitimate sites that have been compromised and are serving up malware The search giant announced Monday that it will now provide webmasters with specific examples of the malicious code that was used to compromise their sites http://www.secuobs.com/revue/news/149990.shtmlhttp://www.secuobs.com/revue/news/149990.shtml Secuobs.com : 2009-10-09 22:15:41 - Threatpost Feed - Consumer Corporate Google has shipped a new version of the Android open-source mobile phone platform to fix a pair of security flaws that could lead to denial-of-service attacks According to an advisory from oCERT, a group that handles vulnerability disclosure for open-source projects, the flaws could allow hackers to render Android-powered devices useless Here's a link to the oCERT advisory ocertorg http://www.secuobs.com/revue/news/149123.shtmlhttp://www.secuobs.com/revue/news/149123.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate Secureworks researcher Kevin Stevens has written a must-read article on the Pay-Per-Install business model PPI that is used primarily to spread spyware and malware The article discusses the way the affiliate system works, with layers of files and software programs that power the installation of malware on hijacked Windows computers http://www.secuobs.com/revue/news/149046.shtmlhttp://www.secuobs.com/revue/news/149046.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate Fake antivirus programs are multiplying at such a rate they could start to overwhelm the detection capabilities of signature-based scanners, the latest figures pdf from the Anti-Phishing Working Group APWG have hinted Rogue or bogus programs passing themselves off as real antivirus software have been one of the malware themes of 2009, but the APWG's numbers for the first half of the year show that the organisation's members detected 485,000 samples, more than five times the total for the whole of 2008 Read the full story Techworld John Dunn http://www.secuobs.com/revue/news/149045.shtmlhttp://www.secuobs.com/revue/news/149045.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Corporate A security research firm has issued a warning for a vulnerability in multiple VMware products that can be exploited by malicious people to cause a denial-of-service condition The vulnerability is caused due to an error in the VMware Authorization Service when processing login requests http://www.secuobs.com/revue/news/149044.shtmlhttp://www.secuobs.com/revue/news/149044.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Corporate In a feature article in USAToday, Byron Acohido writes about porous and difficult to defend workplace networks that provide a haven for professional cybercrimals Acohido writes Overly complex IT systems are producing endless opportunities for cyberthieves, who need only to master simple hacking techniques to get their hands on sensitive data The result Data breaches continue to plague companies, hospitals, universities and government agencies any entity that collects data and conducts business on a digital network Read the full story http://www.secuobs.com/revue/news/149043.shtmlhttp://www.secuobs.com/revue/news/149043.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate Adobe has confirmed a critical, unpatched vulnerability in its PDF Reader Acrobat software is being exploited by malicious attackers The vulnerability affects Adobe Reader and Acrobat 913 and earlier versions on Windows, Macintosh and UNIX Adobe described the in-the wild attacks as limited and targeted, suggesting PDF documents rigged with exploits are being attached to e-mails and sent to business targets http://www.secuobs.com/revue/news/149042.shtmlhttp://www.secuobs.com/revue/news/149042.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate Over on our sister site Viruslistcom, researchers Sergey Golovanov and Igor Soumenkov have published an article that studies a single spam e-mail and illustrates the methods used by cyber criminals to create botnets and conduct mass spam mailings The methods and techniques used are clearly illegal in nature and have a single aim to make cyber criminals rich Read the full story viruslistcom http://www.secuobs.com/revue/news/149041.shtmlhttp://www.secuobs.com/revue/news/149041.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate A recently discovered botnet has been caught siphoning ad revenue away from Google, Yahoo and Bing and funneling it to smaller networks According to researchers at Click Forensics, computers that are part of the so-called Bahama Botnet are infected with malware that sends them to counterfeit search pages instead of the real thing They look authentic, and with the help of DNS poisoning routines, they even display googlecom yahoocom or bingcom in the address bar Read the full story The Register Dan Goodin http://www.secuobs.com/revue/news/149040.shtmlhttp://www.secuobs.com/revue/news/149040.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate The massive phishing scam broken up by federal authorities this week is only a hint at what many say is an insidious and growing problem on the Internet The bust, dubbed Operation Phish Phry, was described by the FBI as the largest ever cyber-crime investigation and they held it up as a shining example of international cooperation in the realm of cybersecurity But as important and impressive as it was, the arrests barely scratch the surface of the phishing problem, according to several who have been tracking the issue for years Read the full story IDG News Service Jaikumar Vijayan http://www.secuobs.com/revue/news/149039.shtmlhttp://www.secuobs.com/revue/news/149039.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer Corporate Mozilla has packaged a suite of security-centric plugins to help Firefox users stay safe while surfing on the Internet The package, available here, includes NoScript, Better Privacy, AdBlock Plus and WOT Web of Trust Mozilla has also expanded its Plugin Check to help users identify and patch vulnerable Firefox add-ons http://www.secuobs.com/revue/news/149038.shtmlhttp://www.secuobs.com/revue/news/149038.shtml Secuobs.com : 2009-10-09 18:52:56 - Threatpost Feed - Consumer CNet's Elinor Mills has the scoop on a Comcast trial of a new automated service that will warn broadband customers of possible virus infections, if the computers are behaving as if they have been compromised by malware For instance, a significant overnight spike in traffic being sent from a particular Internet Protocol address could signal that a computer is infected with a virus taking control of the system and using it to send spam as part of a botnet Read the full story CNet Also see this call by a Google executive for ISPs to take the lead on botnet cleanup http://www.secuobs.com/revue/news/149037.shtmlhttp://www.secuobs.com/revue/news/149037.shtml Secuobs.com : 2009-10-09 03:08:57 - Threatpost Feed - Consumer Corporate Microsoft is planning a bumper Patch Tuesday next week -- 13 bulletins covering 34 security vulnerabilities in a wide range of products Eight of the 13 bulletins will be rated critical, Microsoft's highest severity rating According to Microsoft's advance notice, the patches coming on October 13 includes fixes for two serious issues that are well-known and already documented -- a code execution bug in SMB v2 and a gaping hole in FTP in IIS http://www.secuobs.com/revue/news/148825.shtmlhttp://www.secuobs.com/revue/news/148825.shtml Secuobs.com : 2009-10-08 19:01:53 - Threatpost Feed - Consumer Corporate The largest number of defendants ever charged in a cyber-crime case have been indicted in a multinational investigation conducted in the United States and Egypt that uncovered a sophisticated phishing operation that fraudulently collected personal information from thousands of victims that was used to defraud American banks Authorities in several United States cities arrested 33 of 53 defendants named in an indictment returned last week by a federal grand jury in Los Angeles Several defendants charged in the indictment are being sought this morning by law enforcement Additionally, authorities in Egypt have charged 47 defendants linked to the phishing scheme Read the full FBI statement fbigov http://www.secuobs.com/revue/news/148631.shtmlhttp://www.secuobs.com/revue/news/148631.shtml Secuobs.com : 2009-10-07 20:52:27 - Threatpost Feed - Consumer PayPal suspended the account of a white-hat hacker on Tuesday, a day after someone used his research into website authentication to publish a counterfeit certificate for the online payment processor Under the Acceptable Use Policy, PayPal may not be used to send or receive payments for items that show the personal information of third parties in violation of applicable law, company representatives wrote in an email sent to the hacker, Moxie Marlinspike Please understand that this is a security measure meant to help protect you and your account We apologize for any inconvenience Read the full story Dan Goodin The Register http://www.secuobs.com/revue/news/148311.shtmlhttp://www.secuobs.com/revue/news/148311.shtml Secuobs.com : 2009-10-07 03:09:10 - Threatpost Feed - Consumer Corporate Visa has announced new global best practices for data field encryption, also known as end-to-end encryption - a much-discussed solution in the wake of the Heartland Payment Systems breach Announced by the global credit card company on Monday, these best practices are designed to further the payment industry's efforts to develop a common, open standard while providing guidance to encryption vendors and early adopters Data field encryption protects card information from the swipe to the acquirer processor with no need for the merchant to process or transmit card data in the clear Read the full story govinfosecuritycom http://www.secuobs.com/revue/news/148103.shtmlhttp://www.secuobs.com/revue/news/148103.shtml Secuobs.com : 2009-10-06 23:24:57 - Threatpost Feed - Corporate In his keynote presentation at SecTor 2009, Chris Hoff of Cisco discusses the rise of public and private cloud services, as well as the threats to those platforms http://www.secuobs.com/revue/news/148036.shtmlhttp://www.secuobs.com/revue/news/148036.shtml Secuobs.com : 2009-10-06 23:24:57 - Threatpost Feed - Corporate TORONTO -- The frequency and scope of SQL injection attacks has exploded in the last year or two, with thousands of legitimate Web sites having been compromised and used to serve malware or further Web exploits That's the bad news The good news is that there are some remarkably effective techniques that security professionals can use to identify and recover from these attacks http://www.secuobs.com/revue/news/148035.shtmlhttp://www.secuobs.com/revue/news/148035.shtml Secuobs.com : 2009-10-06 23:24:57 - Threatpost Feed - Consumer A researcher who examined 10,000 Hotmail, MSN and Livecom passwords that were recently exposed online has published an analysis of the list and found that 123456 was the most commonly used password, appearing 64 times Read the full story Kim Zetter Wired Threat Level More from Dancho Danchev zdnetcom http://www.secuobs.com/revue/news/148034.shtmlhttp://www.secuobs.com/revue/news/148034.shtml Secuobs.com : 2009-10-06 23:24:57 - Threatpost Feed - Corporate TORONTO -- The legitimate economy may be in rough shape right now, but the same cannot be said for the underground economy Malware authors and botmasters are thriving, experts say, with some online criminals charging as much as 3,500 for their attack toolkits http://www.secuobs.com/revue/news/148033.shtmlhttp://www.secuobs.com/revue/news/148033.shtml Secuobs.com : 2009-10-06 16:43:44 - Threatpost Feed - Corporate By David Mortman Inspired by professional pastry chef Shuna Fish Lydon You do not know what a good, bad or indifferent baker pastry chef you are until you work alongside someone who is better worse than you This is not at all to say that if you are an outstanding home baker, you are deluding yourself But as far as professional cooking baking go, it is my experience that unless you push yourself really hard to stay away from your sweet spot comfort zone of I-Know-All-I-Need-To-Know-And-I-Feel-Very-Comfy-In-This-Job Kitchen-Thank-You-Very-Much, and move kitchens or chefs or hire people who are much closer to your level than you feel comfortable having them, you will become stagnant in your baking skill and knowledge http://www.secuobs.com/revue/news/147859.shtmlhttp://www.secuobs.com/revue/news/147859.shtml Secuobs.com : 2009-10-06 16:43:44 - Threatpost Feed - Consumer If you use Microsoft's free Hotmail service, it may be time to change your password Microsoft said Monday that several thousand Hotmail account credentials were posted online over the weekend In a statement posted to its Windows Live Spaces blog, Microsoft said the company has determined that the data spill was not the result of a breach of internal Microsoft data, but rather was likely the haul from a phishing scheme Read the full story washingtonpostcom http://www.secuobs.com/revue/news/147858.shtmlhttp://www.secuobs.com/revue/news/147858.shtml Secuobs.com : 2009-10-06 01:47:39 - Threatpost Feed - Consumer Corporate Security researchers tracking the URL Zone malware botnet have stumbled upon a new tactic being used by cyber-criminals to hide information on the money mules being used to transfer stolen funds from compromised online bank accounts URLZone, which targets computer users in Western Europe, is a botnet of approximately 6,000 hijacked computers that is used primarily to siphon funds from online bank accounts It steals between 4,000 and 15,000 from each compromised bank account and uses a nifty trick of modifying the withdrawn amount on the bank's web site to avoid detection by the user http://www.secuobs.com/revue/news/147667.shtmlhttp://www.secuobs.com/revue/news/147667.shtml Secuobs.com : 2009-10-05 18:44:26 - Threatpost Feed - Consumer The Register's Dan Goodin has news about a belated but significant move by Google to protect its GMail and other services from CSRF cross site request forgery attacks In recent days, Google's login pages began setting a cookie with a unique token on each user's browser That same value is also embedded into the login form If the two don't match, the user will be unable to log in Read the full article theregistercouk http://www.secuobs.com/revue/news/147537.shtmlhttp://www.secuobs.com/revue/news/147537.shtml Secuobs.com : 2009-10-05 18:44:26 - Threatpost Feed - Consumer Corporate According to a report by the Anti-Phishing Working Group APWG , the number of phishing incidents and rogue anti-malware programs also known as scareware are rising at an unprecedented rate The APWG says that around four fifths of the phishing attack websites claim to offer payment and financial services and in the first half of 2009, a total of more than 485,000 strains of scareware were found Approximately 22,000 a month were reported in January, rising to over 152,000 in June indicating a very strong upward trend Read the full story h-onlinecom See the full APWG report PDF from antiphishingorg http://www.secuobs.com/revue/news/147536.shtmlhttp://www.secuobs.com/revue/news/147536.shtml Secuobs.com : 2009-10-05 18:44:26 - Threatpost Feed - Consumer Corporate From ZDNet Larry Dignan Adobe s announcements that a full version of Flash is coming to every smartphone not named Apple iPhone leave me conflicted Full-blown Flash can be a boon to the mobile Web, but has the potential to become one huge security headache Read the full story zdnetcom http://www.secuobs.com/revue/news/147535.shtmlhttp://www.secuobs.com/revue/news/147535.shtml Secuobs.com : 2009-10-03 00:11:19 - Threatpost Feed - Consumer Corporate In this Dateline NBC video from 1999, experts, including an unnamed Chris Wysopal, then of the L0pht, now of Veracode, discuss the dangers of online banking and the use of Trojans to steal data Everything old is new again http://www.secuobs.com/revue/news/147002.shtmlhttp://www.secuobs.com/revue/news/147002.shtml Secuobs.com : 2009-10-02 18:38:28 - Threatpost Feed - Consumer Trend Micro researcher Rik Ferguson has discovered a new twist on the old social engineering attacks on Skype -- the use of usernames and monikers that appear very, very convincing In the latest attacks, which lure computer users to fake anti-virus sites rogueware , the attackers are using the username Online Notification in the Skype chat window http://www.secuobs.com/revue/news/146901.shtmlhttp://www.secuobs.com/revue/news/146901.shtml Secuobs.com : 2009-10-02 18:38:28 - Threatpost Feed - Consumer Corporate Google has pushed out a new version of its Chrome browser to fix a high-severity security hole that could lead to malicious code execution attacks The vulnerability could be exploited to run arbitrary code within the Google Chrome sandbox, the company said in an advisory http://www.secuobs.com/revue/news/146900.shtmlhttp://www.secuobs.com/revue/news/146900.shtml Secuobs.com : 2009-10-02 18:38:28 - Threatpost Feed - Corporate The Department of Homeland Security is planning a major hiring spree, looking to fill as many as 1,000 cybersecurity positions over the course of the next three years The department announced the new initiative Thursday, marking DHS's first real push to hire a large number of information security experts http://www.secuobs.com/revue/news/146899.shtmlhttp://www.secuobs.com/revue/news/146899.shtml Secuobs.com : 2009-10-01 22:55:42 - Threatpost Feed - Corporate From SearchSecuritycom Robert Westervelt Phishing websites and rogue antivirus programs increased precipitously in the first half of 2009, according to a new report issued by the Antiphishing Working Group The number of unique phishing websites reached a high of nearly 50,000 in June, the second highest on record since more than 55,000 phishing websites were recorded in April, 2007 Read the full story SearchSecuritycom http://www.secuobs.com/revue/news/146599.shtmlhttp://www.secuobs.com/revue/news/146599.shtml Secuobs.com : 2009-10-01 22:55:42 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - October 1, 2009 Dennis Fisher talks with Chris Hoff of Cisco about the challenges of cloud deployment and security, cloud use cases and the effect that disruptive technologies can have on enterprises, vendors and standards organizations You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/146598.shtmlhttp://www.secuobs.com/revue/news/146598.shtml Secuobs.com : 2009-10-01 22:55:42 - Threatpost Feed - Corporate Security expert Bruce Schneier discusses the problems and limitations of identification-based security, from driver's licenses to national ID cards and the REAL ID program http://www.secuobs.com/revue/news/146597.shtmlhttp://www.secuobs.com/revue/news/146597.shtml Secuobs.com : 2009-10-01 16:34:08 - Threatpost Feed - Corporate Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that's designed to enable site owners to protect against common Web-based attacks http://www.secuobs.com/revue/news/146464.shtmlhttp://www.secuobs.com/revue/news/146464.shtml Secuobs.com : 2009-09-30 20:39:52 - Threatpost Feed - Consumer Corporate Research in Motion RIM has shipped a fix for a serious security vulnerability that exposes BlackBerry users to phishing attacks The certificate handling vulnerability, which carries a CVSS severity score of 68, affects all versions of the BlackBerry device software http://www.secuobs.com/revue/news/146129.shtmlhttp://www.secuobs.com/revue/news/146129.shtml Secuobs.com : 2009-09-30 20:39:52 - Threatpost Feed - Consumer Corporate Security researchers have stumbled on a new botnet that uses an interesting technique to mask its nefarious intentions The Monkif DIKhora botnet, which is pushing out Trojan downloaders to infected machines, is encoding the instructions to appear as if the command-and-control server is returning a JPEG image file, according to SecureWorks researcher Jason Milletary Read the full story secureworkscom http://www.secuobs.com/revue/news/146128.shtmlhttp://www.secuobs.com/revue/news/146128.shtml Secuobs.com : 2009-09-30 20:39:52 - Threatpost Feed - Consumer Corporate Online criminal gangs have begun using special malware that enables them to hide the amount of money that they're stealing from victims' online banking accounts, helping them evade detection for longer periods of time and extend the effectiveness of their crime sprees http://www.secuobs.com/revue/news/146127.shtmlhttp://www.secuobs.com/revue/news/146127.shtml Secuobs.com : 2009-09-30 20:39:52 - Threatpost Feed - Corporate In the wake of Moxie Marlinspike's SSL talk at Black Hat this summer, another security researcher has used the technique described in the talk to create and publish a valid wildcard certificate and private key that could be used to fool browsers into believing a site is legitimate when it is in fact a fake http://www.secuobs.com/revue/news/146126.shtmlhttp://www.secuobs.com/revue/news/146126.shtml Secuobs.com : 2009-09-30 01:37:14 - Threatpost Feed - Corporate A team of computer scientists from several universities has devised an attack that is capable of reconstructing the so-called vanishing data objects created by a system called Vanish, which was designed to create secure data objects that would expire after a set time and could never be recreated http://www.secuobs.com/revue/news/145774.shtmlhttp://www.secuobs.com/revue/news/145774.shtml Secuobs.com : 2009-09-29 19:24:12 - Threatpost Feed - Corporate Large enterprises and consumers have been dealing with sophisticated phishing scams, online extortion plots and other assorted theft schemes for years, but now attackers are turning their attention to the huge population of small businesses and non-profits in the US And they are finding a gold mine http://www.secuobs.com/revue/news/145641.shtmlhttp://www.secuobs.com/revue/news/145641.shtml Secuobs.com : 2009-09-29 13:18:28 - Threatpost Feed - Corporate In the never-ending battle to protect computer networks from intruders, security experts are deploying a new defense modeled after one of nature s hardiest creatures -- the ant Unlike traditional security devices, which are static, these digital ants wander through computer networks looking for threats, such as computer worms -- self-replicating programs designed to steal information or facilitate unauthorized use of machines When a digital ant detects a threat, it doesn t take long for an army of ants to converge at that location, drawing the attention of human operators who step in to investigate Read the full story wfuedu http://www.secuobs.com/revue/news/145487.shtmlhttp://www.secuobs.com/revue/news/145487.shtml Secuobs.com : 2009-09-29 13:18:28 - Threatpost Feed - Consumer Corporate Cyber-criminals are using interest in MMS or SMS on the iPhone to trick users into downloading rogue antivirus software According to security company Websense, attackers are abusing Google's search engine to get users to click on links leading to a malicious page pushing scareware Read the full story eweekcom http://www.secuobs.com/revue/news/145486.shtmlhttp://www.secuobs.com/revue/news/145486.shtml Secuobs.com : 2009-09-29 13:18:28 - Threatpost Feed - Consumer Corporate Fully functional exploit code for the still unpatched Windows SMB v2 vulnerability has been released to the public domain via the freely available Metasploit point-and-click attack tool, raising the likelihood for remote in-the-wild code execution attacks The exploit, created and released by Harmony Security's Stephen Fewer, provides a clear roadmap for hackers to plant malware or open backdoors on Windows Vista Service Pack 1 and 2 as well as Windows 2008 SP1 server http://www.secuobs.com/revue/news/145485.shtmlhttp://www.secuobs.com/revue/news/145485.shtml Secuobs.com : 2009-09-29 00:37:34 - Threatpost Feed - Corporate Amit Yoran, CEO of NetWitness, is the former director of the National Cyber Security Division at the Department of Homeland Security and a longtime veteran of the security industry both inside and outside the Beltway He spoke with Dennis Fisher recently about the current power vacuum in Washington on security matters and the priorities for the next cyber security coordinator http://www.secuobs.com/revue/news/145312.shtmlhttp://www.secuobs.com/revue/news/145312.shtml Secuobs.com : 2009-09-28 21:26:47 - Threatpost Feed - Consumer Corporate The rash of attacks on social networking sites is continuing, this time in the form of a cross-site scripting worm that is currently plaguing Reddit, the popular social bookmarking portal The Reddit attack is interesting in that it requires a minimum of user interaction in order to spread http://www.secuobs.com/revue/news/145223.shtmlhttp://www.secuobs.com/revue/news/145223.shtml Secuobs.com : 2009-09-28 16:12:37 - Threatpost Feed - Corporate By Bruce Schneier In computer security, a lot of effort is spent on the authenticati on problem Whether it s passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated -- and hopefully more secure -- ways for you to prove you are who you say you are over the Internet http://www.secuobs.com/revue/news/145077.shtmlhttp://www.secuobs.com/revue/news/145077.shtml Secuobs.com : 2009-09-25 16:48:09 - Threatpost Feed - Consumer Corporate At the Virus Bulletin 2009 conference,Trend Micro security researcher Ivan Macalintal talks to Threatpost editor Ryan Naraine about the intricacies of the Koobface attack See more on this story here http://www.secuobs.com/revue/news/144483.shtmlhttp://www.secuobs.com/revue/news/144483.shtml Secuobs.com : 2009-09-25 16:48:09 - Threatpost Feed - Corporate DarkReading's Kelly Jackson Higgins is reporting on a new study that shows bot infections in the rise in the enterprise, most coming from tiny, unknown botnets built for targeting victim organizations The three-month study of more than 600 different botnets found having infiltrated enterprise networks, researchers from Damballa discovered nearly 60 percent are botnets with only a handful to a few hundred bots built to target a particular organization Only 5 percent of the bot infections were from big-name botnets, such as Zeus ZDbot and Koobface Read the full story darkreadingcom http://www.secuobs.com/revue/news/144482.shtmlhttp://www.secuobs.com/revue/news/144482.shtml Secuobs.com : 2009-09-25 16:48:09 - Threatpost Feed - Consumer Corporate On the heels of yet another Twitter phishing attack, Threatpost editor Ryan Naraine chats with Kaspersky Lab malware researcher Costin Raiu about a new Krab Krawler project that pinpoints signs of malicious activity on Twitter Raiu introduced the project at this year's Virus Bulletin conference http://www.secuobs.com/revue/news/144481.shtmlhttp://www.secuobs.com/revue/news/144481.shtml Secuobs.com : 2009-09-25 16:48:09 - Threatpost Feed - Consumer Corporate Brian Krebs' terrific reporting on the targeted malware attacks against small businesses in the US continues today with a closer look at the way money mules operate and their roles in the cybercrime operation In this article, Krebs interviews a money mule and shows the layers of online job recruitment, the sign-up process that includes bank account details and the way money is siphoned from stolen bank accounts and wired to international locations This is a must read article washingtonpostcom http://www.secuobs.com/revue/news/144480.shtmlhttp://www.secuobs.com/revue/news/144480.shtml Secuobs.com : 2009-09-25 16:48:09 - Threatpost Feed - Consumer Corporate GENEVA -- In a sign that cyber-criminals are investing more time and resources into attacks against Apple's Mac users, a new malware affiliate program has been discovered offering 43c for every infected Mac machine During an eye-opening presentation at the VB Conference 2009 conference here, Sophos Labs researcher Dmitry Samosseikko provided a glimpse into the Partnerka, a Russian network of spam and malware affiliates that have turned their attention to the Mac platform -- using social engineering tricks to load fake codecs and scareware programs http://www.secuobs.com/revue/news/144479.shtmlhttp://www.secuobs.com/revue/news/144479.shtml Secuobs.com : 2009-09-24 16:20:54 - Threatpost Feed - Consumer Corporate GENEVA -- The attacks and scams that have been affecting users of Facebook, Twitter and other popular social networking sites are continuing to evolve and improve, as the attackers learn more about their victims and refine their tactics, experts say http://www.secuobs.com/revue/news/144034.shtmlhttp://www.secuobs.com/revue/news/144034.shtml Secuobs.com : 2009-09-24 16:20:54 - Threatpost Feed - Consumer Corporate GENEVA -- A veteran security researcher today challenged the anti-malware industry to work on a standard way of assigning computer Internet threat levels to present transparent helpful information to consumers and businesses During a presentation at the Virus Bulletin 2009 conference here, Fortinet project manager Bryan Lu discussed the current scenario where anti-malware vendor use different systems to display threat levels -- either color-coded or using numbers and arrows -- and suggested that vendors use existing data to make threat level indicators more useful and meaningful http://www.secuobs.com/revue/news/144033.shtmlhttp://www.secuobs.com/revue/news/144033.shtml Secuobs.com : 2009-09-24 16:20:54 - Threatpost Feed - Consumer Corporate Google's decision to introduce a plug-in that runs Google Chrome inside Microsoft's Internet Explorer isn't sitting well with the folks at Redmond The Google Chrome Frame, which is presented as a seamless way to bring Google Chrome's open web technologies and speedy JavaScript engine to Internet Explorer, has increased the attack surface for IE users, Microsoft said today http://www.secuobs.com/revue/news/144032.shtmlhttp://www.secuobs.com/revue/news/144032.shtml Secuobs.com : 2009-09-24 13:00:10 - Threatpost Feed - Consumer From IDG News Service Robert McMillan Criminals flooded several online ad networks with malicious advertisements over the weekend, causing popular Web sites such as the Drudge Report, Horoscopecom and Lyricscom to inadvertently attack their readers, a security company said Wednesday The trouble started on Saturday, when the criminals somehow placed the malicious ads on networks managed by Google's DoubleClick, as well as two others YieldManager and ValueClick's Fastclick network Read the full story computerworldcom http://www.secuobs.com/revue/news/143973.shtmlhttp://www.secuobs.com/revue/news/143973.shtml Secuobs.com : 2009-09-24 13:00:10 - Threatpost Feed - Corporate Cisco has released a peck of patches to cover multiple security flaws in its flagship Cisco IOS originally Internetwork Operating System , warning that the bugs exposes businesses to denial-of-service or policy bypass attacks In all, the networking vendor released 10 advisories covering Cisco IOS flaws and a separate alert for a vulnerability in the Cisco Unified Communications Manager Read the Cisco advisory bundle ciscocom http://www.secuobs.com/revue/news/143972.shtmlhttp://www.secuobs.com/revue/news/143972.shtml Secuobs.com : 2009-09-24 00:29:43 - Threatpost Feed - Consumer Corporate Job candidates are willing in this market to give any information they can that would help them get a job, said Ellen B Vance, an HR consultant and auditor who advises companies on how to safeguard applicant and employee information The instinct is natural, but it can leave you vulnerable to identity theft Read the full story theladderscom http://www.secuobs.com/revue/news/143799.shtmlhttp://www.secuobs.com/revue/news/143799.shtml Secuobs.com : 2009-09-24 00:29:43 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - September 23, 2009 Dennis Fisher talks with Stefan Tanase, senior security researcher at Kaspersky Lab, live from Virus Bulletin 2009 about the threats on social networking sites and the privacy and security concerns presented by Web 20 technologies You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/143798.shtmlhttp://www.secuobs.com/revue/news/143798.shtml Secuobs.com : 2009-09-23 21:31:58 - Threatpost Feed - Consumer An ongoing attack on Google users is sending victims to rogue anti-virus software sites, researchers said this week The attack takes advantage of Google's page-ranking feature, according to researchers at eSoft's Threat Prevention Team The scam works like this An attacker hacks a site, but instead of embedding exploits on the hacked site, they put links to other websites to boost rankings for malicious sites, and Google users in particular seem to be the targets Read the full story scmagazineuscom http://www.secuobs.com/revue/news/143734.shtmlhttp://www.secuobs.com/revue/news/143734.shtml Secuobs.com : 2009-09-23 21:31:58 - Threatpost Feed - Consumer GENEVA -- Cyber crime gangs in China are penetrating the hard disk recovery cards on computers in Internet cafes and using a combination of zero-day flaws, rootkits and ARP spoofing techniques to steal billions of dollars worth of online gaming credentials According to Microsoft anti-virus researcher Chun Feng, five generations of the Win32 Dogrobot malware family have perfected the novel rootkit technique to hijack System Restore on Windows effectively allowing the malicious file to survive even after the compromised machine is reverted to its previous clean state http://www.secuobs.com/revue/news/143733.shtmlhttp://www.secuobs.com/revue/news/143733.shtml Secuobs.com : 2009-09-23 17:26:37 - Threatpost Feed - Corporate GENEVA -- A more comprehensive and serious level of cooperation among industry leaders is needed to help stop the scourge of malicious Web ads and botnets that result from the infected PCs, a top Google executive said Wednesday http://www.secuobs.com/revue/news/143588.shtmlhttp://www.secuobs.com/revue/news/143588.shtml Secuobs.com : 2009-09-23 17:26:37 - Threatpost Feed - Consumer Corporate GENEVA -- The critical MS08-067 vulnerability used by the Conficker worm to build a powerful botnet continues to be a lucrative security hole for cybercriminals During a presentation at the Virus Bulletin 2009 conference here, a trio of Microsoft researchers dissected the malware attacks linked to MS08-067 and found that criminal gangs are still exploiting the flaw to plant data-theft Trojans on vulnerable Windows machines http://www.secuobs.com/revue/news/143587.shtmlhttp://www.secuobs.com/revue/news/143587.shtml Secuobs.com : 2009-09-23 07:34:51 - Threatpost Feed - Consumer Corporate Apple has shipped iTunes 901to fix a critical security hole that puts Mac and Windows users at risk of computer takeover attacks The vulnerability could be used by hackers to launch code execution attacks via booby-trapped pls files, Apple warned in an advisory http://www.secuobs.com/revue/news/143458.shtmlhttp://www.secuobs.com/revue/news/143458.shtml Secuobs.com : 2009-09-23 07:34:51 - Threatpost Feed - Consumer From PC Mag Larry Seltzer Just when we were getting the point across that you need to be careful about what links you click on, along comes the new phenomenon of shortened links through redirection services, making it that much harder to be careful There are products and services that can help though The success of these services has been driven mostly by Twitter, whose 140 character limit on posts makes it important for links to be as short as possible The fact remains that when you click on a shortened link you don't know where you will end up Read the full story pcmagcom http://www.secuobs.com/revue/news/143457.shtmlhttp://www.secuobs.com/revue/news/143457.shtml Secuobs.com : 2009-09-21 18:58:43 - Threatpost Feed - Corporate There are security conferences, and then there is Virus Bulletin While virtually all of the presentations are from researchers working at antimalware vendors and other security companies, the talks are quite technical and this year's conference, which starts Wednesday in Geneva, Switzerland, features one most interesting speaker Eric Davis of Google http://www.secuobs.com/revue/news/142875.shtmlhttp://www.secuobs.com/revue/news/142875.shtml Secuobs.com : 2009-09-18 23:36:32 - Threatpost Feed - Consumer Some sections of the popular PBSorg Web site have been hijacked by hackers serving up a cocktail of dangerous exploits According to researchers at Purewire, attempts to access certain PBS Web site pages yielded JavaScript that serves exploits from a malicious domain via an iframe http://www.secuobs.com/revue/news/142370.shtmlhttp://www.secuobs.com/revue/news/142370.shtml Secuobs.com : 2009-09-18 23:36:32 - Threatpost Feed - Consumer Corporate A new botnet, codenamed the 'Bahama' botnet has been linked to the recent surge in click-fraud and scareware attacks This video by researchers at Click Forensics shows the Bahama Botnet in action More on this botnet in this report http://www.secuobs.com/revue/news/142369.shtmlhttp://www.secuobs.com/revue/news/142369.shtml Secuobs.com : 2009-09-18 23:36:32 - Threatpost Feed - Consumer Corporate Less than a week after a malicious advertising attack against the New York Times ad servers, Microsoft filed five civil lawsuits against companies allegedly using online advertising to serve malware The lawsuits allege that individuals using the business names Soft Solutions, Direct Ad, qiweroqwcom, ITmeter INC and ote2008info used malvertisements to distribute malicious software or present deceptive websites that peddled scareware to unsuspecting Internet users http://www.secuobs.com/revue/news/142368.shtmlhttp://www.secuobs.com/revue/news/142368.shtml Secuobs.com : 2009-09-18 23:36:32 - Threatpost Feed - Consumer Corporate With exploit code in circulation and facing a race against time to fix the SMB v2 vulnerability haunting Windows Vista and Windows Server 2008, Microsoft today shipped a one-click fix-it workaround to help users avoid malicious hacker attacks http://www.secuobs.com/revue/news/142367.shtmlhttp://www.secuobs.com/revue/news/142367.shtml Secuobs.com : 2009-09-18 00:03:23 - Threatpost Feed - Consumer Corporate Mozilla's move to nudge Firefox users into updating the browser's Flash Player plug-in has been a phenomenal success with about 10 million users clicking through to the Web page with Adobe's patch Mozilla released some brief statistics to track the success of its new program, which serves up a visual warning to Firefox users if their version of the ever-present Adobe Flash Player plug-in is out of date The program started last week with the releases of Firefox 353 and Firefox 3014 http://www.secuobs.com/revue/news/142008.shtmlhttp://www.secuobs.com/revue/news/142008.shtml Secuobs.com : 2009-09-17 06:38:28 - Threatpost Feed - Consumer Corporate Locked in a cat-and-mouse game with spammers who use bots to defeat anti-fraud mechanisms and create fake accounts, Google today announced a deal to acquire reCAPTCHA, a company that provides those squiggly words at login screens The ReCAPTCHA deal isn t exactly a security transaction Strategically, it gives Google an excellent crowd-sourcing tool to beef up its already impressive machine-vision algorithms think book-scanning and maps but, in the long run, the ability to use CAPTCHAs that are near-impossible for bots to decipher allows Google to raise the bar significantly in the fight against bots and spam http://www.secuobs.com/revue/news/141737.shtmlhttp://www.secuobs.com/revue/news/141737.shtml Secuobs.com : 2009-09-16 19:11:20 - Threatpost Feed - Consumer Corporate Over on the Washington Post's SecurityFix blog, Brian Krebs has been doing a phenomenal job highlighting the online bank robberies -- using malware -- against small businesses in the United States The latest installment, which looks at the role of money mules in the cybercrime operation is required reading http://www.secuobs.com/revue/news/141535.shtmlhttp://www.secuobs.com/revue/news/141535.shtml Secuobs.com : 2009-09-16 19:11:20 - Threatpost Feed - Corporate Microsoft's Security Development Lifecycle SDL team has released two new security tools to help developers test and verify the security of software programs The tools -- BinScope Binary Analyzer and MiniFuzz File Fuzzer -- are available for download at no cost http://www.secuobs.com/revue/news/141534.shtmlhttp://www.secuobs.com/revue/news/141534.shtml Secuobs.com : 2009-09-16 01:58:58 - Threatpost Feed - Consumer Corporate The Web is a dirty, hostile place not fit for use by most decent people, a place where even many seemingly legitimate sites are infested with malware, password-stealing Trojans and all manner of other nasty applications And it's getting worse by the minute, according to a new threat report from Websense http://www.secuobs.com/revue/news/141255.shtmlhttp://www.secuobs.com/revue/news/141255.shtml Secuobs.com : 2009-09-15 20:54:28 - Threatpost Feed - Corporate This video demonstrates the ease with which an attacker can create a root shell on a Linux machine using a backdoor Trojan and a Metasploit payload Via SecurityTube http://www.secuobs.com/revue/news/141149.shtmlhttp://www.secuobs.com/revue/news/141149.shtml Secuobs.com : 2009-09-15 20:54:28 - Threatpost Feed - Corporate Media sites, including the New York Times, have become the latest targets of attackers who make their living by poisoning online ads and redirecting unsuspecting visitors to malicious Web pages or trying to trick them into downloading malware http://www.secuobs.com/revue/news/141148.shtmlhttp://www.secuobs.com/revue/news/141148.shtml Secuobs.com : 2009-09-15 20:54:28 - Threatpost Feed - Corporate From The New York Times Riva Richmond Corporate information technology departments are prioritizing the wrong threats to their computer systems, focusing on old problems and leaving their companies open to a raft of new cyberattacks targeting sensitive customer and corporate information That is the finding of a new biannual report from the SANS Institute, a training organization for computer security professionals, whose senior staff weighed two sets of data that have not been rigorously compared to date data on the most common attacks hitting corporate networks and data on which vulnerabilities are most prevalent on company networks Read the full story nytimescom Read the full report sansorg http://www.secuobs.com/revue/news/141147.shtmlhttp://www.secuobs.com/revue/news/141147.shtml Secuobs.com : 2009-09-15 14:47:15 - Threatpost Feed - Consumer Corporate Four months after it modified Windows 7 to stop the Conficker worm from spreading through infected flash drives, Microsoft has ported the changes to older operating systems, including Windows XP and Vista Read the full story computerworldcom http://www.secuobs.com/revue/news/140997.shtmlhttp://www.secuobs.com/revue/news/140997.shtml Secuobs.com : 2009-09-14 21:41:42 - Threatpost Feed - Corporate From The H Security A network of hijacked Linux servers is apparently being used to distribute malicious software to Windows PCs According to an analysis by web developer Denis Sinegubko, the comprised systems all have one thing in common the light weight web server nginx is running and serving content through port 8080 Otherwise, these systems are inconspicuous and appear to operate quite normally This new tactic was discovered when links to malware posted in China were replaced by dynamic DNS names from DynDNScom and No-IPcom Read the full story The H Security http://www.secuobs.com/revue/news/140769.shtmlhttp://www.secuobs.com/revue/news/140769.shtml Secuobs.com : 2009-09-14 21:41:42 - Threatpost Feed - Consumer Corporate For about 24 hours over the weekend, The New York Times site was serving up fake security software scareware In a message posted to Twitter and a note on its NYTimescom site, the newspaper blamed a rogue advertisement for the malware blast http://www.secuobs.com/revue/news/140768.shtmlhttp://www.secuobs.com/revue/news/140768.shtml Secuobs.com : 2009-09-14 21:41:42 - Threatpost Feed - Consumer Corporate LiveLeak has posted surveillance video footage from earlier this month of a guy in Brazil installing a skimming device onto a bank ATM The second half of the tape shows him being arrested and officials revealing the device Via Consumerist http://www.secuobs.com/revue/news/140767.shtmlhttp://www.secuobs.com/revue/news/140767.shtml Secuobs.com : 2009-09-14 21:41:42 - Threatpost Feed - Corporate Hackers today broke into a server belonging to a New Zealand Web hosting company and defaced a number of high-profile sites, including those belonging to Microsoft, Coca-Cola, Sony and Xerox http://www.secuobs.com/revue/news/140766.shtmlhttp://www.secuobs.com/revue/news/140766.shtml Secuobs.com : 2009-09-12 01:09:05 - Threatpost Feed - None Threatpost editors Ryan Naraine and Dennis Fisher talk about the huge week that was for Apple security, the non-working iPhone phishing filter, the SMB2 flaw and whether sites like YouTube should help push Adobe Flash security updates You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/140232.shtmlhttp://www.secuobs.com/revue/news/140232.shtml Secuobs.com : 2009-09-11 19:27:45 - Threatpost Feed - Consumer Corporate Apple's boast that iPhone OS 30 contains an anti-phishing feature is false, according to a security researcher ZScaler's Michael Sutton says the Fraud Warning option in the security section of iPhone's Safari settings, which is on by default, simply doesn't work http://www.secuobs.com/revue/news/140106.shtmlhttp://www.secuobs.com/revue/news/140106.shtml Secuobs.com : 2009-09-11 19:27:45 - Threatpost Feed - Corporate From The Washington Post Brian Krebs Finding the notorious Clampi banking Trojan on a computer inside your network is a little like spotting a single termite crawling into a crack in the wall Chances are, the unwelcome little intruder is part of a much larger infestation At least, that's the story told by two businesses which recently discovered Clampi infections, compromises that handed organized cyber gangs the access they needed to steal tens of thousands of dollarsRead the full story Washington Post http://www.secuobs.com/revue/news/140105.shtmlhttp://www.secuobs.com/revue/news/140105.shtml Secuobs.com : 2009-09-11 01:47:11 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - September 10, 2009 Dennis Fisher talks with Stephen Toulouse, director of policy and enforcement for Xbox Live at Microsoft, about his years at the Microsoft Security Response Center, the evolution of security at Microsoft and the joy and pain of being the bad guy on Xbox Live You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/139846.shtmlhttp://www.secuobs.com/revue/news/139846.shtml Secuobs.com : 2009-09-11 01:47:11 - Threatpost Feed - Consumer Corporate Apple today shipped another Mac OS X mega-update with fixes for at least 33 serious security problems affecting Mac OS X users The update includes patches for third party components like Adobe s Flash Player plug-in, Clam AV, MySQL and PHP A separate update was released for Snow Leopard to fix the issue where a vulnerable version of Flash Player was included with the new operating system Read the full story zdnetcom http://www.secuobs.com/revue/news/139845.shtmlhttp://www.secuobs.com/revue/news/139845.shtml Secuobs.com : 2009-09-10 20:52:52 - Threatpost Feed - Consumer Corporate From The Last Watchdog Byron Acohido A strong dose of déjà vu enshrouds the heightened security advisory Microsoft issued today about the newly-disclosed SMB2 zero-day vulnerability in the Windows Vista and Windows Server 2008 operating systems It was one year ago today September 2008 that Chinese malware brokers were spotted selling a 37 tool kit that allowed anyone to exploit a newly-disclosed RPC-DCOM vulnerability in Windows XP and Windows Server 2000 Read the full story The Last Watchdog http://www.secuobs.com/revue/news/139720.shtmlhttp://www.secuobs.com/revue/news/139720.shtml Secuobs.com : 2009-09-10 03:45:37 - Threatpost Feed - Consumer Corporate Apple has released security patches to cover serious security vulnerabilities in its iPhone, iPod Touch and QuickTime products The most serious of the vulnerabilities could lead to remote code execution attacks that give malicious hackers an easy way to hijack computers and mobile devices Read the full story for details on these vulnerabilities zdnetcom http://www.secuobs.com/revue/news/139451.shtmlhttp://www.secuobs.com/revue/news/139451.shtml Secuobs.com : 2009-09-10 03:45:37 - Threatpost Feed - Consumer Corporate Mozilla has released a new version of its flagship Firefox browser to fix 10 vulnerabilities that put Web surfers at risk of code execution attacks The Firefox 353 update -- available for Windows, Mac and Linux users -- patches security holes that could allow drive-by download attacks if a user simply surfs to a booby-trapped Web site http://www.secuobs.com/revue/news/139450.shtmlhttp://www.secuobs.com/revue/news/139450.shtml Secuobs.com : 2009-09-09 21:59:19 - Threatpost Feed - Consumer DarkReading is reporting on the launch of a new experimental service set up to detect spam and threats on the popular Twitter microblogging service The experiment, called TwiGUARD, lets Twitter users check if a follower is a spammer or if a link embedded in a tweet is malicious http://www.secuobs.com/revue/news/139320.shtmlhttp://www.secuobs.com/revue/news/139320.shtml Secuobs.com : 2009-09-09 21:59:19 - Threatpost Feed - Consumer Corporate The last couple of years have seen a dramatic rise in the number and quality of malware-as-a-service and hacking-as-a-service providers, with many of them advertising their services on the Web And while law enforcement officials are well aware of the problem, they're not having much luck in finding or prosecuting the criminals behind the schemes http://www.secuobs.com/revue/news/139319.shtmlhttp://www.secuobs.com/revue/news/139319.shtml Secuobs.com : 2009-09-09 21:59:19 - Threatpost Feed - Consumer Corporate Microsoft has issued a formal security advisory to confirm the remote reboot flaw in its implementation of the SMB2 protocol, going a step further to warn that a successful attack could lead to remote code execution and full system takeover http://www.secuobs.com/revue/news/139318.shtmlhttp://www.secuobs.com/revue/news/139318.shtml Secuobs.com : 2009-09-08 22:54:13 - Threatpost Feed - Consumer Corporate Both Adobe and Oracle have delayed planned October releases of security updates for their products Oracle's reason for delaying its patch day is the OpenWorld 2009 Oracle conference taking place from 11th to 15th October, which generally attracts large numbers of administrators responsible for Oracle installations Adobe cites the vulnerabilities in Microsoft's Active Template Library ATL , which affected multiple products, as its reasons for delaying its quarterly patch cycle, introduced just this spring Read the full story h-onlinecom http://www.secuobs.com/revue/news/138844.shtmlhttp://www.secuobs.com/revue/news/138844.shtml Secuobs.com : 2009-09-08 22:54:13 - Threatpost Feed - Corporate Vendors are finally releasing patches today for the TCP vulnerabilities first publicized nearly a year ago that affect a huge range of networking products, including any device running a version of Cisco's IOS software, and a number of Microsoft server and desktop operating systems Both Microsoft and Cisco released fixes for the vulnerabilities on Tuesday http://www.secuobs.com/revue/news/138843.shtmlhttp://www.secuobs.com/revue/news/138843.shtml Secuobs.com : 2009-09-08 22:54:13 - Threatpost Feed - Consumer Corporate Microsoft today released a peck of patches to cover at least seven documented worm holes in the Windows operating system The most serious of the vulnerabilities addresses could lead to remote code execution complete system takeover attacks The September batch of patches does not address the FTP in IIS vulnerability that is currently being exploited in the wild http://www.secuobs.com/revue/news/138842.shtmlhttp://www.secuobs.com/revue/news/138842.shtml Secuobs.com : 2009-09-08 22:54:13 - Threatpost Feed - Consumer Corporate A worm is circulating that can post malware and spam to some WordPress blogs using outdated versions of the blogging software, according to a post by Matt Mullenweg, founding developer of WordPress The worm can be tough to catch, as Mullenweg explains It registers a user, uses a security bug fixed earlier in the year to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts Read the full story zdnetcom http://www.secuobs.com/revue/news/138841.shtmlhttp://www.secuobs.com/revue/news/138841.shtml Secuobs.com : 2009-09-08 17:07:53 - Threatpost Feed - Consumer Corporate Researchers have found a new vulnerability in the SMB2 protocol in Windows Vista and Windows 7 that enables an attacker to remotely crash vulnerable machines There is proof-of-concept exploit available for the vulnerability, as well http://www.secuobs.com/revue/news/138731.shtmlhttp://www.secuobs.com/revue/news/138731.shtml Secuobs.com : 2009-09-08 17:07:53 - Threatpost Feed - Consumer Starting with the upcoming releases of Firefox 353 and Firefox 3014, Mozilla will warn users if their version of the popular Adobe Flash Player plug-in is out of date, according to Mozilla Human Shield Johnathan Nightingale Once the browser is updated, Mozilla will present the user with a visual notice on its first-run Web site that the Flash Player plugin contains security and stability vulnerabilities http://www.secuobs.com/revue/news/138730.shtmlhttp://www.secuobs.com/revue/news/138730.shtml Secuobs.com : 2009-09-05 06:27:47 - Threatpost Feed - None Threatpost editors Dennis Fisher and Ryan Naraine discuss the Apache attack and response, Microsoft Patch Tuesday and the bizarre reasons behind Adobe and Oracle delaying their regular patch releases You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/138125.shtmlhttp://www.secuobs.com/revue/news/138125.shtml Secuobs.com : 2009-09-05 06:27:47 - Threatpost Feed - Consumer From The Register John Leyden A US woman has been stung for 4,000 via a fraudulent Facebook friend in peril scam Jayne Scherrman, a pediatric dentist from Cape Girardeau, Missouri, wired the money via Western Union to what she thought was her friend Grace Parry in response to requests for help via Facebook The messages claimed that Grace and her husband had lost everything after being robbed while on holiday in London and requested 600 in order to resolve their difficulties Read the full story theregistercouk http://www.secuobs.com/revue/news/138124.shtmlhttp://www.secuobs.com/revue/news/138124.shtml Secuobs.com : 2009-09-04 18:57:37 - Threatpost Feed - Corporate Less than a week after the publication of exploit code for a gaping hole in the FTP Service in Microsoft Internet Information Services IIS , attackers are launching what is described as limited attacks against Windows users Microsoft has updated its security advisory to warn of the new attacks and added new mitigation workarounds for business running IIS 50, 51, and 60 http://www.secuobs.com/revue/news/137953.shtmlhttp://www.secuobs.com/revue/news/137953.shtml Secuobs.com : 2009-09-04 06:29:33 - Threatpost Feed - Corporate From IDG News Service Robert McMillan Amazon and Microsoft have been pushing cloud-computing services as a low-cost way to outsource raw computing power, but the products may introduce new security problems that have yet to be fully explored, according to researchers at the University of California, San Diego, and the Massachusetts Institute of Technology In experiments pdf with Amazon's EC2 they showed that they could pull off some very basic versions of what are known as side-channel attacks A side-channel attacker looks at indirect information related to the computer -- the electromagnetic emanations from screens or keyboards, for example -- to determine what is going on in the machine Read the full story computerworldcom http://www.secuobs.com/revue/news/137778.shtmlhttp://www.secuobs.com/revue/news/137778.shtml Secuobs.com : 2009-09-03 23:29:40 - Threatpost Feed - Corporate The Apache Software Foundation last week was the victim of a serious network attack in which a number of its Web servers and other machines were compromised by attackers who were able to gain root privileges and jump from machine to machine The incident was embarrassing and a serious problem for the foundation, but instead of making excuses and hiding behind the veil of confidentiality, Apache officials have published the gory details of the attack http://www.secuobs.com/revue/news/137662.shtmlhttp://www.secuobs.com/revue/news/137662.shtml Secuobs.com : 2009-09-03 23:29:40 - Threatpost Feed - Consumer Corporate The Opera Web browser has undergone a minor security makeover with one significant improvement -- the ability to update itself when patches are released The latest browser update will, by default, notify the user about available updates in very much the same way Mozilla Firefox handles automatic patching The update also includes several security fixes See the Opera changelog operacom http://www.secuobs.com/revue/news/137661.shtmlhttp://www.secuobs.com/revue/news/137661.shtml Secuobs.com : 2009-09-03 23:29:40 - Threatpost Feed - Consumer Corporate Apple today released a new version of Java for Mac to plug a total of 15 documented security vulnerabilities that could lead to remote code execution attacks via rigged Web pages The Java for Mac OS X 105 Update 5 includes patches for security holes covered by Sun Microsystems last month http://www.secuobs.com/revue/news/137660.shtmlhttp://www.secuobs.com/revue/news/137660.shtml Secuobs.com : 2009-09-03 23:29:40 - Threatpost Feed - Consumer Corporate Microsoft's September batch of security updates will include fixes for a multiple critical vulnerabilities affecting the Windows operating system In all, the software maker will release six bulletins with patches for a range of flaws that could expose users to remote code execution attacks http://www.secuobs.com/revue/news/137659.shtmlhttp://www.secuobs.com/revue/news/137659.shtml Secuobs.com : 2009-09-03 17:12:46 - Threatpost Feed - Consumer Corporate The group of hackers alleged to have broken into the networks of a string of companies, including TJX, Hannaford and Heartland Payment Systems, were in no hurry once they worked their way into the companies' systems In fact, they had plenty of time to do their dirty work, in some cases sitting inside the networks and stealing data for as long as a year http://www.secuobs.com/revue/news/137503.shtmlhttp://www.secuobs.com/revue/news/137503.shtml Secuobs.com : 2009-09-02 23:08:36 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - September 2, 2009 In this episode Dennis Fisher talks with Alex Howard, associate editor of Searchcompliancecom, about the burden compliance places on security staffs, the growing tide of breach notification laws and the misunderstandings surrounding the Rockefeller bill and the Internet kill switch You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/137133.shtmlhttp://www.secuobs.com/revue/news/137133.shtml Secuobs.com : 2009-09-02 23:08:36 - Threatpost Feed - Consumer Corporate Apple's newest operating system, Snow Leopard, is due later this week, and much of the talk surrounding the OS centers on its security Apple has added a limited anti-malware feature to Snow Leopard and security experts have said they expect the latest iteration of OS X to be more secure than previous versions http://www.secuobs.com/revue/news/137132.shtmlhttp://www.secuobs.com/revue/news/137132.shtml Secuobs.com : 2009-09-02 23:08:36 - Threatpost Feed - Consumer First Twitter and now Facebook A researcher today began a round of daily disclosures of serious vulnerabilities in popular Facebook applications According to a Dark Reading report, the researcher who goes by name theharmonyguy, plans to disclose multiple cross-site scripting XSS flaws he discovered in various third-party Facebook applications this month, though he may not do so every day He says he found major security holes in several of Facebook's top 10 most popular applications Read the full story darkreadingcom More information here theharmonyguycom http://www.secuobs.com/revue/news/137131.shtmlhttp://www.secuobs.com/revue/news/137131.shtml Secuobs.com : 2009-09-02 17:04:23 - Threatpost Feed - Corporate There is an unpatched flaw in Microsoft SQL Server that could enable an attacker to access users' passwords on the database server The vulnerability is in SQL Server 2000, 2005 and 2008 http://www.secuobs.com/revue/news/137006.shtmlhttp://www.secuobs.com/revue/news/137006.shtml Secuobs.com : 2009-09-02 17:04:23 - Threatpost Feed - Corporate Spam costs organizations 712 per employee per year, according a study by to Nucleus Research However, these staggering numbers don't even take into consideration one of spam's latest victims enterprise mobile users Spam targeted at smart phones is on the rise and becoming a growing security and productivity concern Read the full story computerworldcom http://www.secuobs.com/revue/news/137005.shtmlhttp://www.secuobs.com/revue/news/137005.shtml Secuobs.com : 2009-09-02 10:57:31 - Threatpost Feed - Corporate Microsoft late Tuesday confirmed the publication of exploit code for a serious code execution vulnerability in the File Transfer Protocol FTP Service in Microsoft Internet Information Services IIS 50, 51, and 60 A security advisory from Redmond warned that the vulnerability could allow remote code execution on affected systems running the FTP service and connected to the Internet Read the advisory microsoftcom See workaround information on the SR D blog technetcom http://www.secuobs.com/revue/news/136904.shtmlhttp://www.secuobs.com/revue/news/136904.shtml Secuobs.com : 2009-09-01 22:22:12 - Threatpost Feed - Consumer Microsoft plans to force a mandatory Windows Live Messenger upgrade later this month to fix a security vulnerability that could lead to remote code execution attacks The vulnerability, caused by an extra character in the Microsoft Active Template Library ATL , affects users of Windows Live Messenger 81 and 85 http://www.secuobs.com/revue/news/136660.shtmlhttp://www.secuobs.com/revue/news/136660.shtml Secuobs.com : 2009-09-01 16:18:14 - Threatpost Feed - Corporate There is exploit code circulating for a newly discovered vulnerability in the FTP service of Microsoft IIS, a flaw which could enable an attacker to run his own code on a remote server The flaw mainly affects older versions of IIS, Microsoft's Web server product, but the existence of a working exploit and the popularity of IIS make the vulnerability a serious concern http://www.secuobs.com/revue/news/136539.shtmlhttp://www.secuobs.com/revue/news/136539.shtml Secuobs.com : 2009-08-31 22:33:58 - Threatpost Feed - Corporate The powers that be in Washington are not known for getting things done quickly, and the current power vacuum in information security in the capital is a painful case in point The well-documented failure to find a coordinator to oversee security for the country is only one piece of the puzzle, and as time continues to pass with no help on the horizon, those in the know are growing increasingly restless and discouraged by the process http://www.secuobs.com/revue/news/136289.shtmlhttp://www.secuobs.com/revue/news/136289.shtml Secuobs.com : 2009-08-29 00:43:53 - Threatpost Feed - Corporate Officials at MicroSolved, the security services company that was involved in the penetration test that set off concerns about malware-infected CDs being sent to credit unions, have posted a detailed explanation of the technique and how it turned into a national news story http://www.secuobs.com/revue/news/135744.shtmlhttp://www.secuobs.com/revue/news/135744.shtml Secuobs.com : 2009-08-28 19:22:50 - Threatpost Feed - Consumer The built-in malware protection in Apple's Snow Leopard upgrade appears to be nothing more than a XProtectplist file containing five signatures for two of the most popular Mac OS X trojans -- OSXRSPlug and OSXIservice Read the full story zdnetcom http://www.secuobs.com/revue/news/135653.shtmlhttp://www.secuobs.com/revue/news/135653.shtml Secuobs.com : 2009-08-28 19:22:50 - Threatpost Feed - Corporate The main site of the Apache Software Foundation was compromised on Friday through an attack using a compromised SSH key, leading to concerns about the integrity of copies of the hugely popular Apache Web server, which is distributed through the Apacheorg site http://www.secuobs.com/revue/news/135652.shtmlhttp://www.secuobs.com/revue/news/135652.shtml Secuobs.com : 2009-08-28 19:22:50 - Threatpost Feed - Consumer Corporate A software engineer who created Trojans for the Swiss authorities to intercept Voice-over-IP VoIP phone calls has published the source code to his programs in order to draw attention to the surveillance threat posed by such software Read the full story idgno http://www.secuobs.com/revue/news/135651.shtmlhttp://www.secuobs.com/revue/news/135651.shtml Secuobs.com : 2009-08-27 22:11:39 - Threatpost Feed - Corporate The malware-infected CDs that were mailed to some credit unions may have been part of a penetration test designed to gauge whether an employee would run the software The SANS Internet Storm Center says it was notified by a representative from Microsolved that the mailing was part of an authorized pen test http://www.secuobs.com/revue/news/135293.shtmlhttp://www.secuobs.com/revue/news/135293.shtml Secuobs.com : 2009-08-27 22:11:39 - Threatpost Feed - Consumer Corporate The most trusted websites, such as search engines, mainstream news sites and some blogs, ar e increasingly at risk of hosting malicious links that pass malicious code to their visitors, according to the latest data collected by researchers with IBM's X-Force security team The report ibmcom outlines a sharp increase in new malicious Web links and consistent attacks against Web applications that could undermine the security of some database servers Read the full story techtargetcom http://www.secuobs.com/revue/news/135292.shtmlhttp://www.secuobs.com/revue/news/135292.shtml Secuobs.com : 2009-08-27 22:11:39 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - August 27, 2009 Dennis Fisher talks with Amit Yoran, former director of the National Cyber Security Division at DHS and CEO of NetWitness, about state-sponsored attacks, federal cybersecurity and the changing nature of security threats You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/135291.shtmlhttp://www.secuobs.com/revue/news/135291.shtml Secuobs.com : 2009-08-26 23:16:10 - Threatpost Feed - Consumer Corporate A pair of Japanese researchers have developed an improvement on an existing technique for attacking wireless LAN traffic that enables them to intercept and decrypt encrypted packets in about a minute, significantly lowering the barrier to entry for attackers looking to listen in on supposedly private connections http://www.secuobs.com/revue/news/134898.shtmlhttp://www.secuobs.com/revue/news/134898.shtml Secuobs.com : 2009-08-26 23:16:10 - Threatpost Feed - Consumer Corporate From The Last Watchdog Byron Acohido How much time should vendors of popular technology be given to fix a known security flaw That s the central question of the full disclosure debate - and one that is being tested again via Karsten Nohl s campaign to compile a decryption handbook useful for eavesdropping on transmissions from AT T and Tmobile phones, including iPhones and GPhones Nohl, a computer science PhD candidate from the University of Virginia, is calling for the global community of hackers to crack the encryption used on GSM phones He plans to compile this work into a code book that can be used to eavesdrop on conversations and data transfers to and from GSM phones Read the full story lastwatchdogcom http://www.secuobs.com/revue/news/134897.shtmlhttp://www.secuobs.com/revue/news/134897.shtml Secuobs.com : 2009-08-26 00:09:05 - Threatpost Feed - Consumer Apple's commercials may give the impression that Macs are virus-free but the company isn t taking any chances with the newest Mac OS X refresh Apple has quietly added a new Snow Leopard feature to scan software downloads for malware, a no-brainer move that coincides with a noticeable spike in malicious files embedded in pirated copies of Mac-specific software Read the full story zdnetcom http://www.secuobs.com/revue/news/134404.shtmlhttp://www.secuobs.com/revue/news/134404.shtml Secuobs.com : 2009-08-25 18:44:18 - Threatpost Feed - Consumer Corporate From ZDNet Dancho Danchev According to a research published by Trusteer earlier this month, 795pourcents of the 25 million users of their Rapport security service run a vulnerable version of Adobe Flash, with 835pourcents also running a vulnerable version of Acrobat The company has also criticized Adobe by insisting that their update mechanism does not meet the requirements of a system that is used by 99pourcents of users on the Internet and is highly targeted by criminals , but is praising the update mechanism of Google s Chrome and Firefox, whose silent updates close the window of opportunity for malicious attackers to take advantage of Read the full story zdnetcom See the Trusteer study PDF http://www.secuobs.com/revue/news/134271.shtmlhttp://www.secuobs.com/revue/news/134271.shtml Secuobs.com : 2009-08-25 12:40:41 - Threatpost Feed - Corporate From CNet Elinor Mills Cisco Systems wireless local area network equipment used by many corporations around the world is at risk of being used in denial-of-service attacks and data theft, according to a company that offers protection for WLANs Researchers at AirMagnet, which makes intrusion-detection systems for WLANs, discovered the vulnerability, which affects all lightweight Cisco wireless access points, as well as the exploit that could be used against networks that have the Over-the-Air-Provisioning OTAP feature turned on Read the full story cnetcom http://www.secuobs.com/revue/news/134137.shtmlhttp://www.secuobs.com/revue/news/134137.shtml Secuobs.com : 2009-08-25 00:53:53 - Threatpost Feed - Consumer Corporate From internetnewscom Sean Michael Kerner Tens of millions of people around the world use Adobe's Flash and PDF reader technologies How many of them update regularly The issue of updated Flash and Adobe Acrobat PDF clients is an important one, as Adobe recently patched both technologies for security vulnerabilities that could expose users to risk Yet security vendor Trusteer recently examined its own users and found that at least 80 percent were running unpatched versions of Flash and Adobe Acrobat Read the full story internetnewscom http://www.secuobs.com/revue/news/133862.shtmlhttp://www.secuobs.com/revue/news/133862.shtml Secuobs.com : 2009-08-25 00:53:53 - Threatpost Feed - Corporate From SC Magazine Angela Moscaritolo Two new rules were created this week requiring health care organizations, and other entities that interact with personal health records PHRs , to issue notifications in the event of a data breach The key rule, issued Wednesday by the US Department of Health and Human Services HHS , requires health care organizations subject to Health Insurance Portability and Accountability Act HIPAA regulations to notify individuals whose information has been breached, when the breach affects more than 500 individuals Breaches affecting fewer than 500 individuals must be reported to the HHS annually Read the full story scmagazineuscom http://www.secuobs.com/revue/news/133861.shtmlhttp://www.secuobs.com/revue/news/133861.shtml Secuobs.com : 2009-08-25 00:53:53 - Threatpost Feed - Consumer Corporate From Computerworld Michael Scalisi While security has never been more important than it is today, the fastest way for an IT professional to become the most despised person in the company is to start enforcing a strong password policy A policy perceived as overbearing may cause people to write down their passwords on a sticky-note near their computers, circumventing its very purpose Your policy will be ineffective if your users don't know how to create strong passwords that are easy to remember Read the full story computerworldcom http://www.secuobs.com/revue/news/133860.shtmlhttp://www.secuobs.com/revue/news/133860.shtml Secuobs.com : 2009-08-25 00:53:53 - Threatpost Feed - Consumer Corporate Security researchers are raising an alarm for a potent malware cocktail -- backdoor Trojans and password stealers -- being pushed to Windows users from about 55,000 hacked Web sites According to Mary Landesman, a researcher in ScanSafe's security threat alert team, the cybercriminals have embedded a malicious iFrame into tens of thousands of Websites to fire exploits at unsuspecting PC users who surf to one of the rigged sites http://www.secuobs.com/revue/news/133859.shtmlhttp://www.secuobs.com/revue/news/133859.shtml Secuobs.com : 2009-08-22 01:36:56 - Threatpost Feed - Corporate How much does a bot cost these days Like everything else in our economy, the price of a bot-infected PC fluctuates significantly, based on supply, demand, volume purchased and any number of other factors But according to research done by the folks at Cisco, bots can be had for as little as 10 cents right now It's a buyer's market http://www.secuobs.com/revue/news/133287.shtmlhttp://www.secuobs.com/revue/news/133287.shtml Secuobs.com : 2009-08-21 19:56:59 - Threatpost Feed - Consumer By Rich Mogull Macworld As a security analyst and researcher, I often find myself exploring some of the darker corners of the Internet In the course of staying current on security issues, I frequently must browse the sorts of Web sites no average person should go anywhere near I'm also far more likely to be targeted in an attack That's forced me to develop a somewhat extreme approach to safer surfing Read the full story macworldcom http://www.secuobs.com/revue/news/133214.shtmlhttp://www.secuobs.com/revue/news/133214.shtml Secuobs.com : 2009-08-21 19:56:59 - Threatpost Feed - Corporate From Zero in a Bit Tyler Shields Trust has long been a favorite target of malicious individuals Most people would say that proper management of trust is one of the primary cornerstones of information security Trust is a relative term and all trust relationships should be examined with a very critical eye Ken Thompson s seminal paper Reflections on Trusting Trust , which won a Turing Award, addresses in detail why we can never be fully sure of the trust relationships in our development environment Read the full story Zero in a Bit http://www.secuobs.com/revue/news/133213.shtmlhttp://www.secuobs.com/revue/news/133213.shtml Secuobs.com : 2009-08-21 01:35:48 - Threatpost Feed - Corporate It seems that hackers have not been taking the move to two-factor authentication lying down Instead, they have been hard at work figuring out a method for siphoning off the one-time passwords generated by devices such as the RSA SecurID token and using them immediately to steal money from victims' bank accounts http://www.secuobs.com/revue/news/132987.shtmlhttp://www.secuobs.com/revue/news/132987.shtml Secuobs.com : 2009-08-20 20:07:19 - Threatpost Feed - Consumer Corporate From NYTimescom Brad Stone Albert Gonzalez, a suspect in several hacking cases, was close to reaching a comprehensive plea agreement with federal prosecutors in Massachusetts and New York when federal prosecutors in New Jersey indicted him on Monday on a new raft of computer crimes, said Mr Gonzalez s lawyer, Rene Palomino Jr Read the full story NYTimescom http://www.secuobs.com/revue/news/132899.shtmlhttp://www.secuobs.com/revue/news/132899.shtml Secuobs.com : 2009-08-20 20:07:19 - Threatpost Feed - Consumer Corporate From Computerworld Gregg Keizer Microsoft's plan to sandbox documents in the next version of Office looks like a very good step forward, according to one security analyst Last week, Microsoft revealed more details about a new security feature in Office 2010, dubbed Protected View, that is designed to shut down the popular hacker tactic of feeding users rigged Word, Excel and PowerPoint files Read the full story computerworldcom http://www.secuobs.com/revue/news/132898.shtmlhttp://www.secuobs.com/revue/news/132898.shtml Secuobs.com : 2009-08-20 20:07:19 - Threatpost Feed - Consumer This video is a demonstration of an attack exploiting a vulnerability in Facebook It is a companion video to this blog post quajicom that describes and discusses the hack In a nutshell, a Facebook user's personal is stolen The only thing he does is view a regular, legitimate forum site http://www.secuobs.com/revue/news/132897.shtmlhttp://www.secuobs.com/revue/news/132897.shtml Secuobs.com : 2009-08-20 20:07:19 - Threatpost Feed - Corporate From the HP Security Labs blog If Google detects that your website is hosting malware, it is pretty clear your site has been attacked A frightening trend with SQL Injection attacks concerns how an attacker will insert links to javascript content used to serve malicious links that may try and automatically compromise the users of your website When this happens, Google will automatically detect this and actively deter users from visiting your website Here are some of the basic recovery steps that need to be taken to ensure all content that was possibly modified by the attacker will be removed The steps below are simply a very rough set of guidelines on one way that a security analyst might approach securing a hacked website Read the full story hpcom http://www.secuobs.com/revue/news/132896.shtmlhttp://www.secuobs.com/revue/news/132896.shtml Secuobs.com : 2009-08-19 22:48:33 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - August 19, 2009 In this episode, Dennis Fisher talks with David Mortman and Alex Hutton of the New School of Information Security blog about the Mortman Hutton model, data breaches and the effect of breaches on the reputation and viability of an organization You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/132504.shtmlhttp://www.secuobs.com/revue/news/132504.shtml Secuobs.com : 2009-08-19 22:48:33 - Threatpost Feed - Consumer Corporate Add the Radisson Hotels Resorts chain to the growing list of businesses datalossdborg reporting significant data breaches that exposed sensitive customer data In an open letter radissoncom to guests, Radisson chief operating officer Fredrik Korallus said the hotel chain s computer system was hacked between November 2008 and May 2009 and customer data, including credit and debit card numbers, was stolen Read the full story zdnetcom http://www.secuobs.com/revue/news/132503.shtmlhttp://www.secuobs.com/revue/news/132503.shtml Secuobs.com : 2009-08-19 17:33:47 - Threatpost Feed - Corporate Martin Hellman, the co-inventor of public key cryptography, uses his background in security and cryptography to bring insights to two seemingly unrelated issues nuclear weapons and soaring http://www.secuobs.com/revue/news/132408.shtmlhttp://www.secuobs.com/revue/news/132408.shtml Secuobs.com : 2009-08-19 17:33:47 - Threatpost Feed - Corporate The critical WINS vulnerability that Microsoft issued a patch for last week is now being exploited actively in the wild, according to the SANS Institute sansorg The Internet Storm Center ISC , which is operated by SANS, is receiving preliminary reports that hackers are targeting Microsoft's WINS service on Windows NT, 2000 and 2003 servers Read the full story networkworldcom http://www.secuobs.com/revue/news/132407.shtmlhttp://www.secuobs.com/revue/news/132407.shtml Secuobs.com : 2009-08-19 00:07:38 - Threatpost Feed - Consumer Corporate A Miami man and two Russians have been indicted usdojgov by a grand jury in New Jersey on charges of conspiring to commit some of the largest data breaches in US history Albert Gonzalez, 28, and the two still-unnamed Russian citizens are charged with running an international scheme to steal more than 130 million credit and debit card numbers along with personally identifying information from five companies, including Heartland Payment Systems Inc, 7-Eleven Inc and Hannaford Brothers Co The two other companies were not named in the indictment because their breaches have not yet been made public Read the full story computerworldcom Here's a PDF link to the indictment washingtonpostcom http://www.secuobs.com/revue/news/132174.shtmlhttp://www.secuobs.com/revue/news/132174.shtml Secuobs.com : 2009-08-19 00:07:38 - Threatpost Feed - Corporate The news that federal authorities have indicted the man they claim is responsible for the TJX attack for also allegedly hacking into the networks of Heartland Payment Systems, 7-Eleven and the Hannaford Brothers grocery chain shows that law enforcement is indeed stepping up its work on cybercrime But it also provides what is probably the clearest evidence to date that the people executing these attacks are highly competent, organized and motivated http://www.secuobs.com/revue/news/132173.shtmlhttp://www.secuobs.com/revue/news/132173.shtml Secuobs.com : 2009-08-19 00:07:38 - Threatpost Feed - Corporate Adobe s never-ending run on the security treadmill hit a new gear this week with the release of patches to cover serious vulnerabilities in the ColdFusion and JRun web design and development platforms The patches, rated critical, cover a total of 7 vulnerabilities, some of which could lead to the potential compromise of user accounts or the affected system, according to an advisory from Adobe They affect ColdFusion v801 and earlier versions, and JRun 40 Read the full story zdnetcom http://www.secuobs.com/revue/news/132172.shtmlhttp://www.secuobs.com/revue/news/132172.shtml Secuobs.com : 2009-08-18 01:15:42 - Threatpost Feed - Corporate By Dmitry Bestuzhev The credit crunch means we're all increasingly aware of bank charges, interest rates, and how we can save a few extra pennies Financial advisors have written pages on how transferring an existing credit card balance to another card issuer could save you money, and most people are shopping around for the best offers Of course, the APR and other rates don't worry cybercriminals All they want to do is get their hands on credit card numbers and then use them or sell them on Who cares if the card owner gets stung with additional charges Read the full story Viruslist http://www.secuobs.com/revue/news/131701.shtmlhttp://www.secuobs.com/revue/news/131701.shtml Secuobs.com : 2009-08-17 19:43:01 - Threatpost Feed - Corporate In this Google Tech Talk, Neil Daswani, founder of Dasient and a former Google engineer, discusses the recent epidemic of attacks featuring legitimate Web sites that have been compromised by malware and what can be done to combat the threat http://www.secuobs.com/revue/news/131591.shtmlhttp://www.secuobs.com/revue/news/131591.shtml Secuobs.com : 2009-08-17 19:43:01 - Threatpost Feed - Consumer Corporate A huge number of Web sites are employing a little-known tracking mechanism to gather information on visitors and are failing to disclose the practice in their privacy policies, according to a new paper from a group of university researchers The technique employs cookies generated by the Adobe Flash software and the cookies often have the same value as HTTP cookies, the researchers report http://www.secuobs.com/revue/news/131590.shtmlhttp://www.secuobs.com/revue/news/131590.shtml Secuobs.com : 2009-08-15 03:15:21 - Threatpost Feed - None Threatpost editors Ryan Naraine and Dennis Fisher discuss the botnet being controlled through Twitter, Obama and cybersecurity, as well as the new Linux kernel flaw You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/131095.shtmlhttp://www.secuobs.com/revue/news/131095.shtml Secuobs.com : 2009-08-14 21:43:18 - Threatpost Feed - Corporate Researchers have identified a new vulnerability in the Linux kernel which could enable an attacker to take complete control of a vulnerable system The flaw is in all versions of the 24 and 26 Linux kernels The Linux kernel vulnerability is a NULL pointer dereference vulnerability that derives from the kernel's failure to validate a function pointer before dereferencing it The flaw, discovered by two members of the Google security team, has been fixed by a patch for the Linux kernel that was made available Thursday http://www.secuobs.com/revue/news/131018.shtmlhttp://www.secuobs.com/revue/news/131018.shtml Secuobs.com : 2009-08-13 23:02:06 - Threatpost Feed - Consumer Corporate Arbor Networks security researcher Jose Nazario has stumbled upon a crimeware botnet using Twitter as its command-and-control operation The botnet, which is linked to identity thieves in Brazil, uses Twitter status messages to communicate with bots -- sending new links for the infected computers to contact and new commands and executables to download and run Read the full story arbornetworkscom http://www.secuobs.com/revue/news/130740.shtmlhttp://www.secuobs.com/revue/news/130740.shtml Secuobs.com : 2009-08-13 23:02:06 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - August 13, 2009 Dennis Fisher talks with Microsoft s Adam Shostack about the Privacy Enhancing Technologies Symposium, the definition of privacy in today s world and the role of technology in helping to enhance and protect that privacy You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/130739.shtmlhttp://www.secuobs.com/revue/news/130739.shtml Secuobs.com : 2009-08-13 00:18:50 - Threatpost Feed - Consumer Corporate As smartphones become even smarter, they are going to attract more and more attention from attackers, spammers and others looking to take control of the billions of mobile devices in use today, the head of Google's Android security team said In a talk at the USENIX Security symposium Wednesday, Rich Cannings acknowledged the danger that malware and other security threats pose to Android phones as well as other smartphones, Computerworld reports http://www.secuobs.com/revue/news/130375.shtmlhttp://www.secuobs.com/revue/news/130375.shtml Secuobs.com : 2009-08-12 18:45:25 - Threatpost Feed - Consumer Corporate By Roel Schouwenberg On Tuesday we got another DDoS attack on Twitter A lot of people are asking why Twitter doesn't seem to be coping with attacks like these And at the same time there are more and more people jumping on the bandwagon saying stay away from Adobe products http://www.secuobs.com/revue/news/130286.shtmlhttp://www.secuobs.com/revue/news/130286.shtml Secuobs.com : 2009-08-12 18:45:25 - Threatpost Feed - Consumer Corporate Apple has released Safari 403 to fix at least six security vulnerabilities that put Mac and Windows users at risk of hacker attacks The update is considered highly-critical and should be immediately applied on both Windows and Mac systems because of the risk of information disclosure, phishing and remote code execution attacks See Apple's advisory for details applecom http://www.secuobs.com/revue/news/130285.shtmlhttp://www.secuobs.com/revue/news/130285.shtml Secuobs.com : 2009-08-12 18:45:25 - Threatpost Feed - Consumer Corporate From IDG News Service Juan Carlos Perez Members of the eBay Developers Program must change their account passwords because the e-commerce company recently discovered a way in which account information could be accessed by malicious hackers This requirement comes out of an abundance of caution on the part of eBay, which hasn't detected any suspicious activity in developer accounts, the company said Monday evening Read the full story ciocom See the eBay warning ebaycom http://www.secuobs.com/revue/news/130284.shtmlhttp://www.secuobs.com/revue/news/130284.shtml Secuobs.com : 2009-08-12 18:45:25 - Threatpost Feed - Consumer Corporate This short video demonstration shows a new technique for exploiting a flaw in Apple Safari 4 that enables an attacker to hijack the Top Sites feature in Safari and replace the victim's Top Sites with phishing sites The vulnerability and attack were discovered by Inferno http://www.secuobs.com/revue/news/130283.shtmlhttp://www.secuobs.com/revue/news/130283.shtml Secuobs.com : 2009-08-12 18:45:25 - Threatpost Feed - Corporate That giant sucking sound you hear is the steady stream of talented security people and experienced policy makers getting out of Washington as quickly as possible as the Obama administration continues to be paralyzed by indecision and a lack of direction regarding cybersecurity http://www.secuobs.com/revue/news/130282.shtmlhttp://www.secuobs.com/revue/news/130282.shtml Secuobs.com : 2009-08-11 22:53:30 - Threatpost Feed - Consumer Corporate Researchers are sounding the alarm for a serious administrator password-reset vulnerability affecting the latest version of WordPress, the popular open-source blog publishing platform The flaw, which can be exploited via the browser, gives an attacker a trivial way to compromise the admin account of any WordPress of WordPress MU multiple user installation Read the full story zdnetcom Also see ISC SANS diary entry sansorg http://www.secuobs.com/revue/news/129989.shtmlhttp://www.secuobs.com/revue/news/129989.shtml Secuobs.com : 2009-08-11 22:53:30 - Threatpost Feed - Consumer Corporate By Eric Schultze Microsoft has released nine bulletins today, five of them Critical, four of them Important The bulletins cover a gamut of affected products - almost everything in your enterprise will need to be patched today with the exception of Internet Explorer No IE patches this month The majority of bulletin releases these days relate to client-side vulnerabilities visit an evil website, open an evil document, or read an evil email and you ll get hacked These vulns are of greatest concern on the desktop where end users are filling time between Mafia Wars power-ups and Facebook updates by visiting websites that may be hosting content of questionable repute This month, there are five bulletins addressing these types of issues http://www.secuobs.com/revue/news/129988.shtmlhttp://www.secuobs.com/revue/news/129988.shtml Secuobs.com : 2009-08-11 06:32:03 - Threatpost Feed - Consumer Two of the largest US banks -- Bank of America and Citigroup -- have issued new credit and debit cards to Massachusetts customers after running into data-safety concerns Bank of America and Citigroup each recently issued replacement cards to consumers, telling them in letters that their account numbers may have been compromised Read the full story bizjournalscom http://www.secuobs.com/revue/news/129766.shtmlhttp://www.secuobs.com/revue/news/129766.shtml Secuobs.com : 2009-08-10 21:37:03 - Threatpost Feed - Consumer Corporate By Bruce Schneier There are several ways two people can divide a piece of cake in half One way is to find someone impartial to do it for them This works, but it requires another person Another way is for one person to divide the piece, and the other person to complain to the police, a judge, or his parents if he doesn t think it s fair This also works, but still requires another person at least to resolve disputes A third way is for one person to do the dividing, and for the other person to choose the half he wants http://www.secuobs.com/revue/news/129577.shtmlhttp://www.secuobs.com/revue/news/129577.shtml Secuobs.com : 2009-08-10 21:37:03 - Threatpost Feed - Consumer Corporate From TidBITS Rich Mogull A mere three days after I published an article touting the enhanced security of the iPhone 3GS, security researcher Jonathan Zdziarski revealed iphonesecuritycom a simple, only moderately technical technique for completely circumventing the iPhone's passcode lock and encryption As a result, the iPhone 3GS encryption can no longer be considered a security control for consumers or enterprises until Apple releases a fix Although encryption is one of the most fundamental tools available in the security arsenal, it can be difficult to implement properly In this case, it isn't that the encryption itself is flawed although that happens , but that the implementation of the encryption leaves cracks for attackers Read the full story tidbitscom http://www.secuobs.com/revue/news/129576.shtmlhttp://www.secuobs.com/revue/news/129576.shtml Secuobs.com : 2009-08-07 22:19:40 - Threatpost Feed - Corporate This Google Tech Talk features researcher Nate Lawson discussing recent vulnerabilities in crypto libraries, why public key cryptography is like a Ford Pinto in a demolition derby and the password-hashing mess created by Web 20 sites http://www.secuobs.com/revue/news/129071.shtmlhttp://www.secuobs.com/revue/news/129071.shtml Secuobs.com : 2009-08-07 22:19:40 - Threatpost Feed - Consumer Corporate By Stefan Tanase There are a lot of theories flying around about why Twitter and other social media services got knocked offline yesterday I've heard rumors about it being linked to political tension between Georgia and Russia Otthers blame Iran for the outages I'm not a political commentator, therefore I cannot comment on anyone's political views -- but I have some logic and common sense, and I can draw some objective conclusions http://www.secuobs.com/revue/news/129070.shtmlhttp://www.secuobs.com/revue/news/129070.shtml Secuobs.com : 2009-08-07 22:19:40 - Threatpost Feed - None Threatpost editors Ryan Naraine and Dennis Fisher discuss the DDoS attacks against Twitter, Facebook and LiveJournal and delve into Apple's Mac OS X patch and Microsoft's Patch Tuesday plans You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/129069.shtmlhttp://www.secuobs.com/revue/news/129069.shtml Secuobs.com : 2009-08-07 22:19:40 - Threatpost Feed - Corporate In this video from the Source Boston 2008 conference, Rich Mogull of Securosis and Chris Hoff discuss the phenomenon of disruptive innovation and what it means for the future of security http://www.secuobs.com/revue/news/129068.shtmlhttp://www.secuobs.com/revue/news/129068.shtml Secuobs.com : 2009-08-07 07:41:44 - Threatpost Feed - Consumer From Viruslistcom Stefan Tanase Once again, there's a new wave of Koobface malware attacks But this time, the tactics have changed There's a new twist to the social engineering, with links from infected messages leading to a very well designed Facebook lookalike page, far more convincing than the previous YouTube page Read the full story viruslistcom http://www.secuobs.com/revue/news/128796.shtmlhttp://www.secuobs.com/revue/news/128796.shtml Secuobs.com : 2009-08-07 07:41:44 - Threatpost Feed - Consumer Corporate Twitter was the target of a sustained denial-of-service attack Thursday morning, an attack that took the site offline for several hours Twitter's service went down around 9 am EDT and was back up around noon, while Facebook's site also experienced problems that may have been the result of a DoS attack http://www.secuobs.com/revue/news/128795.shtmlhttp://www.secuobs.com/revue/news/128795.shtml Secuobs.com : 2009-08-07 07:41:44 - Threatpost Feed - None Digital Underground podcast with Dennis Fisher - August 6, 2009 Dennis Fisher talks with researcher Moxie Marlinspike about the innovative research on attacking the inherent weaknesses in the SSL infrastructure that he presented at Black Hat, and the tools he has released to demonstrate the attacks, SSLSniff and SSLStrip You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/128794.shtmlhttp://www.secuobs.com/revue/news/128794.shtml Secuobs.com : 2009-08-07 07:41:44 - Threatpost Feed - Consumer Corporate For Microsoft Windows users, next week s Patch Tuesday will be a busy one The Redmond, Wash software maker plans to release a total of nine bulletins to patch a wide range of serious vulnerabilities affecting Windows, Microsoft Office, Microsoft Visual Studio, Microsoft ISA Server, Microsoft BizTalk Server and the Net Framework See the advance notice microsoftcom http://www.secuobs.com/revue/news/128793.shtmlhttp://www.secuobs.com/revue/news/128793.shtml Secuobs.com : 2009-08-06 00:39:12 - Threatpost Feed - Corporate From Washington Post Brian Krebs Security researchers today unveiled details about a little-known but ubiquitous class of vulnerabilities that may reside in a range of Internet components, from Web applications to mobile and cloud computing platforms to documents, images and instant messaging products At issue are problems with the way many hardware and software makers handle data from an open standard called XML Read the full story washingtonpostcom http://www.secuobs.com/revue/news/128337.shtmlhttp://www.secuobs.com/revue/news/128337.shtml Secuobs.com : 2009-08-06 00:39:12 - Threatpost Feed - Consumer Corporate By Roel Schouwenberg Once upon a time we were living in a world where creating malware, then still called viruses, was a very bad thing to do These days, people seem much more relaxed with the idea of someone writing malware Over the years I've spent quite some time thinking about this change and why it's occuring One of the major reasons for this change in mindset is the shift in the malware landscape Back in the 1990s, mostly hooligans were busy writing malware These days it's all about professional cyber criminals making huge amounts of money Compared to malware that empties your bank account that file infector suddenly doesn't seem that bad anymore http://www.secuobs.com/revue/news/128336.shtmlhttp://www.secuobs.com/revue/news/128336.shtml Secuobs.com : 2009-08-06 00:39:12 - Threatpost Feed - Consumer Apple today warned that opening or viewing image files could lead to remote code execution attacks against Mac OS X users In an update that contains fixes for a total of 19 documented vulnerabilities, Apple said malicious hackers could rig PNG Portable Network Graphics and other images to take complete control of unpatched Mac systems Read the full story zdnetcom See Apple's advisory applecom http://www.secuobs.com/revue/news/128335.shtmlhttp://www.secuobs.com/revue/news/128335.shtml Secuobs.com : 2009-08-06 00:39:12 - Threatpost Feed - Consumer Corporate Upstream providers have pulled the plug on Latvian ISP Real Host over allegations it maintained cybercrime servers linked to the Zeus botnet Real Host was disconnected by its upstream provider, Junik, on Monday, after TeliaSonera told Junik to either cut the juice or face sanctions itself Read the full story theregistercouk http://www.secuobs.com/revue/news/128334.shtmlhttp://www.secuobs.com/revue/news/128334.shtml Secuobs.com : 2009-08-05 19:47:05 - Threatpost Feed - Digital Underground podcast with Dennis Fisher - August 5, 2009 In this episode Dennis Fisher talks with Joe Grand of Grand Idea Studios about the design for this year s DEFCON badge, the secret feature he added that no one has uncovered yet and his research on hacking smart parking meters You are missing some Flash content that should appear here Perhaps your browser cannot display it, or maybe it did not initialise correctly http://www.secuobs.com/revue/news/128222.shtmlhttp://www.secuobs.com/revue/news/128222.shtml Secuobs.com : 2009-08-05 09:43:06 - Threatpost Feed - From ZDNet Dancho Danchev During the last couple of hours, a fake Microsoft patch themed malware campaign was restarted by its botnet masters, once again spamming a non-existent Update for Microsoft Outlook and Outlook Express Read the full story zdnetcom http://www.secuobs.com/revue/news/128086.shtmlhttp://www.secuobs.com/revue/news/128086.shtml Secuobs.com : 2009-08-04 22:54:13 - Threatpost Feed - The US Marine Corps has slapped an immediate ban on the use of social networking sites on its network, warning that sites like Facebook, MySpace and Twitter are a proven haven for malicious hackers and content The ban, contained in an order issued Monday, will last for a year It specifically mentions Facebook, Twitter and MySpace although it applies to what is described as Web-based services that allows communities of people to share common interests Read the USMC order marinesmil http://www.secuobs.com/revue/news/127954.shtmlhttp://www.secuobs.com/revue/news/127954.shtml Secuobs.com : 2009-08-04 22:54:13 - Threatpost Feed - This video from Network World shows hackers modifying the Defcon 2009 badge to act as a lie detector, confuse facial recognition systems and get around motion detection systems http://www.secuobs.com/revue/news/127953.shtmlhttp://www.secuobs.com/revue/news/127953.shtml Secuobs.com : 2009-08-04 22:54:13 - Threatpost Feed - From Computerworld Kenneth van Wyk The annual summer bug parades at Black Hat and Defcon always leave me questioning motives This year, as in the past, we witnessed a deluge of vulnerability disclosures, and many of them seemed to me to be beyond irresponsible They were attempts at naked glory mongering, and that just plain stinks Before I defend my claims, I'll say that I am a huge fan of freedom of speech I don't begrudge anyone the right to publish the results of their work That's not my point My point is that it isn't always responsible to exercise one's rights Read the full viewpoint computerworldcom http://www.secuobs.com/revue/news/127952.shtmlhttp://www.secuobs.com/revue/news/127952.shtml Secuobs.com : 2009-08-04 17:38:51 - Threatpost Feed - See photos taken from Black Hat 2009 and Defcon, both held last week in Las Vegas, Nev http://www.secuobs.com/revue/news/127870.shtmlhttp://www.secuobs.com/revue/news/127870.shtml