PC Tools News
Pirated Windows 7 RCs riddled with malware
20 May 2009 | VNUNet by Phil Muncaster
Security companies are warning users not to download Windows 7 release candidate software from peer-to-peer sites, after it was discovered that several versions contain malware. The pirated copies of the software, which are circulating on various networks, are infected with a Trojan downloader embedded in the setup.exe file. Trojan-Dropper.Agent, or Trojan.Agent, can take control of the host computer and add it to a botnet, with the potential to cause system failure. It can also result in identity theft or financial loss for the user, according to Australian security vendor PC Tools. The news comes just a month after criminals released pirated versions of Apple's iWork '09 office software suite containing spyware onto peer-to-peer networks.
Trojan Alert: Windows 7 RC1, FIFA World Cup Virus
20 May 2009 | Infopackets by Dennis Faas
Cybercriminals are continuing to target major news stories and global events such as the recent release of Windows 7 release candidate (RC) and results of the FIFA World Cup. It has been reported that thousands of Windows 7 builds downloaded on Torrent and P2P sharing sites contain a malicious Trojan designed to target personal information and has the potential to cause system failure and identity theft. Phishing attacks have targeted the 2010 FIFA World Cup Tournament and evidence suggests that the attacks will continue to escalate, as demonstrated during the previous FIFA World Cup which saw an increase of phishing attacks jump by 40% last year. (Source: pctools.com)
15 May 2009 | Macworld by Scott McNulty
Writing reviews of Mac antivirus software can be a thankless task, much like correcting e-mail grammar: no one particularly wants to hear about it, but there might be some value in the exercise. There have been no major viruses or malware outbreaks for Mac OS X since its introduction in March 2001 (kind of amazing, actually). That excellent track record doesn't make a strong case for running antivirus software on your Mac. Most antivirus software makers get around this by having their products do more than just look for Mac-specific threats. They will scan and clean your Mac of any Windows viruses that might come along so you don’t unknowingly pass them along to your Windows-using friends, making you a better Internet citizen.
Fradulent FIFA Emails Out and About
15 May 2009 | Smart House by Mendelson Tiu
Researchers from PC Tools are warning soccer fans of phishing attacks that is targeting the 2010 FIFA World Cup Tournament. According to the company, the phishing emails either include an attachment that contains malware or direct users to illegitimate sites masquerading as FIFA websites. With the FIFA World Cup qualifier to be played in Australia next month, Australians are likely to see more of these attacks. The researchers are also warning that FIFA-related attacks will continue to escalate. During the previous FIFA World Cup, related phishing attacks jumped by 40% and as many as 4,615 phishing hosts per month were discovered in 2008, up 66% over the previous year.
Threat Update
Microsoft warns of IIS zero-day vulnerability
19 May 2009 | Search Security by Robert Westervelt
Microsoft is warning of an IIS zero-day vulnerability in Microsoft Internet Information Services (IIS) Web server, which if successfully exploited, could give an attacker elevated privileges to gain access to sensitive data. Microsoft said a remote authentication bypass vulnerability exists in the WebDAV extension, a collection of tools used to publish content to IIS Web servers. The Web server does not properly decode a requested URL. An attacker can exploit the flaw by creating a specially crafted anonymous HTTP request to gain access to a location. Microsoft said the hack typically requires authentication. Related News: Microsoft confirms serious IIS bug, downplays threat (19 May 2009 | Computer World by Gregg Keizer) Microsoft Issues IIS Security Advisory (19 May 2009 | PC Magazine by Larry Seltzer) Vulnerability unpatched in Microsoft server product (19 May 2009 | Computer Weekly by Warwick Ashford) New Microsoft IIS flaw (18 May 2009 | SC Magazine US by Angela Moscaritolo); Free tools help protect users from IIS zero-day exploit (20 May 2009 | Network World by Jane Fontana)
Web attack that poisons Google results get worse
19 May 2009 | IDG News Services by Robert McMillan
A new attack that peppers Google search results with malicious links is spreading quickly, the U.S. Computer Emergence Response Team warned on Monday. The attack, which has intensified in recent days, can be found on several thousand legitimate Web sites, according to security experts. It targets known flaws in Adobe's software and uses them to install a malicious program on victims' machines, CERT said. The program then steals FTP login credentials from victims and uses that information to spread further. It also hijacks the victim's browser, replacing Google search results with links chosen by the attackers. (Comments by Scansafe, Symantec). Related News: ‘Gumblar’ attack explodes across the web (15 May 2009 | iTnews Australia by Shaun Nichols); Viral web infection siphons ad dollars from Google (14 May 2009 | The Register by Dan Goodin)
20 May 2009 | Network World by Carolyn Duffy
Domain name registries are scrambling to patch a newly discovered bug in popular open source DNS software that could be exploited for denial-of-service attacks.The bug and a corresponding fix were announced Monday by NLnet Labs, a research group that provides authoritative domain name server software called NSD to domain name registrars.The bug allows for an attack on an NSD server that would cause it to stop responding to queries. The bug affects all versions of NSD 2.0.0 to 3.2.1, NLnet Labs said calling the bugfix "critical." The bug is a "one-byte buffer overflow that allows a carefully crafted exploit to take down your name server," NLnet Labs said.
Mac OS X vulnerable to critical Java bug
20 May 2009 | ZDNet by Matthew Broesma
Apple's Mac OS X is vulnerable to a security flaw in Java that was originally publically disclosed almost six months ago, a security researcher has warned. The flaw affects a number of platforms running Java, and has been patched by most other operating-system vendors, noted researcher Julien Tinnes in a blog post on Tuesday. "Unfortunately, it is still not patched in [Apple's] latest security update from just a few days ago," he wrote. Exploits can be written purely in Java code, meaning they work on multiple platforms, Tinnes said. He recommended that Mac OS X users disable Java in their web browsers. Relate News: Apple lags on Java security fix in OS X (20 May 2009 | Mac World by Dan Moren)
JSRedir-R malware spreads across internet
15 May 2009 | PC Advisor by Carrie Ann Skinner
JSRedir-R is the latest web-based malware attack to infect the internet, being found on six times more websites than other malware, says Sophos. The security firm revealed that in the last week, almost half of all infections were caused by Troj/JSRedir-R. Third-party sites host the malware, which infects PCs when users navigate to them. The malware then steals sensitive personal data. "No-one should be in any doubt that the web is still the main vector of attack for cybercriminals, and this new threat suggests this situation isn't going to change anytime soon," said Graham Cluley, senior technology consultant at Sophos. (Comments by Sophos) Sophos: JSRedir-R surpasses other Web-Based malware (19 May 2009 | Computer World Hong Kong )
Facing criticism, Adobe rethinks PDF security
20 May 2009 | Computer World by Gregg Keizer
Blasted three months ago for being slow to fix a zero-day vulnerability in its popular PDF viewer, Adobe today promised it will root out bugs in older code, speed up the patching process and release regular security updates for Adobe Reader and Acrobat. The flak Adobe caught in February, when it disclosed a critical vulnerability, admitted the bug was being used by hackers, but then took weeks to patch the problem, is what prompted Adobe to review its security practices, acknowledged Brad Arkin, Adobe's director for product security and privacy. "At first, this was just another of our normal security incidents," said Arkin. "But it ended up expanding to [make] changes in our
security practices with Reader and Acrobat." (Comments from F-Secure)
Wimad Malware: Free Music is Too Good to Be True
18 May 2009 | PC Magazine by Larry Seltzer
Looking to tell a moral in addition to issuing a warning, Microsoft's Malware Protection Center has put out a blog on the Wimad family of malware, which they say is one of the top families of malware that they detect in the wild, behind Vundo, Zango stuff, Zlob and Renos. Wimad's niche in the malware market is that it offers free music. The files, which are malicious Windows Media files of various types; they have been observed in the wild with the extensions of .ASF, .ASX, .MP3, and .WMA. When they are opened in Windows Media Player they direct the web browser to a particular address and prompt the user to download a file. The file, of course, is an even more malicious program. Related News: Wimad Malware Plays A Tempting Tune 15 May 2009 | Security Watch
New Variant of Sinowal rootkit
14 May 2009 | Net Security
Kaspersky Lab has implemented detection and treatment for a new variant of a unique MBR rootkit, Sinowal. The new variant of Sinowal, a malicious program that is capable of hiding its presence in the computer system by infecting the Master Boot Record (MBR) on the hard drive, was detected at the end of March 2009. Over the last month Sinowal has been actively spreading from a number of malicious sites that use the Neosploit exploit toolkit. Kaspersky Lab analysts have been monitoring the Sinowal rootkit since early 2008. earlier versions, the new modification, Backdoor.Win32.Sinowal has these features:
Conficker Virus Excessively Infecting Indian Computers
18 May 2009 | SPAMfighter News
Various security agencies report that the malicious worm Conficker is currently attacking a large number of Indian PCs, to quietly turn them into spam bots as well as to load spyware on them. A research by Symantec has revealed that India ranks high among the nations that are severely hit by Conficker. This is attributed to the country's rampant use of P2P file sharing applications, inadequate knowledge about the necessity of updating antivirus programs and the widespread use of fake or pirated software. Shantanu Ghosh, Vice-President of India Product Operations, Symantec India, states that India is one of the top ten nations affected by Conficker, as reported by CIOL on May 11, 2009.
Researchers Hack Web Application Firewalls
13 May 2009 | Dark Reading by Kelly Jackson Higgins
A pair of researchers at the OWASP Europe 2009 conference on Wednesday showed how some Web application firewalls (WAFs) are prone to attack. Wendel Henrique, a member of SpiderLabs (Trustwave's advanced security team), and Sandro Gauci, founder and CSO for EnableSecurity, also found some WAFs vulnerable to the same types of exploits they are supposed to protect Web apps from, such as cross-site scripting (XSS) attacks. The researchers used a tool they developed, called WafW00f, to detect and fingerprint the presence — and in some cases, the brand — of a WAF running in front of a Web application. A second tool created by Henrique and Gauci, called WafFun, let them exploit and bypass WAFs running in blacklisting and whitelisting modes.
Kaspersky finds malware on new netbook
19 May 2009 | Computer World by Gregg Keizer
After discovering attack code on a brand new Windows XP netbook, Kaspersky Lab warned users yesterday that they should scan virgin systems for malware before connecting them to the Internet. When Kaspersky developers installed their recently-released Security for Ultra Portables on an M&A Companion Touch netbook purchased for testing, "they thought something strange was going on," said Roel Schouwenberg, a senior antivirus researcher with the Moscow-based firm. Schouwenberg scanned the machine – a $499 netbook designed for the school market – and found three pieces of malware. "This was done at the factory," said Schouwenberg. "It was completely brand new, still in its packaging." (Comments by Kaspersky)
Hacks and Website Attacks
Hacker Destroys Avsim.com 15 May 2009 | Slashdot by Timothy
Phishing Scams
Commonwealth Bank warns on phishing scam 20 May 2009 | Business Spectator
Industry News
Inside the botnets that never make the news
20 May 2009 | ZDNet by Dancho Danchev
If you ever wanted to take an inside view of targeted-botnets primarily run by novice cybercriminals sometimes utilizing outdated, but very effective methods – this ZDNet photo gallery is for you. It offers an inside view of those “beneath the radar” botnets that never make the news. The images have been collected throughout the past year by using open source intelligence, namely, by either joining the command and control IRC channel upon infection, or monitoring ongoing communications between the botnet masters. Why are small botnets so important anyway, and shouldn’t we keep an eye on the big ones such as Conficker, Torpig or the rest of the eye-popping ones? Smaller botnets are usually underestimated ones, however, they’re perfectly suitable for targeted attacks such as the recently exposed GhostNet espionage network.
Conficker still infecting 50 000 PCs per day
21 May 2009 | IDG News Services by Robert McMillan
The Conficker worm is still infecting systems at a brisk rate and continues to snag computers in Fortune 1000 companies, according to security researchers. The worm is infecting about 50,000 new PCs each day, according to researchers at Symantec, who reported Wednesday that the U.S., Brazil and India have been hit the hardest.. "Much of the media hype seems to have died down around Conficker/Downadup, but it is still out there spreading far and wide," Symantec said in a blog post. Conficker began spreading late last year, taking advantage of a recently patched flaw in Microsoft's Windows operating system to infect entire networks and also using removable storage devices to hop from PC to PC. (Comments by Symantec)
Malware hits 8pc of Commons computers
21 May 2009 | Kablenet
Nearly 400 computers at the House of Commons needed attention after malware attacks during the past 12 months. Out of nearly 5,000 computers used by MPs, their staff and Commons administrators, eight percent had to be visited by an ICT specialist because of problems with malware. The information was revealed by Nick Harvey, a Liberal Democrat MP and member of the House of Commons Commission, the body responsible for the administration and services of the House. Harvey was replying to a parliamentary written question from Conservative MP Tim Loughton. Harvey said that over the last year 86 percent of computers on the Commons estate had been attacked by malware, but 78 percent of these were automatically cleaned by Parliament's antivirus software.
‘Secret’ security questions don’t work, finds study
20 May 2009 | IDG News Services by Jeremy Kirk
Even if your spouse doesn't know your email password, he or she probably knows enough information to get it. Free email providers often present a so-called "secret question" as a verification mechanism to reset an account password. But the answer is often easily guessable by other people who know the account holder, according to a new study to be released during the IEEE Symposium on Security and Privacy this week in Oakland, California. In other cases, strangers can successfully supply the answers to some questions, which is how Republican vice-presidential nominee Sarah Palin lost control of her Yahoo account.
Security Groups Tout ‘Chain of Trust’ Initiative to Combat Malware
19 May 2009 | eWeek by Roy Mark
Latest cyber security initiative aims to link together all organizations and individuals that play a role in securing the Internet. Applying many of the same approaches used to bring nuisance adware under control, three cyber security groups said May 19 they are launching a new initiative: a "chain of command" plan among all organizations and individuals that play a role in securing the Internet. Developed by the ASC (Anti-Spyware Coalition), NCSA (National Cyber Security Alliance) and StopBadware.org, the Chain of Trust Initiative will link together security vendors, researchers, government agencies, Internet companies, network providers, advocacy and education groups in a systemic effort to stem the ever increasing rising tide of malware.
Warner touts e-medical data despite hacker attack
19 May 2009 | Sydney Morning Herald – AP Digital by Bob Lewis
A hacker's theft of millions of Virginia's most sensitive prescription drug records isn't slowing Democratic Sen. Mark Warner's push for electronic medical records. The former governor convened a conference in Richmond Monday about the medical and cost-saving benefits of digitizing hundreds of millions of patient records nationally. "We've been talking about this subject, policymakers have, for decades: how can we make sure that we can bring the power of information technology to our health care system," Warner told reporters at Virginia Commonwealth University. Related News: Hacker hobbles medical database dream (19 May 2009 | The Inquirer by Nick Farrell)
Windows 7 UAC Isn’t Inherently Insecure; Users Are
18 May 2009 | PC Magazine by Larry Seltzer
Reports are spreading (like this) that the default configuration of UAC (User Account Control) in Windows 7 is insecure. These claims are based on old and fallacious arguments. A little background: If you run Windows 7 as an administrator this does not require a UAC prompt, while it did in Vista. If you're logged in as Administrator in Vista or Windows 7 then you are actually run in a less-privileged mode and, when you attempt to perform a privileged action (or so it's supposed to do) you get a UAC prompt. These prompts just have a Continue button, unlike the ones for standard users which also require administrator credentials.
MyIDscore.com Offers Free ID Theft Risk Score
18 May 2009 | Security Fix by Brian Krebs
Consumers trying to determine their risk of becoming an identity theft victim typically are told to check their credit report for signs of unauthorized or suspicious activity. But a new Web-based service aims to give users a view into tricks ID thieves use that credit reports often miss, such as when crooks use only parts of a victim's identity to fabricate a new one. The new service, www.myidscore.com, is a free offering by ID Analytics, a company that sells anti-fraud software to banks and other creditors. After providing some personal information and answering a handful of questions, visitors to the site are presented with a score from 1 to 999.
Open letter to vendors on software security
18 May 2009 | SC Magazine US by Andrew Storms
While I recognize no software is 100 percent bug free and that the world of threats is ever dynamic, customers, consumers and enterprises need their vendors to take the entire life cycle of security management far more seriously than is evident from their behavior today. Vendors must focus on dramatically reducing events that bring about zero-day exploits that leave security professionals holding the bag and praying nobody opens an attachment. Vendors that talk about security must deliver evidence that matters. In the big picture, it's clear that features and functionality that drive some level of economic gain are often prioritized over security.
Gut instinct no protection against net scams
19 May 2009 | The Register by John Leyden
Those who rely on gut instinct and are open to persuasion are more at risk of falling prey to internet scams, according to a research sponsored by the UK Office of Fair Trading. Far from being naive and easily led, many scam victims are often decent decision-makers in their everyday life, psychology researchers at the University of Exeter conclude. Grifters take UK marks for an estimated £3.5bn every year. OFT commissioned research found many frauds rely on exploiting basic human emotions such as excitement or fear to provoke a "gut reaction" to a fraudulent offer. Many fraudsters attempt to hoodwink people by posing as reputable businesses or official institutions.
Spam company develops new way to stop form spam
19 May 2009 | IDG News Services by Jeremy Kirk
Spam isn't just a problem for people with e-mail addresses, but also for companies and organizations running Web sites with various types of feedback forms. Automated bots troll the Internet for forms, automatically filling them out with rubbish information. Form data often goes to Web-site employees' e-mail addresses for sorting later. Many companies also collect marketing leads through forms that feed directly into databases, which then get gummed up with Viagra pitches instead of potential customers. But a four-person company in Dallas has come up with a Web-based service called Form Armor that blocks Web-form spam.
Rootkits: Is Removing them even possible?
18 May 2009 | ZDNet Asia by Michael Kassner
Throughout my series about rootkits and botnets, I've been impressed by the number and quality of member comments, especially the ones discussing how to remove rootkits. Thinking about this led to one of my ah-ha moments; fortuitously I decided to listen and consolidate those real-world tips along with what I have gleaned from security experts. Why rootkits are hard to remove
To be honest, my research is showing rootkit removal to be a rather haphazard affair, with positive results not always the norm. The apparent reason for this is the increased sophistication of rootkits. Some examples of these improvements are: # The ability to install rootkits at increased privilege levels in the operating system, making them immune to malware scanners.
Website risks highlighted in two new studies
18 May 2009 | SC Magazine US by Greg Masters
Two reports released this week confirmed the tidal shift in the type of websites into which cybercriminals are injecting malware. WhiteHat Security, in the seventh installment of its Website Security Statistics Report, to be released on Tuesday, found that 82 percent of websites studied over the past year have had a "high," "critical," or "urgent" issue during their lifetime, with cross-site scripting continuing to top the list. WhiteHat's report is no more alarming than in the past two years, Jeremiah Grossman, founder and CTO of the company, told SCMagazineUS.com on Monday. But this time, most of the more than 1,000 compromised websites reviewed in the report belong to well-known brands.
Phishers harvest Facebook passwords for profit
18 May 2009 | Computer World by Gregg Keizer
Identity thieves that hit Facebook last week with a new round of phishing attacks are harvesting passwords for profit, a security researcher said today. "It's not surprising that they're targeting Facebook," said Kevin Haley, a director on Symantec's security response team. "Facebook has, what, 200 million-plus users? The bad guys always go where's there's a lot of people." The newest Facebook attacks resemble previous phishing rounds in their tactics: A compromised account sends a malicious link to friends. That link leads to a site that mimics the legitimate log-in page. (Comments by Symantec)
Israeli intelligences issues Facebook warning
18 May 2009 | All Around Philly
Israel's internal intelligence service urged the public Monday to exercise caution when using Facebook, saying Arabs are trying to recruit spies on the popular social networking site. The Shin Bet security agency warned Israelis against answering unsolicited messages or sharing telephone numbers and other sensitive information over the Internet. It said there have been numerous incidents recently in which violent groups tried to recruit Israelis through Facebook and other networking sites. The agency said in one instance an Israeli Facebook user was contacted by a man who introduced himself as a Lebanese agent and offered money for information about Israel.
Net security needs ground up rebuild
19 May 2009 | Australian IT by Karen Dearne
IT professionals need to name and shame lazy software developers and refuse to deal with dangerous operating systems instead of pretending more security will defeat steadily increasing cyber-threats, US security consultant Daniel Klein has warned. IN his address at the AusCERT 2009 conference on the Gold Coast yesterday, Mr Klein lambasted operating system designers and security software providers, saying patching and protecting essentially insecure computer software was never going to work "It's not the hackers that are the problem, it's the systems that they're hacking that are the problem," Mr Klein said. "All we've ever done is patch the systems to fix problems when they occur.
19 May 2009 | The Age by Yuko Narushima
AUSTRALIANS are wide open to having their secrets tapped by criminals, a crime analyst warned yesterday, as rising instances of theft and fraud online triggered a new government inquiry.The inquiry's chairwoman, the Labor MP Belinda Neal, said the investigation would focus on consumers, whose growing acceptance of internet banking and shopping had made them more vulnerable. "The prevalence of the internet means the dangers are increasing," she said. "No one can turn on their emails without several messages making requests for identification or saying you've won the lottery." Examples of internet crime include hacking and phishing. Hackers breach private computers, or whole networks, to draw sensitive information.
Security specialist to help NBN build
18 May 2009 | Australian IT by Karen Dearne
FEDERAL Communications Minister Stephen Conroy says IT security specialists will help with the detailed design, operating and identity security arrangements needed to underpin the new National Broadband Network. In particular, supervisory control and data acquisition specialists (SCADA) can expect a boost, in recognition of the heavy reliance now placed on critical infrastructure such as electricity and water supply, banking and finance and aviation. “As more vital services such as health and aged care come to rely on broadband, the security of our networks is of the highest priority,” Senator Conroy told the AusCERT 2009 conference on the Gold Coast today
New Technique’s Gonna Find Out Who’s Spammy or Nice
15 May 2009 | Wired Science by Lizzie Buchen
You are how you e-mail: A new technique can tell people apart using only the timestamps in their Sent folders. In the interactive, real-time world of Twitter, blogs and World of Warcraft, timing is one of the most salient aspects of social behavior. Now, researchers at Northwestern University and Yahoo Research in New York show that they can distinguish and categorize people based solely on the timestamps of their e-mails, paving the way for smarter advertisements, spam filters and social networking sites. “You can’t track everything an individual is doing at every hour of the day,” said Dean Malmgren of Northwestern University, lead author of the study posted May 11 on the pre-publication physics repository, arXiv.
Mac users struggle to install security fix
15 May 2009 | PC Advisor by Gregg Keizer
Mac users installing Apple's recent security update that patched 67 bugs, have reported an unusually high number of problems. According to messages posted on Apple's support forum, some users have had trouble downloading the update, while others have seen their Macs hang with a blue screen during installation. "I've made three [download] attempts, and every one of them has failed with an error message telling me that the digital signature for the package is incorrect, suggesting that it may have been tampered with since being signed," a user identified as 'jposner said. Other users confirmed seeing the same message.
Netbook or laptop? Which is best for portable computing?
15 May 2009 | PC Authority by William Maher
If you're wondering if a netbook is the perfect laptop for you, ask yourself this: will you want to work or play on your new laptop for hours at a time whilst viewing a screen 10 inches in size? With high-end netbooks creeping up to the $1000 mark – and in the case of Sony's Vaio P series, well beyond it – the bigger question is whether you should be buying a netbook at all. What about one that copes well with basic tasks, but gets a bit sluggish when you start opening lots of programs at once – especially if they are processor-intensive tasks such as watching video?
Most Attacks Come From Legit But Hijacked Sites
18 May 2009 | Techworld by John E Dunn
The number of legitimate Websites being hacked to host malware has hit startling highs in recent days, new figures from MessageLabs have revealed. Data taken from the days between May 4 and 8 showed that 84.6 percent of Websites blocked by the company for hosting malicious content were 'well-established' domains that have been around for a year or more. During the same period, 10.2 percent of blocked domains were less than a year old and only 3.1 percent were less than a week old. At first glance this, this runs counter to the assumption that malicious Websites more commonly exist for only days or hours in some cases, the better to avoid detection and filtering. Related News: Web attacks routinely hosted by real websites (15 May 2009 | Techworld by John E Dunn)
PDF Flaw Patched, But Does Anybody Know?
17 May 2009 | Computer World by Gregg Keizer
As expected, Adobe patched a zero-day vulnerability in its popular Adobe Reader software last week, marking the second time in three months that it delivered an update on the same day Microsoft issued its monthly fixes. But while Microsoft's PowerPoint patch received lots of attention, the Adobe update should be at the top of people's to-do list, a security expert said today. "Adobe's is more important than Microsoft's," said Wolfgang Kandek, chief technology officer at Qualys. "Even though Microsoft's had more visibility, if you have to choose between the two, you should patch Adobe. [Reader] is pretty much everywhere, attackers are increasing exploiting it and [PDF] is a widely-used corporate format."
15 May 2009 | CSO by Bill Brenner
What a Botnet Looks LikeResearcher David Vorel mapped interconnected, bot-infected IP addresses and created this geometric representation; CSO contributor Scott Berinato annotated the map and added interactive controls so you can zoom in and explore botnets' inner workings. CSO ran this last year, but it's worth looking at before launching into the new content below. Botnets: 4 Reasons It's Getting Harder to Find and Fight ThemResearchers say vulnerable Web 2.0 applications and peer-to-peer architecture are making it easy for hackers to maintain armies of hijacked computers. USA (and IE) Number 1 for Botnet MayhemResearchers say IT shops aren't doing enough to protect their machines from botnet herders.
Google’s Chrome was ‘hackable’ at Pwn2Own contest
15 May 2009 | Computer World by Gregg Keizer
Although Google's Chrome was the only browser left standing after March's Pwn2Own hacking contest, it was vulnerable to the same bug that a German college student used to bring down Apple's Safari, Google acknowledged this week. Although Google patched the Chrome vulnerability May 7, it waited until last Wednesday to reveal that the bug was the same WebKit flaw that Apple patched the day before. "[We are] disclosing that this release contains the fix for CVE-2009-0945, an issue in WebKit code that also affects Apple's Safari," Mark Larson, the program manager for Chrome, said in a May 13 post. "We did not want to disclose this until Apple's fix for Safari users was released."
13 May 2009 | Network World
At the same time that Apple released an update to Leopard (10.5), the company also fixed a number of security issues for users running Tiger (10.4). Security Update 2009-02 updates several areas of Tiger, including Apache, CoreGraphics, CUPS, Disk images, Flash Player plug-in, Help Viewer, Spotlight, X11, and more. It fixes problems ranging from keeping PDFs opened in CoreGraphics from executing malicious code to preventing maliciously crafted Mach-O executables from causing the Finder to repeatedly terminate and relaunch. There are four version of the update, one each for Tiger client PowerPC and Intel, as well as Tiger Server PowerPC and Universal.
ContactPoint child database goes live despite security fears
17 May 2009 | The Register by John Leyden
Analysis The Government has announced plans to push ahead with the next phase in launch of a controversial child protection database, despite ongoing concerns about the security of data held on the system. The delayed ContactPoint system, which is due to include names and addresses on every child under 18 in England, will be accessed by frontline care workers in real-life trials for the first time from this Monday. Security experts contacted by El Reg remain concerned that information housed on the database might leak out despite ministerial assurances on security provisions that will accompany the roll-out of the directory system.
One in ten UK PCs infected by porn sites
15 May 2009 | PC Advisor by Carrie Ann Skinner
Here's another reason to stay one from porn sites: they're bad for your computer's health. Ten percent of Britons' PCs havce picked up a virus after surfing adult sites. That's according to a survey from comparison site Moneysupermarket, which also found that 19 percent of users have been infected through general surfing while 12 percent of users blamed opening files from unknown senders. Moneysupermarket also revealed that of those infected by viruses. Five percent of respondents said personal information was stolen. James Parker, manager of broadband at moneysupermarket, said: "People need to be more aware of security threats than ever before. Most people use some of their personal details online -
Organized crime cops seek international hacking powers
15 May 2009 | The Register by Chris Williams
British law enforcement agents are quietly working with European counterparts on changes to national legislation that will allow them to share intelligence gained by hacking into suspects' PCs. Sharon Lemon, director of the Serious and Organised Crime Agency's (SOCA) e-crime unit, told The Register data laws in some EU countries make it impossible for investigators to obtain and pool data covertly. The desired change could mean law enforcement officers in eastern Europe could ask SOCA to hack into a suspect's PC for them and share the data. SOCA said its hacking activities are always within the law. Lemon refused to be drawn on the specifics of the techniques the agency uses.
Malware infested MP’s PCs inflate leak risk
15 May 2009 | The Register by John Leyden
Comment "That's one of those irregular verbs, isn't it? I give confidential security briefings. You leak. He has been charged under section 2a of the Official Secrets Act." (Bernard Woolley, Yes Minister) The ongoing MPs' expenses row has brought public opinion of politics and politicians in the UK, never very high, towards unplumbed depths. Embarrassing disclosures about how politicians across the political spectrum subsidised their living expense from the public purse follow hard on the heels of leaked emails regarding a proposed New Labour smear campaign against senior Tories, cobbled together by spin doctors Derek Draper and Brown aide Damian McBride in the style of In the Loop's Malcolm Tucker.
SOCA reveals its online security battle
15 May 2009 | IT PRO by Asavin Wattanajantra
The Serious Organised Crime Agency (SOCA) has revealed more on its fight against serious international cybercriminals this year, particularly its battle against fraudsters forum DarkMarket, in its annual report. SOCA led the UK end of an FBI undercover operation against DarkMarket, which was known to deal with stolen personal information that criminals used to profit. Adewale Taiwo, a Nigerian known as ‘fredbb’ in DarkMarket, admitted causing £600,000 of fraud. He was arrested by Humberside Police and sentenced to five years imprisonment for conspiracy to defraud. As well as the two SOCA operations against DarkMarket members, it also provided intelligence and forensic capability to the City of London, Greater Manchester, South Yorkshire and Humberside Police.
Apple Hires Former OLPC Security Guru
14 May 2009 | CRN by Stefanie Hoffman
The former head of security architecture at One Laptop per Child (OLPC), Ivan Krstic, has taken a job with Apple to help fend off malware threats directed at the Mac platform. Krstic began his job at Cupertino, Calif.-based Apple on Monday. In his new role, Krstic will work on core security and shore up security infrastructure to prevent further malicious attacks targeting the Mac operating system. During his stint as security director for OLPC, a nonprofit aimed at building $100 laptops for millions of children in developing countries, Krstic created the Bitfrost security application, a secure system that wouldn't require tech support and continual security updates.
Gotcha!
Hack suspect challenges privacy of Palin emails
21 May 2009 | The Register by John Leyden
Defence lawyers in the Sarah Palin webmail account hack case intend to claim the Alaskan governor's emails were a matter of public record and therefore enjoyed no expectation of privacy. The novel legal tactic is designed to reduce the seriousness of the charges against their client, David Kernell. Citing an Alaskan court's decision that Palin's private webmail account, allegedly used for government business, ought to be preserved pending the resolution of a lawsuit, lawyers for hack trial defendant Kernell argue that hacking charges against the 20 year-old ought to be dropped or reduced to less serious misdemeanour offences. Kernell's attorney Wade Davies reasons that since mails sent through Palin's webmail account were a matter of public record. Related News: Accused Palin Hacker Says Stolen E-Mails were Public Record (20 May 2009 | Wired.com)
PC Tools Blogs
21 May 2009 | ThreatFire Research Blog
While no product protects against absolutely everything, a couple of technical support people here had links sent from their friends to their Facebook account, telling them to check out "Brunga. at". (Do not visit this site right now to fill out login information, it will steal your credentials.) Subject: Dan Shmoo sent you a message on Facebook… Dan sent you a message.Subject: Hello "Check brunga.at" Screenshot of the site here, notice the blue banner missing the logo
20 May 2009 | ThreatFire Research Blog
A couple of anti-malware firms have grumbled about the number of successful web site attacks a group has been making in order to inject malicious web pages on these victimized sites. These hijacked web sites in turn attack visiting users' web browsers with the goal of downloading and executing more malware hosted on a remote server. Originally the malware hosting site was gumblar.cn, it was changed to martuz.cn, and most likely will change again. The delivered dropper uses an interesting technique to register loaded components for auto start on an unsuspecting user's system. Instead of the usual run key and service locations, this writer decided to abuse a user-mode auxiliary audio driver location that is loaded when Internet Explorer is started.
SoftwareForTubeView Codec Scheme’s Continued Success
15 May 2009 | ThreatFire Research Blog
A rogueware distribution gang known for their use of well known Rbn services and phishing scams continue to maintain a couple of the busiest servers in our daily prevented malware lists. Starting on May 6th, the group moved their downloaders and malware (similarly named to softwarefortubeview.4000.exe) from being served at 195.88.80.41 to exclusively 91.212.65.54. This group appears to be getting quite a bit of traction out of their ongoing FakeAv scheme, in addition to the phishing activities. They started out in late 2008 on 94.247.3.232 with tubeviewer.95.exe.
Tags: Computer Secutiry, Computer Secutiry News, Spyware, Spyware News
