ZDNet Must Read:
Google fixes critical XSS vulnerability
Hours after a proof of concept example detailing a XSS vulnerability at Google's account login page was posted at the XSS Project's clearing house, the company quickly took notice and... Continued »
November 20th, 2008
Under worm attack, US Army bans USB drives
Under sustained attack from what is described as a rapidly spreading network worm, the U.S. army has banned the use of USB sticks, CDs, flash media cards, and all other removable data storage devices, according to internal e-mail messages seen by Wired’s Noah Shachtman.
According to the article, service members have been ordered to “cease usage of all USB storage media until the USB devices are properly scanned and determined to be free of malware.” Eventually, some government-approved drives will be allowed back under certain “mission-critical,” but unclassified, circumstances. “Personally owned or non-authorized devices” are “prohibited” from here on out, according to the e-mails.
November 19th, 2008
What does the spam ISP shutdown really mean?
It has been over a week since the takedown of an ISP responsible for directing a large portion of Internet’s spam. While many groups immediately hailed a massive drop in spam, the true story was more nuanced.
Read the rest of this entry »
November 19th, 2008
Malware found in Lenovo software package
Computer maker Lenovo is shipping a malware-infected software package to Windows XP users, according to warning from anti-virus researchers at Microsoft.
The malicious file was identified by Microsoft as Win32/Meredrop, a Trojan dropper that is used to install and execute multiple malicious executables on an infected computer. Other anti-virus vendors are detecting the threat as a ‘hooligan’ virus or a porn dialer. It was found the Lenovo Trust Key software for Windows XP, a digitally signed driver package available to Windows XP SP2 users.
November 18th, 2008
Fake Windows XP activation trojan goes 2.0
Known as Kardphisher and “in the wild” since April, 2007, last week the malware author of this trojan horse mimicking the Windows XP activation interface while collecting the credit card details the end user has submitted, has made significant changes to visual interface and usability of the trojan, consequently improving its authenticity. Guess what happens when a gullible end user falls victim into this social engineering attack?
November 18th, 2008
Commercial vendor of spyware under legal fire
Just like every decent marketer out there, vendors of commercial malware tools are very good at positioning their tools. However, their pitches often contradict with themselves in a way that what’s promoted as a Remote Administration Tool, has in fact built-in antivirus software evading capabilities, rootkit functionality and tutorials on how to remotely infect users over email.
This fake positioning is finally receiving the necessary attention. CyberSpy Software LLC, a popular vendor of such commercial spyware tools has been recently targeted by the U.S Federal Trade Commission, with the company’s sites shut down already. Wish it was that simple.
November 18th, 2008
What really happened to the candidates’ computers?
Now that two weeks have passed since the end of the presidential campaigns, it is worthwhile to take a look at what I think should have one of the biggest cybercrime stories of the year. As Ryan blogged the day after the election, both the McCain and the Obama campaigns’ systems were compromised by an external party, and this compromise lead to a massive data exfiltration. If these reports turn out to be true, the attack is a huge coup for the attacking party.
Read the rest of this entry »
November 18th, 2008
Microsoft kills OneCare, replaces it with freebie ‘Morro’
Microsoft today announced plans to kill its Windows Live OneCare PC care and security suite and replace it with a free anti-malware utility.
The new product, code-named “Morro,” will be designed for a smaller footprint that will use fewer computing resources, making it ideal for low-bandwidth scenarios or less powerful PCs, Microsoft said its surprise announcement.
Retail sales of Windows Live OneCare, which offered non-security PC care features such as printer sharing, data backup and automated PC tune-up, ends on June 30, 2009.
November 17th, 2008
Anti fraud site hit by a DDoS attack
The popular British anti-fraud site Bobbear.co.uk is currently under a DDoS attack (distributed denial of service attack) , originally launched last Wednesday, and is continuing to hit the site with 3/4 million hits daily from hundreds of thousands of malware infected hosts mostly based in Asia and Eastern Europe, according to the site’s owner. Targeted DDoS attacks against anti-fraud and volunteer cybercrime fighting communities clearly indicate the impact these communities have on the revenue stream of scammers, and with Bobbear attracting such a high profile underground attention, the site is indeed doing a very good job.
November 17th, 2008
Adobe AIR hits ‘critical’ security turbulence
Buried in today’s flurry of feel-good Adobe news is this less flattering nugget: Adobe AIR is vulnerable to several critical vulnerabilities that could expose users to code execution attacks.
The company released AIR 1.5 with fixes for previously discussed flaws in Flash Player (which is embedded into AIR) and a patch for a separate issue that allows the execution of untrusted JavaScript with elevated privileges.
As this bulletin explains, the issues are all remotely exploitable:
November 17th, 2008
Apple turns to Google for Safari anti-phishing
Apple has quietly teamed up with Google to add anti-phishing features into the latest version of the Safari browser.
The feature, turned on by default in Safari 3.2, displays a warning page (see screenshots below) when Safari users surf to a fraudulent Web site. It is powered by Google’s blacklist of fake Web sites that are used to steal user credentials for banking and other finance-related Web sites.
For daily updates on Ryan's activities, follow him on Twitter.
SponsoredWhite Papers, Webcasts, and Downloads
- IT Disaster Recovery with Data Domain and Simply Continuous Simply Continuous
- F5 Demo: F5 and VMware Virtualization Technology F5 Networks
- How to disappoint your HIPAA auditors and gain the respect of your board of directors (Not necessarily in that order) DataMotion, Inc.
Essential Topics 
Recent Entries
- Under worm attack, US Army bans USB drives
- What does the spam ISP shutdown really mean?
- Malware found in Lenovo software package
- Fake Windows XP activation trojan goes 2.0
- Commercial vendor of spyware under legal fire
Most Popular Posts
- MS08-067 worms squirming in the wild
- MS ships emergency patch for Windows worm hole
- Heads up: Patch your Adobe Reader now
- Patch Tuesday heads up: Critical Windows, Office fixes coming
- Black market for zero day vulnerabilities still thriving
- Code execution flaws haunt OpenOffice
Top Rated
- MS ships emergency patch for Windows worm hole+80 votes
- Rigged PDFs exploiting just-patched Adobe Reader flaw+25 votes
- CNET Download.com not so 'spyware-free'+17 votes
- MS08-067 worms squirming in the wild+16 votes
- Heads up: Patch your Adobe Reader now+15 votes
- Exploit published for Windows worm hole+14 votes
- Firefox security makeover: 11 vulnerabilities, 4 critical+14 votes
- Newsweek: Obama, McCain campaigns hacked by 'foreign entity'+13 votes
Premier Vendor Content Whitepapers, webcasts & resources from our Power Center Sponsors
- Intel Xeon 7400 highlights available now!
-
With key platform innovations built-in, the Intel Xeon processor 7400 series offers more headroom, reliability, and the highest expandability for large-scale server consolidation. See highlights from Summer IDF, SAP Tech-Ed, VMWorld, and more.
- Get blogs, videos and more from past tech events >>
Archives
ZDNet Blogs
- A Developer's View
- All About Microsoft
- The Apple Core
- Between the Lines
- BriefingsDirect
- Collaboration 2.0
- Community, Incorporated
- The Core Truth
- CRM 2.0: The Conversation
- Dev Connection
- Digital Cameras
- Ed Bott's Microsoft Report
- Emerging Tech
- Enterprise Alley
- Enterprise Anti-matter
- Enterprise Web 2.0
- Feeds
- Forrester Research
- Googling Google
- GreenTech Pastures
- Hardware 2.0
- Home Theater
- iGeneration
- Irregular Enterprise
- IT Facts
- The IT Grind
- IT Project Failures
- Laptops & Desktops
- Lawgarithms
- Linux and Open Source
- Managing L'unix
- The Mobile Gadgeteer
- On Sustainability
- Rational Rants
- The Semantic Web
- Service Oriented
- Smartphones and Cell Phones
- The Social Web
- Software & Services Safari
- Software as Services
- SOHO Networking
- Storage Bits
- Team Think
- Tech Broiler
- Tom Foremski: IMHO
- The ToyBox
- The Universal Desktop
- Virtually Speaking
- The Web Life
- ZDNet Education
- ZDNet Government
- ZDNet Healthcare
- Zero Day
Fusion
- There’s a new energy coming from the people of AMD. Its the power of Fusion.
- Learn about the power of fusion at work and the industry-changing impact of accelerated computing.
-
- View AMD video, case studies, blogs, forums, and more on ZDNet »
-
