ZDNet Must Read:
Consumer Reports urges Mac users to dump Safari
The 2008 edition of Consumer Reports' "State of the Net" report urges Mac users to switch to Firefox or Opera.... Continued »
August 19th, 2008
Scammers caught backdooring chip and PIN terminals
The U.K’s Dedicated Cheque and Plastic Crime Unit (DCPU) have recently uncovered state of the art social engineering
scheme, where once backdoored, chip and PIN terminals were installed at retailers and petrol stations in an attempt to steal the credit card details passing through. Originally, before online banking took place proportionally with the developments on the banker malware front, scammers used to take advantage of old-fashioned ATM skimming and fake keypad devices, which were installed at less popular locations due to the possibility of them getting caught. What this case demonstrates is that even trustworthy locations where you’d assume that a physical breach cannot take place that easily, remain vulnerable.
August 19th, 2008
Android security team appeals to hackers
Already burned by the discovery of serious security vulnerabilities in its SDK, the Android Security Team emerged from the shadows this week with an appeal to the security community for help fixing flaws in the Linux-based mobile platform.
In a note posted to several public mailing lists, the open-source group published a detailed FAQ covering its security philosophy and process and made a direct request for hackers to use responsible disclosure (.pdf) ethics when vulnerabilities are discovered.
August 19th, 2008
China busts hacking ring, managed to penetrate 10 gov’t databases
If you needed a university certificate in China during the last couple of months, there’s a big chance that a group of ten
people could have supplied with you such, going a step further and adding your details in more than ten government databases across different provinces in the country, making $300k in the process.
Shanghai Daily is reporting on this sophisticated group of local hackers who were selling “valid” educational certificates by modifying government databases. How they got caught? Apparently, by cross-checking the validity of the certificate, and since they couldn’t hack each and every database in order to add a reference to it, their business model was quickly detected and shut down.
August 19th, 2008
Fortune 500 companies use of email spoofing countermeasures declining
Here’s a paradox - a technology originally meant to verify the sender of an email message for the sake of preventing
spoofed messages from reaching the network, still hasn’t been embraced by the world’s biggest companies despite being around for years, but is actively used by adaptive spammers increasingly abusing legitimate services in order to take advantage of their identifiable email reputations.
A recently conducted study by Secure Computing’s TrustedSource reveals that, not only a mere 40% of the Fortune 500 companies use Sender Policy Framework and DomainKeys Identified mail, but also, that the ones who’ve implemented the countermeasures aren’t fully taking advantage of protection mechanisms offered at the first place.
August 18th, 2008
DEFCON 16: List of tools and stuff released
Guest editorial by Rob Fuller
DEFCON, the 9000+ attendee hacker conference in Vegas has become a sort of hydra conference. It has become more like a global fair than what most people think of conferences; even the badge is highly unique.
I say this because there are so many things to do at DEFCON, other than going to talks, that you could spend your whole weekend looking at the “World’s Largest Boar!”, so to speak. One of the CTF (Capture the Flag) contest winners this year actually exclaimed that he only made it to 2 talks in 12 years! I am also one of those individuals who barely get a chance to go to talks and now that the speaker pool is so diverse, it’s hard to find all of the “stuff” they release.
August 18th, 2008
uTorrent silently patches critical vulnerability
If uTorrent is the client you use to download files, now might be a good time to hit that “check for updates” button.
According to security alerts aggregator Secunia, there’s a “highly critical” uTorrent vulnerability that could allow remote code execution attacks with rigged .torrent files.
From the advisory:
August 18th, 2008
Adobe Flash ads launching clipboard hijack attack
Malicious hackers are using booby-trapped Flash banner ads to hijack clipboards for use in rogue security software attacks.
In the Web attacks, which target Mac, Windows and Linux users running Firefox, IE and Safari, hackers are seizing control of the machine’s clipboard and using a hard-to-delete URL that points to a fake anti-virus program.
According to victims on several Web forums, the attack is coming from Adobe Flash-based advertising on legitimate sites — including Newsweek, Digg and MSNBC.com.
Here is a Mac OS X user explaining the attack:
August 18th, 2008
From Metasploit to Microsoft: Skape goes to Redmond
Metasploit developer Matt Miller, who for years frustrated Microsoft officials with the public release of Windows exploits, is heading to Redmond to join Microsoft’s Security Science team.
Miller, who uses the hacker moniker Skape,will work on improved ways to find security vulnerabilities and better software defenses through mitigations, according to an announcement by SDL guru Michael Howard.
August 18th, 2008
Fedora infrastructure breach?
Has there been a security breach in Red Hat Fedora’s infrastucture systems?
According to a cryptic announcement posted to the Fedora-Announce mailing list, the open-source group is investigating an unspecified “issue in the infrastructure systems” that has resulted in widespread service outages.
In the note, Fedora maintainers recommend that end users avoid downloading packages on Fedora systems, which strongly hints at a security-related problem:
August 18th, 2008
Security vs. convenience: Apple chooses poorly
Guest post by Oliver Day
My PowerBook is in the third year of its life and has begun falling apart on a regular basis. I’ve had the laptop in for repair at least five times this year alone.
Every time I bring my laptop in Apple employees ask me the same question: “What is your administrator password?”
The first time I heard this question, I thought he was joking. Apple is not kidding.
See his full profile and disclosure of his industry affiliations. Send tips, ideas and feedback to naraine SHIFT 2 gmail.com
For daily updates on Ryan's activities, follow him on Twitter.
Recent Entries
- Scammers caught backdooring chip and PIN terminals
- Android security team appeals to hackers
- China busts hacking ring, managed to penetrate 10 gov’t databases
- Fortune 500 companies use of email spoofing countermeasures declining
- DEFCON 16: List of tools and stuff released
Most Popular Posts
- Web worms squirm through Facebook, MySpace
- Coordinated Russia vs Georgia cyber attack in progress
- Adobe: Beware of fake Flash downloads
- Microsoft plugs IE, Office in big patch haul
- Where on earth are these Microsoft patches?
- MS Patch Tuesday: Critical IE, Office, Excel patches coming
Top Rated
- Web worms squirm through Facebook, MySpace+45 votes
- Escapee 'Spam King' dead in apparent murder-suicide+26 votes
- Adobe: Beware of fake Flash downloads+24 votes
- DNS cache poisoning attacks exploited in the wild+23 votes
- Adobe Flash ads launching clipboard hijack attack+18 votes
- How OpenDNS, PowerDNS and MaraDNS remained unaffected by the DNS cache poisoning vulnerability+17 votes
- 'Spam King' escapes from federal prison+17 votes
- Microsoft plugs IE, Office in big patch haul+16 votes
Premier Vendor Content Whitepapers, webcasts & resources from our Power Center Sponsors
- Access the latest Intel and industry best practices
-
Designed specifically to address the concerns of senior IT managers at organizations with more than 100 employees, the Intel Premier IT Professional Program provides best practices via local and e-Seminars and a members-only Web site.
- View the Intel Premier IT Professional web-site tour >>
Archives
ZDNet Blogs
- A Developer's View
- All About Microsoft
- The Apple Core
- Between the Lines
- BriefingsDirect
- Collaboration 2.0
- The Core Truth
- Dev Connection
- Digital Cameras
- Ed Bott's Microsoft Report
- Emerging Tech
- Enterprise Alley
- Enterprise Anti-matter
- Enterprise Web 2.0
- Feeds
- Googling Google
- GreenTech Pastures
- Hardware 2.0
- iGeneration
- Irregular Enterprise
- IT Facts
- The IT Grind
- IT Project Failures
- Laptops & Desktops
- Lawgarithms
- Linux and Open Source
- Managing L'unix
- The Mobile Gadgeteer
- On Sustainability
- Rational Rants
- The Semantic Web
- Service Oriented
- The Social Web
- Software as Services
- SOHO Networking
- Storage Bits
- Team Think
- Tech Broiler
- Tom Foremski: IMHO
- The ToyBox
- The Universal Desktop
- Virtually Speaking
- The Web Life
- ZDNet Education
- ZDNet Government
- ZDNet Healthcare
- Zero Day
SponsoredWhite Papers, Webcasts, and Downloads
- Sprint IPVoice Connect Fact Sheet Sprint
- Advances in Data Warehouse Performance: I/O Elimination in DB2 IBM
- SUSE Linux Enterprise Server: The Solution for Mission-critical Computing Novell
- BNET Industries
- Check out BNET's newest resource for managers and executives. Need to do research on your competitors? Don't have time to read every trade pub? BNET Industries is the new source for daily news, insights, and research on 11 major industries and 9,000 public companies.
-
- The technology industry from a different angle
-
- See what's hot in the auto industry
-
- Stay on top of the energy industry
