May 26th, 2009

Twitter API ripe for abuse by web worms

Posted by Ryan Naraine @ 12:39 pm

Categories: Anti Virus, Browsers, Data theft, Exploit code, Hirings and firings, Malware, Passwords, Pen testing, Phishing, Punditocracy, Responsible disclosure, Social Networking Applications, Spam and Phishing, Viruses and Worms, Vulnerability research, Web 2.0, Web Applications

Tags: Web, API, Worm, Twitter, Twitpic, Cyberthreats, Viruses And Worms, Security, Ryan Naraine

A security researcher is warning that the Twitter API can be trivially abused by hackers to launch worm attacks.

The red-hot social networking/microblogging service has been scrambling to plug cross-site scripting and other Web site vulnerabilities to thwart worm attacks but, as researcher Aviv Raff points out, it’s much easier to misuse the Twitter API as a “weak link” to send worms squirming through Twitter.

Read the rest of this entry »

May 13th, 2009

Apple snags ex-OLPC security chief

Posted by Ryan Naraine @ 10:33 am

Categories: Anti Virus, Apple, Arbitrary Code Execution, Browsers, Data theft, Exploit code, Hackers, Hirings and firings, Open source, Punditocracy, Research, Uncategorized, iPhone

Tags: Join, Apple Inc., Security, Ryan Naraine

Former director of security architecture at One Laptop per Child (OLPC) Ivan Krstic has joined Apple to help thwart hacker attacks against the Mac operating system.

Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this week and will work on core OS security.  His hiring comes at a crucial time for a company that ties security to its marketing campaigns despite public knowledge that it’s rather trivial to launch exploits against the Mac.

Read the rest of this entry »

May 7th, 2009

Patch Tuesday: Fix coming for PowerPoint zero-day

Posted by Ryan Naraine @ 12:03 pm

Categories: Anti Virus, Arbitrary Code Execution, Complex Attacks, Data theft, Exploit code, Hirings and firings, Malware, Mobile (In)Security, Patch Watch, Responsible disclosure, Vulnerability research

Tags: Microsoft PowerPoint, Microsoft Corp., Microsoft Office, Office Suites, Software, Ryan Naraine

Exactly one month after malicious hackers started using rigged PowerPoint files to launch targeted attacks, Microsoft announced plans to ship a “critical” bulletin affecting its flagship presentation program.

The PowerPoint update is the only bulletin scheduled for this month’s Patch Tuesday on May 12, 2009 .  It is rated “critical” (remote code execution) for all supported versions of Microsoft Powerpoint 2000 through 2007.

Read the rest of this entry »

May 6th, 2009

Layoffs hit Microsoft security unit

Posted by Ryan Naraine @ 2:53 pm

Categories: Anti Virus, Data theft, Hackers, Hirings and firings, Microsoft, Passwords, Pen testing, Punditocracy, Responsible disclosure, Reverse Engineering

Tags: Layoff, Microsoft Corp., Riley, Security, Ryan Naraine

The latest round of layoffs at Microsoft has taken a toll on Redmond’s security unit.

Steve Riley (left),  a senior security strategist who served as one of the public faces of Microsoft’s security efforts, had his position eliminated during the second round of cuts that happened this week.

Riley is best known for his presentations at security conferences and his work on the Protecting Your Windows Network book.

Read the rest of this entry »

April 29th, 2009

Survey: 37% of employees would become insiders given the right incentive

Posted by Dancho Danchev @ 2:23 pm

Categories: Data theft, Hirings and firings, Passwords, Privacy

Tags: Security, Incentive, Insider, Survey, Sales Force Management, Marketing Research, Sales, Marketing, Dancho Danchev

Would you sell sensitive company data if you’re offered the right incentive? Using the current economic situation, or pure greed as an excuse, 37% of  employees surveyed at this year’s Infosecurity Europe event said that they are keeping their options open.

What type of information are they willing to sell, and what kind of incentives are the potential insiders interested in?

Read the rest of this entry »

April 27th, 2009

Is Twitter finally taking security seriously?

Posted by Ryan Naraine @ 9:42 am

Categories: Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Data theft, Exploit code, Hirings and firings, Locally Running Web Servers, Malware, Passwords, Pen testing, Social Networking Applications, Viruses and Worms, Vulnerability research

Tags: Twitter, Cyberthreats, Security, Viruses And Worms, Ryan Naraine

Now that Oprah’s all a twitter, it looks like everyone’s favorite micro-blogging tool is finally taking a hard look at security.

According to a job listing posted online, Twitter is searching for software engineers to focus specifically on application and infrastructure security.

Read the rest of this entry »

March 25th, 2009

Microsoft adds 'Skywing' to Windows defense team

Posted by Ryan Naraine @ 11:57 am

Categories: Arbitrary Code Execution, Complex Attacks, Data theft, Exploit code, Hackers, Hirings and firings, Kernel-level Exploits, Metasploit, Microsoft, Patch Watch, Pen testing, Punditocracy, Research, Responsible disclosure, Viruses and Worms, Vulnerability research, Zero-day attacks

Tags: Team, Microsoft Corp., Defense, Shostack, Microsoft Windows, Operating Systems, Security, Software, Ryan Naraine

Ken ‘Skywing’ Johnson, a well-known hacker famous for his work on bypassing several Windows anti-exploitation mechanisms, has joined the software maker to help make it harder to compromise the operating system.

Johnson, who teamed up with another recent Microsoft hire — Matt ‘Skape’ Miller — on several Uninformed Journal articles on breaking into the Windows OS, will be working on “everything related to vulnerabilities, exploits, defenses [and] bypassing defenses,” according to Microsoft’s Michael Howard.

Read the rest of this entry »

March 18th, 2009

Pwn2Own 2009: Safari/MacBook falls in seconds

Posted by Ryan Naraine @ 4:05 pm

Categories: Apple, Arbitrary Code Execution, Browsers, Complex Attacks, Data theft, Denial of Service (DoS), Hirings and firings, Linux

Tags: Ryan Naraine

[ UPDATE: IE 8 and Safari also fall ]

VANCOUVER, BC — Charlie Miller has done it again.  For the second consecutive year, the security researcher hacked into a fully patched MacBook computer by exploiting a security vulnerability in Apple’s Safari browser.

“It took a couple of seconds.  They clicked on the link and I took control of the machine,” Miller said moments after his accomplishment.

Read the rest of this entry »

March 16th, 2009

BBC botnet buy: What were they thinking?

Posted by Ryan Naraine @ 8:35 am

Categories: Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Complex Attacks, Data theft, Denial of Service (DoS), Exploit code, Governments, Hirings and firings, Locally Running Web Servers, Malware, Passwords, Phishing, Punditocracy, Spyware and Adware

Tags: British Broadcasting Corp., Ryan Naraine

Guest editorial by Roel Schouwenberg

As Dancho Danchev pointed out, the BBC leased itself a botnet. I couldn’t quite believe it when I read it. The BBC, arguably one of the very best TV producers in the world, surely should have known better? There are so many things wrong about this that I hardly know where to start.

Firstly, given their figures, they seem to have spent quite an amount of money purchasing the botnet. Regardless of how much the total sum was, they sponsored the underground economy. Paying money to criminals (for illegal goods) is not only unethical but also considered illegal in most countries. The BBC broke the law right there and then already, not when they actively started using the botnet.

Read the rest of this entry »

September 22nd, 2008

McAfee buys CipherTr-- err, Secure Computing

Posted by Adam O'Donnell @ 8:08 am

Categories: Hirings and firings, McAfee

Tags: McAfee Inc., Secure Computing Corp., Mergers & Acquisitions, Corporate Law, Spam, Financial Accounting, Viruses And Worms, Investment, Finance, Business Operations

Like every other red-blooded American I take a quick peak at my collapsing retirement and savings portfolios in the morning just to give me that extra kick to head into the office. So I pull up Google Finance to see Secure Computing (SCUR) is, up some 23%, one of the big movers for the day. There are very few things that could cause a tech company to jump so much in such a short period of time.
Read the rest of this entry »