Just 4% of users of corporate systems abide by IT security policies, even when that system handles very sensitive private information according to an academic survey [pdf] that has revealed humans to be the main flaw in any security system.

Researchers at the University of Wisconsin-Madison and  IT University, Copenhagen found that just 4% of the people surveyed obey best practice rules for passwords. The rest use the same passwords for different systems or use words that appear in the dictionary or write their passwords down on post-it notes beside the computer.  Read the full story [out-law.com]   More »

The botnet masters behind the most efficient social engineering driven botnet, Koobface, launched a new campaign currently spreading across Facebook with a new template spoofing Adobe’s Flash updater embedded within a fake YouTube page.  Read the full story [zdnet.com/Dancho Danchev]   More »

CNet's Elinor Mills has the scoop on a Comcast trial of a new automated service that will warn broadband customers of possible virus infections, if the computers are behaving as if they have been compromised by malware.

For instance, a significant overnight spike in traffic being sent from a particular Internet Protocol address could signal that a computer is infected with a virus taking control of the system and using it to send spam as part of a botnet.  Read the full story [CNet]  Also see this call by a Google executive for ISPs to take the lead on botnet cleanup.   More »

A recently discovered botnet has been caught siphoning ad revenue away from Google, Yahoo! and Bing and funneling it to smaller networks.

According to researchers at Click Forensics, computers that are part of the so-called Bahama Botnet are infected with malware that sends them to counterfeit search pages instead of the real thing. They look authentic, and with the help of DNS poisoning routines, they even display google.com yahoo.com or bing.com in the address bar.  Read the full story [The Register/Dan Goodin]   More »

In a feature article in USAToday, Byron Acohido writes about porous and difficult to defend workplace networks that provide a haven for professional cybercrimals.

Acohido writes: "Overly complex IT systems are producing endless opportunities for cyberthieves, who need only to master simple hacking techniques to get their hands on sensitive data. The result: Data breaches continue to plague companies, hospitals, universities and government agencies — any entity that collects data and conducts business on a digital network."  Read the full story.   More »