Punditry
October 16, 2009, 7:29 AM

Outlook Web Access Attack Using Pushdo Botnet

By Sergey Golovanov

Here are some technical details on the Outlook Web Access phishing scheme.

1. The Spam

According to our preliminary research, the spam emails which attacked OWA users, including Kaspersky, were sent using the pushdo botnet – which is based on malware from the Backdoor.Win32.NewRes family. These Trojans spread via spam, social networks (in conjunction with the Koobface family) and through hacked websites.   More »

  • Comment
October 15, 2009, 8:47 AM

Abdicating on a Cyber Security Czar?

In May, President Obama completed his long-awaited "cyberspace policy review," concluding that cyberspace is a strategic asset that must be safeguarded from attack as a national security priority. 

The president promised to appoint a permanent "cyber czar" who would coordinate the work of federal agencies charged with protecting us. But since "acting cyber-security czar" Melissa Hathaway resigned in August, the post has been unfilled.  Why?   Read the full op-ed [LA Times/James D. Zirin]   More »

  • Comment
October 14, 2009, 7:48 AM

October Microsoft Patch Tuesday Has Something for Everyone

By Jason Miller

Microsoft has released 13 new security bulletins in the October 2009 version of Patch Tuesday.  Eight bulletins have a severity rating of Critical. The remaining five security bulletins have a severity rating of Important. For the first time, Windows 7 and Windows 2008 R2 are affected by security bulletins. The sheer volume of bulletins and subsequent patches this month will likely give administrator fits.   More »

  • Comment
October 13, 2009, 10:57 AM

The Business of Phishing

By Michael Molsner

Today I got a 'Anti-virus notification message' from our mail server (protected by kav4lms) so naturally I was interested in what the content was. Examining the quarantined mail on the server revealed some interesting details starting from the mail header itself.   More »

  • Comment
October 9, 2009, 8:37 AM

Analysis: Phishing Arrests Highlight Massive Problem

The massive phishing scam broken up by federal authorities this week is only a hint at what many say is an insidious and growing problem on the Internet. The bust, dubbed Operation Phish Phry, was described by the FBI as the largest ever cyber-crime investigation and they held it up as a shining example of international cooperation in the realm of cybersecurity.

But as important and impressive as it was, the arrests barely scratch the surface of the phishing problem, according to several who have been tracking the issue for years.  Read the full story [IDG News Service/Jaikumar Vijayan]   More »

  • Comment
October 6, 2009, 4:09 AM

Better Security Through Diversity of Thinking

By David Mortman

Inspired by professional pastry chef Shuna Fish Lydon:

"You do not know what a good, bad or indifferent baker/pastry chef you are until you work alongside someone who is better/worse than you. This is not at all to say that if you are an outstanding home baker, you are deluding yourself. But as far as professional cooking & baking go, it is my experience that unless you push yourself really hard to stay away from your sweet spot comfort zone of I-Know-All-I-Need-To-Know-And-I-Feel-Very-Comfy-In-This-Job/Kitchen-Thank-You-Very-Much, and move kitchens or chefs or hire people who are much closer to your level than you feel comfortable having them, you will become stagnant in your baking skill and knowledge."   More »

  • Comment
October 5, 2009, 8:51 AM

The Security Nightmare of a Flash Monoculture

From ZDNet (Larry Dignan)

Adobe’s announcements that a full version of Flash is coming to every smartphone not named Apple iPhone leave me conflicted. Full-blown Flash can be a boon to the mobile Web, but has the potential to become one huge security headache. Read the full story [zdnet.com]   More »

  • Comment
September 28, 2009, 6:39 AM

The Difficulty of Un-Authentication

By Bruce Schneier

In computer security, a lot of effort is spent on the authentication problem.  Whether it’s passwords, secure tokens, secret questions, image mnemonics, or something else, engineers are continually coming up with more complicated -- and hopefully more secure -- ways for you to prove you are who you say you are over the Internet.   More »

  • Comment
August 13, 2009, 8:20 AM

An Open Letter to Heartland CEO Robert Carr

By Rich Mogull (Securosis)

Mr. Carr,

I read your interview with Bill Brenner in CSO magazine today, and I sympathize with your situation. I completely agree that the current system of standards and audits contained in the Payment Card Industry Data Security Standard is flawed and unreliable as a breach-prevention mechanism. The truth is that our current transaction systems were never designed for our current threat environment, and I applaud your push to advance the processing system and transaction security. PCI is merely an attempt to extend the life of the current system, and while it is improving the state of security within the industry, no best practices standard can ever fully repair such a profoundly defective transaction mechanism as credit card numbers and magnetic stripe data.   More »

  • Comment
August 12, 2009, 6:53 AM

Twitter and Adobe Struggle With Security

By Roel Schouwenberg

On Tuesday we got another DDoS attack on Twitter. A lot of people are asking why Twitter doesn't seem to be coping with attacks like these. And at the same time there are more and more people jumping on the bandwagon saying stay away from Adobe products.   More »

  • Comment
August 11, 2009, 1:00 PM

Inside Microsoft Patch Tuesday: Revenge of the ActiveX Controls

By Eric Schultze

Microsoft has released nine bulletins today, five of them Critical, four of them Important. The bulletins cover a gamut of affected products - almost everything in your enterprise will need to be patched today with the exception of Internet Explorer. No IE patches this month! The majority of bulletin releases these days relate to client-side vulnerabilities – visit an evil website, open an evil document, or read an evil email and you’ll get hacked. These vulns are of greatest concern on the desktop where end users are filling time between Mafia Wars power-ups and Facebook updates by visiting websites that may be hosting content of questionable repute. This month, there are five bulletins addressing these types of issues.   More »

  • Comment
August 10, 2009, 6:55 AM

The Value of Self-Enforcing Protocols

By Bruce Schneier

There are several ways two people can divide a piece of cake in half.  One way is to find someone impartial to do it for them.  This works, but it requires another person.  Another way is for one person to divide the piece, and the other person to complain (to the police, a judge, or his parents) if he doesn’t think it’s fair.  This also works, but still requires another person – at least to resolve disputes.  A third way is for one person to do the dividing, and for the other person to choose the half he wants.   More »

  • Comment

Blogger Bio

About Punditry

A handpicked group of computer security researchers, executives and analysts use this blog to offer hard-hitting commentary on hot topics of the day.

 

more

Stay Connected