About
"Distrust and caution are the parents of security" - Benjamin Franklin
Federal agents on Monday raided the Melrose, Massachusetts home of a missile systems expert who formerly worked at U.S. defense
contractor Raytheon. Several boxes of items were taken by FBI and Immigration
and Customs Enforcement agents from the home, which is owned by Richard M. Lloyd.
This week seemed to be all about the numbers as a handful of reports were released, disclosing new stats on phishing, information theft and spam. Evercookies, the inside story of SQL Slammer, and of course, the usual array of patches, rounded out the week. Read on for the full week in review.
Customers of an Italian bank were lured into a phishing scam with promises of mobile phone airtime credits, according to a blog post from analyst Mathew Maniyara on Symantec’s Connect blog.
Spammers always need fresh lists of e-mail addresses, says
Steve Santorelli of Team Cymru. Supplying them is a lucrative underground
business in its own right. The easy availability of such lists and the
commodity prices they fetch is a sign of how well developed the underground
economy really is. In this strip, a spammer negotiates for a list of one
million e-mail addresses. The final price: 100 addresses for a little more than
a penny.
Dennis Fisher and Paul Roberts discuss the controversy over the HTC G2 code modification, America’s supremacy in the rankings of bot-infested countries and the viability of the new Exploit Hub as a business.
Patches – and plenty of them – took center stage this week
as two big software companies shipped substantial updates. Some alarming news
also broke regarding the growing number of botnets operating out of the U.S. Read on for the full week in review.
The Stuxnet buzz continued this week, Adobe took a few steps toward better security and Microsoft announced plans for its largest Patch Tuesday ever. But it wasn’t just Microsoft, Adobe and everyone’s favorite worm grabbing headlines. Read on for the full week in review.
FTP Flaw Could Disable Wide Range of ServersAn easily exploitable flaw exists that could enable an anonymous hacker to cause a denial of service on many common FTP server platforms , including some public FTP servers run by software giants Adobe and HP, according to a report published by SecurityReason.. The vulnerability affects a wide range of FTP servers, including those by OpenBSD (V 4.7), NetBSD (V 5.0.2), FreeBSD (V 7.3/8.1), Oracle’s Sun Solaris 10 and GNU Libc, used by some leading software vendors.The vulnerabilityexists in the glob() function, which is used to enable wildcard searches by file names. When exploited the hole can cause servers to become slow, unresponsive and even crash. Acccording to the report (http://securityreason.com/securityalert/7822) from Maksymilian Arciemowicz, a security researcher with SecurityReason, the error boils down to a problem with GLOB_LIMIT, a component created in 2001 to help reduce memory used by glob(). The faulty GLOB_LIMIT clogs up memory with errant patterns that leads to the attack.Arciemowicz said well trafficked sites such as ftp.openbsd.org, ftp.netbsd.org, ftp.freebsd.org, ftp.adobe.com, ftp.hp.com and ftp.sun.com are all vulnerable to denial of service attacks using the glob() function. Those sites often allow anonymous logins, making attacks even easier.Unlike previous FTP attacks like Gumblar, which remotely steals credentials, the GLOB flaw does not allow remote code to be executed on the affected system and does not appear to be widespread. A patch has yet to be issuedThe H Security has more details about the flaw.An easily exploitable flaw exists that could enable an anonymous attacker to cause a denial of service on many common FTP server platforms, according to a report published by SecurityReason.
Toronto, Ontario, Canada
Billed as “Canada’s Premiere IT Security
Conference” (they might want to ask the CanSecWest folks about that), SecTor is
an annual security confab that draws some of the top security researchers and
IT professionals from the Great White North and the U.S. to Toronto for
training and a two day conference. Smaller and more mellow than shows like
BlackHat, SecTor offers a great lineup of top tier speakers and sessions
without the insanity of its larger kin south of the border.
Cleveland, Ohio
A hacker con in the truest sense, this
Cleveland, Ohio, based conference takes place in April and combines sessions on
traditional IT security with craftier fare like the convergence of clothes,
fashion and hacking, biomimicry and mimetic engineering. Now in its eighth
year, Notacon says its goal is “to apply technology to
graphics, art, music, or social interaction. “
(Check it out at http://www.notacon.org/ – and PLEASE note that
.ORG!! 😉 )
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
