Dennis Fisher

If the last couple of years of life on the Internet have taught us anything it should be that there’s a lot we don’t know about what’s happening out there. Sure, we know that there are a lot of attacks going on, metric tons of money being stolen and untold terabytes of data being siphoned off, and once in a while we’re even able to figure out who’s doing some of it. But, as the discovery of tools such as Flame and Gauss suggests, there’s a lot of stuff bubbling under the surface that mostly goes unseen.

As researchers continue to pull apart the Gauss malware code, looking for spreading mechanisms and infection vectors, there is still some work being done on Gauss’s cousin Flame, as well. New research from CERT Polska reveals how deeply Flame burrows itself into infected systems, showing that the malware injects various pieces of its code into three threads and hiding its operations behind commonly seen and legitimate processes.

Oracle is warning customers about a vulnerability in the ubiquitous Oracle Database Server that can allow an attacker to gain complete control of the affected server. The CVE-2012-3132 vulnerability is not remotely exploitable by an unauthenticated user.

One of the many mysteries around the discovery of the Gauss malware is why the tool installs a new font called Palida Narrow on infected machines. Researchers have been unable to figure out yet what the purpose of the font is, but as its presence on a PC is a good indicator of a Gauss infection, CrySyS Lab and Kaspersky Lab today released a tool to detect it.

While much of the world was focused yesterday on the Gauss malware saga, there was another interesting infection happening, mainly in the Netherlands, that researchers think may be related to the Zeus and Citadel attacks, though the motivation behind the attack is somewhat of a mystery. The new malware, called Dorifel, has infected thousands of businesses in the Netherlands and Europe and researchers say that it’s stealing online banking data and the crew behind it may be working on some other attack campaigns, as well.

Google has agreed to pay a $22.5 million fine to the Federal Trade Commission to settle charges that the company set tracking cookies on the machines of Safari users, after saying that it would not use such tracking measures or serve targeted ads to the users. The FTC investigation began after a researcher at Stanford University found that Google was bypassing the do-not-track option in Safari. 

A security researchers has discovered a pair of methods that enable him to bypass the protections offered by Microsoft’s EMET anti-exploit technology. The Enhanced Mitigation Experience Toolkit, which Microsoft updated late last month to include one of the three technologies that were finalists in the company’s BlueHat Prize competition, is designed to prevent certain kinds of exploits from hitting software vulnerabilities. But now a researcher has developed two techniques that can bypass the protections.