Dennis Fisher

One of the key infection methods for the Stuxnet worm was hard-coded to stop working on June 24, removing one of its techniques for propagation. Researchers say that the date, which is found in coded form in the worm’s instructions, is nearly three years to the day from the date that the first version of Stuxnet was seeded.

Security researchers have come across a new worm that is meant specifically to steal blueprints, design documents and other files created with the AutoCAD software. The worm, known as ACAD/Medre.A, is spreading through infected AutoCAD templates and is sending tens of thousands of stolen documents to email addresses in China. However, experts say that the worm’s infection rates are dropping at this point and it doesn’t seem to be part of a targeted attack campaign.

Bank robbers have a clear motivation for their crimes: money. It’s there for the taking; all you have to do is get to it. But there are a lot of inherent risks involved with robbing banks, and, as a new study shows, not a great deal of return. And yet people keep robbing banks. In cybercrime, the motivation is the same, the rewards are huge and the risk of being caught is far lower. So the question is, why isn’t cybercrime worse?

The unpatched vulnerability in Internet Explorer’s MSXML component that Microsoft warned users about earlier this month is being used in attacks that employ malicious Flash files. Researchers say that the attacks are taking the form of drive-by downloads launched from compromised legitimate sites.

PayPal is the latest company to join the ranks of software vendors and Web properties that offer bounties to security researchers who privately disclose new bugs to them. The company isn’t saying how much it will pay for each bug, just that its security team will determine the severity of each flaw as well as the ultimate payout.

There is a line of thinking that pervades and pollutes the discussions of many sporting events, and it goes something like this: “You can’t let LeBron James/Derek Jeter/Lionel Messi beat you. You have to force someone else to beat you.” It’s a flawed strategy for a number of reasons, but it’s even more problematic when you realize that this same mentality could be applied to information security.

Microsoft has announced the three finalists for its $200,000 Blue Hat Prize contest and all three of the researchers in the running for the win submitted technologies designed to defeat ROP (return-oriented programming) exploits. Each of the entrants takes a different tack with his ROP defense and it will be another month before Microsoft announces at Black Hat which of them will take home the $200,000 top prize.