Dennis Fisher

A day after the Internet was abuzz with protests of the proposed SOPA and PIPA anti-piracy bills, the Department of Justice took a major action against many of the top executives of Megaupload, a popular file-sharing site that the government says was the basis for an “international organized criminal enterprise allegedly responsible for massive worldwide online piracy of numerous types of copyrighted works”. Prosecutors revealed indictments against seven people, all of whom are foreign nationals, as part of the case. As a result of the indictments and shutdown of Megaupload, Anonymous retaliated with a series of DDoS attacks against sites owned by Justice, Universal Music and the Motion Picture Association of America.

The crew behind the Koobface worm, who have been quite open about their exploits and financial gains from their work in the past, now seem to be ducking underground as pressure is building on them in the wake of exposures of their operation and real identities. The command-and-control server used to run the Koobface botnet, known as the Mothership, is now offline and new infections seem to have dropped off, experts say.

The ongoing controversy surrounding the SOPA and PIPA anti-piracy bills in Congress has produced a lot of things: misunderstanding of what the bills would do; silly rhetoric from trade groups supposedly defending content creators; confusion on Capitol Hill; and a clear demonstration of how insulated and uninformed many citizens are. But perhaps the worst thing to come out of all of this is the almost comical picture it paints of Congress and its complete lack of understanding of the Internet and its role in society, business and freedom.

There’s an odd bit of behavior that some Windows systems will exhibit when certain kinds of installers are launched, automatically elevating the privileges of the installer process to system-level privileges. In theory, the issue shouldn’t be exploitable because at one point in the process the system will generate an MD5 hash of a DLL that’s to be loaded, and unless the attacker can replace that DLL with a malicious one that sports the same hash, an attack is impossible. But those constraints may not hold for all attackers, a researcher says.

Oracle on Tuesday unleashed its quarterly critical patch update, which included just two fixes for vulnerabilities in its Oracle Database Server, one of the lower totals seen from the company in recent years. There are a total of 78 patches for a wide variety of Oracle products available today, including Fusion, PeopleSoft and the Sun Product Suite.

One of the wonderful things about some pieces of malware is that, like that slightly dodgy uncle who never seems to have a job, they never really go away. They just sort of hang about in the background, waiting for the right time to hit you up for some spare cash or CPU cycles. It appears that the once-celebrated and now nearly forgotten Conficker malware has entered that realm.

MIAMI BEACH–It’s the accepted wisdom these days that many of the traditional security defenses organizations depend on just aren’t effective at deterring attackers. But this glosses over the fact that the last few years have included some major advances in defensive technologies, including the widespread adoption of exploit mitigations such as ASLR and DEP and the use of sandboxes in many applications. However, as these advances have made their way into the mainstream, the folks on the offensive side of the game have not been sitting idly by, either, as was made abundantly clear during the talks at the Infiltrate conference here.