About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
MALAGA, SPAIN–Botnets have been around for more than 15 years now, and for much of that time they’ve been the favored platform for attackers looking to compromise users on a large scale and monetize those infected machines. But now, as researchers and authorities begin to have more success with botnet takedowns and arrests, the attackers behind malware kits and exploit kits are beginning to work together and learn from one another.
Apple has released a massive set of security updates for Mac OS X and a number of other applications, fixing a total of 39 separate vulnerabilities in programs including QuickTime, MobileMe and others. The company also released OS X 10.6.8.
The FBI has made a major dent in the huge scareware and rogue antivirus problem that has been plaguing Internet users for years now, arresting two people and seizing dozens of computers, servers and bank accounts as part of a large-scale coordinated operation in twelve countries.
A certification authority called StartSSL was attacked and compromised recently and forced to suspend the issuance of SSL certificates indefinitely. However, unlike earlier attacks on CAs such as Comodo, the attackers were not able to gain access to the material necessary to issue themselves valid certificates for arbitrary domains.
MALAGA, SPAIN–While the high-profile attacks against RSA, Google and others over the last couple of years has focused a lot of attention on defending against advanced, targeted attacks, the fact remains that most attackers are in fact relying on crimeware packs loaded with commodity exploits for older vulnerabilities that have no trouble bypassing the security systems deployed at the vast majority of enterprises today.
Attackers have begun actively exploiting the critical Adobe Flash vulnerability that Adobe patched last week, using rigged Web pages and phishing techniques to compromise vulnerable machines. The attack code is being hosted on a number of sites around the Web right now, researchers said.
Sega has responded to the attack on its Sega Pass gaming network, saying that data belonging to more than a million of its customers was stolen. The attack on Sega, which came to light last week, is the latest in a string of such compromises of gaming and media companies.
MALAGA, SPAIN–An RSA official on Friday offered more details of the attack the company suffered earlier this year in which thieves made off with key data related to the RSA SecurID two-factor authentication system. The attack, he said, targeted just four employees and was executed by a group he said was highly skilled and experienced.
Dennis Fisher talks with Anup Ghosh of Invincea about the current wave of targeted attacks against high-profile companies such as RSA, the IMF and Citigroup and how the lack of innovation on the defensive side of the fence has made life easier for the attackers.
In an initial hearing to discuss a proposed national data-breach notification bill on Wednesday, representatives and witnesses dissected the SAFE Data Act proposed by Rep. Mary Bono Mack and said that the legislation had a long way to go to be ready for prime time.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
