About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
The inventiveness and avarice of the underground community knows few bounds and one of the latest bits of evidence of this is the creation of a new service designed to help newbies get their Zeus botnets up and running as quickly as possible.
Things are getting curioser and curioser of late at Microsoft. The company is no longer the punch line for every joke in the IT security industry, but now the lessons the company learned in the last 10 years about dealing with researchers and making product security a priority are falling by the wayside.
Just a day after Apple introduced its Mac App Store, some users already have found a way around the DRM system designed to ensure that they have paid for the apps that they’re using. The technique seems to work only on apps that don’t correctly implement the method for checking the App Store receipts.
Microsoft plans to issue just two patches in its monthly scheduled release next Tuesday. Both of the bugs that Microsoft will fix are in Windows and one of them is rated critical, but it doesn’t appear the company will patch the Internet Explorer bugs that have been publicly disclosed.
Apple issued a fix for just one security vulnerability in the release of the latest version of its Mac OS X software on Thursday. OS X 10.6.6 fixes a flaw in PackageKit, a software installation and updating tool.
A security researcher has published a simple method for bypassing one of the sandboxes that Adobe has implemented to prevent Flash files from taking unwanted or malicious actions on users’ PCs.
In response to the embarrassment and perceived threat resulting from the WikiLeaks disclosures in recent months, the Office of Management and Budget has issued a hefty memo with pages of questions that federal agencies must use to conduct an initial assessment of their programs to handle and protect classified information by the end of the month. The document directs agencies to “assess what your agency has done or plans to do to address any perceived vulnerabilities, weaknesses, or gaps on automated systems in the post-WikiLeaks environment.”
The simplistic spam campaign that hit around Christmas and purported to be a holiday greeting from the White House not only included a piece of Zeus-related malware that searches hard drives for documents and uploads them to a remote server, but also appears to be connected to a similar attack from early 2010 that exposed a nascent botnet.
A new spam campaign that appeared shortly before the New Year is part of a new effort by the crew behind the Storm/Waledac botnet and is using some rather elementary tactics–in combination with fast-flux–to attempt to compromise unsuspecting users.
The creators of the Phoenix exploit kit have begun using obfuscation and other techniques to prevent security researchers and others from reverse-engineering the installation process for the kit, adopting a tactic that has become increasingly popular among attackers recently.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
