About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
Researchers are tracking a new botnet that has become one of the more active DDoS networks on the Internet since its emergence early last month. The botnet, dubbed “Darkness,” is being controlled by several domains hosted in Russia and its operators are boasting that it can take down large sites with as few as 1,000 bots.
A new paper from researchers at Verizon Business identifies a method through which an attacker can bypass Internet Explorer Protected Mode and gain elevated privileges once he’s successfully exploited a bug on the system.
In this video, Dustin Childs of the Microsoft Security Response Center gives an inside look at what it’s like in Redmond on Patch Tuesday and what goes into the efforts that Microsoft makes to get fixes out every month.
The FBI has arrested the man that they allege is behind the notorious Mega-D botnet, which at one point accounted for nearly a third of all of the spam on the Internet. The arrest came to light this week after the man was caught entering the U.S. last month on his way to a car show.
As browser-based exploits and specifically JavaScript malware have shouldered their way to the top of the list of threats, browser vendors have been scrambling to find effective defenses to protect users. Few have been forthcoming, but Microsoft Research has developed a new tool called Zozzle that can be deployed in the browser and can detect JavaScript-based malware at a very high effectiveness rate.
The main server used to distribute the open-source ProFTPD software was compromised over the weekend through the use of a bug in the FTP software itself, and a backdoored version of the software was uploaded and distributed for several days as a result.
Two weeks after releasing Reader X with its new sandbox security mechanism, Adobe has teamed up with Google to enable a sandboxed version of its Flash software to run in Google Chrome.
Attackers have been using legitimate online services such as VirusTotal and others to check their new pieces of malware against various security suites for some time now, but that’s become less and less effective recently. Now, the creators of some exploit kits are beginning to include less well-known, underground malware-checking services as part of their offerings to buyers of their kits.
A site belonging to the Savannah GNU free software archive was attacked recently, leading to a compromise of encrypted passwords and enabling the attackers to access restricted project material.
Dennis Fisher talks with Gary McGraw of Cigital about the current climate of FUD and rhetoric surrounding cyber war and cyber espionage, the state of software security in the government and military and the potential need for a software Cash for Clunkers program.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
