Google Sues Work@Home Scam Co.
Google filed a lawsuit Monday against a U.S. company it alleges runs
work-at-home scams that unnecessarily charge people’s credit cards and
spoof Google’s brand name. Read the full article. [Computerworld]
Donald Sears
2010: A Conficker Worm Odyssey
Researchers expect Conficker to get worse in the coming year in a number of specific ways including the corruption on defensive systems, keylogging, DDoS, mass identity theft, and more. Read the full article. [Help Net Security]
Web Shopping Sites Get Independent Testing
U-Test has just completed a substantive, independent review of three major e-tailing sites–Amazon, Walmart and Target– and found a gaping cross-site scripting security hole in one of them. Read the full article. [The Last Watchdog]
The websites of NASA’s Instrument Systems and Technology unit and
Software Engineering division were broken into by taking advantage of SQL Injection flaws and poor access controls. Read the full article. [The Register]
Scam e-mail artists have launched a massive campaign to trick
webmasters into giving up the credentials needed to administer their
Web sites, targeting site owners at more than 90 online hosting
providers. Read the full article. [Washington Post]
HSBC Bank says a bug in its imaging software inadvertently exposed
sensitive data about some of its customers going through bankruptcy
proceedings. Read the full article. [Computerworld]
Phishers actually land a tiny percentage of
victims, but the end result is big bucks — to the tune of $2.4 million
to $9.4 million a year, according to a new study that measured real
phishing attacks on banks. Read the full article. [Dark Reading]
A security researcher has released a proof-of-concept attack that
exploits critical vulnerabilities that Apple patched on Thursday; The
vulns stem from bugs in the Java runtime environment that allow
attackers to remotely execute malicious code. Read the full article. [The Register]
An attacker with access to the target computer simply boots from a USB
flash drive and replaces the BitLocker bootloader with a substitute
bootloader which mimics the BitLocker PIN query process but saves the
PINs entered by the user to disk in unencrypted form. Read the full article. [The H Security]
The Defense Department will not meet its end-of-the-year deadline for
removing Social Security numbers from military ID cards as they are issued or
renewed, the Pentagon has confirmed. Read the full article. [Stars & Stripes]
