Google has pushed out a new version of its Chrome browser to fix a high-severity security hole that could lead to malicious code execution attacks.
The vulnerability could be exploited to run arbitrary code within the Google Chrome sandbox, the company said in an advisory.
A researcher who examined 10,000 Hotmail, MSN and Live.com passwords that were recently exposed online has published an analysis of the list and found that “123456″ was the most commonly used password, appearing 64 times. Read the full story [Kim Zetter/Wired Threat Level] More from Dancho Danchev [zdnet.com]
Security researchers tracking the URL Zone malware/botnet have stumbled upon a new tactic being used by cyber-criminals to hide information on the money mules being used to transfer stolen funds from compromised online bank accounts.
URLZone, which targets computer users in Western Europe, is a botnet of approximately 6,000 hijacked computers that is used primarily to siphon funds from online bank accounts. It steals between $4,000 and $15,000 from each compromised bank account and uses a nifty trick of modifying the withdrawn amount on the bank’s web site to avoid detection by the user.
From the IDG News Service (Dan Nystedt)
A new era of computing is on the rise and viruses, spies and malware developers are tagging along for the ride.
The new playground for hackers is “the cloud,” the term for computer applications and services hosted on the Internet. Some of the devices making the cloud more popular these days are BlackBerries and other smartphones. Read the full story [computerworld.com]
If you use Microsoft’s free Hotmail service, it may be time to change your password: Microsoft said Monday that several thousand Hotmail account credentials were posted online over the weekend.
In a statement posted to its Windows Live Spaces blog, Microsoft said the company has determined that the data spill was not the result of a breach of internal Microsoft data, but rather was likely the haul from a phishing scheme. Read the full story [washingtonpost.com]
From ZDNet (Larry Dignan)
Adobe’s announcements that a full version of Flash is coming to every smartphone not named Apple iPhone leave me conflicted. Full-blown Flash can be a boon to the mobile Web, but has the potential to become one huge security headache. Read the full story [zdnet.com]
According to a report by the Anti-Phishing Working Group (APWG), the number of phishing incidents and rogue anti-malware programs (also known as scareware) are rising at an “unprecedented rate”.
The APWG says that around four fifths of the phishing attack websites claim to offer payment and financial services and in the first half of 2009, a total of more than 485,000 strains of scareware were found. Approximately 22,000 a month were reported in January, rising to over 152,000 in June – indicating a very strong upward trend. Read the full story [h-online.com] See the full APWG report [PDF from antiphishing.org]
The Register’s Dan Goodin has news about a belated but significant move by Google to protect its GMail and other services from CSRF (cross site request forgery) attacks.
In recent days, Google’s login pages began setting a cookie with a unique token on each user’s browser. That same value is also embedded into the login form. If the two don’t match, the user will be unable to log in. Read the full article [theregister.co.uk]
From eSecurityPlanet (Larry Barrett)
Securing data networks is important enough for the majority of companies to hire outside security firms to audit their systems but only about one in three bother to have their network audited every year, according to a new survey conducted by VanDyke Software and independent researcher Amplitude Research.
At time when enterprise companies, government agencies and Average Joes are doing everything they can to protect sensitive data, the survey reveals both an admirable willingness on the part of most IT departments to pony up for external expertise and an astonishing lack of follow through to keep data secure for the long haul. Read the full story [esecurityplanet.com]
Trend Micro researcher Rik Ferguson has discovered a new twist on the old social engineering attacks on Skype — the use of usernames and monikers that appear very, very convincing.
In the latest attacks, which lure computer users to fake anti-virus sites (rogueware), the attackers are using the username “Online Notification” in the Skype chat window.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
