“Job candidates are willing in this market to give any information they can that would help them get a job,” said Ellen B. Vance, an HR consultant and auditor who advises companies on how to safeguard applicant and employee information.
The instinct is natural, but it can leave you vulnerable to identity theft. Read the full story [theladders.com]
An ongoing attack on Google users is sending victims to rogue anti-virus software sites, researchers said this week.
The attack takes advantage of Google’s page-ranking feature, according to researchers at eSoft’s Threat Prevention Team. The scam works like this: An attacker hacks a site, but instead of embedding exploits on the hacked site, they put links to other websites to boost rankings for malicious sites, and Google users in particular seem to be the targets. Read the full story [scmagazineus.com]
Security researchers are reporting on an ongoing scareware serving campaign abusing the popular micro-blogging service Twitter.
Hundreds of tweets using four different URL shortening services are currently spammed through the automatically registered Twitter accounts, relying on a pseudo-random text generation using Twitter’s trending topics. Read the full story [zdnet.com]
GENEVA — Head of Google’s anti-malvertising team Eric Davis wants Internet Service Providers (ISPs) to look beyond profits and take a more proactive approach to dealing with malware-infested computers on their networks.
During a keynote presentation at the Virus Bulletin conference here, Davis said competitors in the ISP space must look beyond profits and partner on new initiatives to deal with the “parasites” that have taken control of the Internet landscape.
Apple has shipped iTunes 9.0.1to fix a critical security hole that puts Mac and Windows users at risk of computer takeover attacks.
The vulnerability could be used by hackers to launch code execution attacks via booby-trapped “.pls” files, Apple warned in an advisory.
Gamers trying to update their mouse or keyboard drivers from accessory maker Razer USA’s Web site recently may have gotten more than they bargained for.
According to the IDG News Service, the company’s computers appear to have been hacked, and its support site used to spread malicious Trojan horse programs. Customers who downloaded Razer software would get the drivers they requested, but they also got an obscure Trojan program.
From PC Mag (Larry Seltzer)
Just when we were getting the point across that you need to be careful about what links you click on, along comes the new phenomenon of shortened links through redirection services, making it that much harder to be careful. There are products and services that can help though.
The success of these services has been driven mostly by Twitter, whose 140 character limit on posts makes it important for links to be as short as possible. The fact remains that when you click on a shortened link you don’t know where you will end up. Read the full story [pcmag.com]
A new botnet, codenamed the ‘Bahama’ botnet has been linked to the recent surge in click-fraud and scareware attacks. This video by researchers at Click Forensics shows the Bahama Botnet in action. More on this botnet in this report.
Security researchers at penetration testing firm Immunity have created a reliable remote exploit capable of spawning a worm through an unpatched security hole in Microsoft’s dominant Windows operating system.
A team of exploit writers led by Kostya Kortchinsky attacked the known SMB v2 vulnerability and created a remote exploit that’s been fitted into Immunity’s Canvas pen-testing platform. The exploit hits all versions of Windows Vista and Windows Server 2008 SP2, according to Immunity’s Dave Aitel.
Mozilla’s move to nudge Firefox users into updating the browser’s Flash Player plug-in has been a phenomenal success with about 10 million users clicking through to the Web page with Adobe’s patch.
Mozilla released some brief statistics to track the success of its new program, which serves up a visual warning to Firefox users if their version of the ever-present Adobe Flash Player plug-in is out of date. The program started last week with the releases of Firefox 3.5.3 and Firefox 3.0.14.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
