Ryan Naraine

Microsoft’s Security Development Lifecycle (SDL) team has released two new security tools to help developers test and verify the security of software programs.
The tools — BinScope Binary Analyzer and MiniFuzz File Fuzzer — are available for download at no cost.

Add the Radisson Hotels & Resorts chain to the growing list of businesses [datalossdb.org] reporting significant data breaches that exposed sensitive customer data.
In an open letter [radisson.com] to guests, Radisson chief operating officer Fredrik Korallus said the hotel chain’s computer system was hacked between November 2008 and May 2009 and customer data, including credit and debit card numbers, was stolen.  Read the full story [zdnet.com]

For about 24 hours over the weekend, The New York Times site was serving up fake security software (scareware).
In a message posted to Twitter and a note on its NYTimes.com site, the newspaper blamed a rogue advertisement for the malware blast:

From The New York Times (Riva Richmond)
Corporate information technology departments are prioritizing the wrong threats to their computer systems, focusing on old problems and leaving their companies open to a raft of new cyberattacks targeting sensitive customer and corporate information.
That is the finding of a new biannual report from the SANS Institute, a training organization for computer security professionals, whose senior staff weighed two sets of data that have not been rigorously compared to date: data on the most common attacks hitting corporate networks and data on which vulnerabilities are most prevalent on company networks.  Read the full story [nytimes.com]   Read the full report [sans.org]

Four months after it modified Windows 7 to stop the Conficker worm from spreading through infected flash drives, Microsoft has ported the changes to older operating systems, including Windows XP and Vista.  Read the full story [computerworld.com]

Throughout the last two years, scareware (fake security software), quickly emerged as the single most profitable monetization strategy for cybercriminals to take advantage of. Due to the aggressive advertising practices applied by the cybercrime gangs, thousands of users fall victim to the scam on a daily basis, with the gangs themselves earning hundreds of thousands of dollars in the process. 
This end user-friendly guide aims to educate the Internet user on what scareware is, the risks posed by installing it, how it looks like, its delivery channels, and most importantly, how to recognize, avoid and report it to the security community taking into consideration the fact that 99% of the current releases rely on social engineering tactics.  Read the full story [zdnet.com]