Ryan Naraine

From C|Net (Elinor Mills)

Cisco Systems wireless local area network equipment used by many corporations around the world is at risk of being used in denial-of-service attacks and data theft, according to a company that offers protection for WLANs.

Researchers at AirMagnet, which makes intrusion-detection systems for WLANs, discovered the vulnerability, which affects all lightweight Cisco wireless access points, as well as the exploit that could be used against networks that have the Over-the-Air-Provisioning (OTAP) feature turned on.  Read the full story [cnet.com]

Security researchers are raising an alarm for a potent malware cocktail — backdoor Trojans and password stealers — being pushed to Windows users from about 55,000 hacked Web sites.

According to Mary Landesman, a researcher in ScanSafe’s security threat alert team, the cybercriminals have embedded a malicious iFrame into tens of thousands of Websites to fire exploits at unsuspecting PC users who surf to one of the rigged sites.

From Computerworld (Michael Scalisi)

While security has never been more important than it is today, the fastest way for an IT professional to become the most despised person in the company is to start enforcing a strong password policy. A policy perceived as overbearing may cause people to write down their passwords on a sticky-note near their computers, circumventing its very purpose. Your policy will be ineffective if your users don’t know how to create strong passwords that are easy to remember.  Read the full story [computerworld.com]

From SC Magazine (Angela Moscaritolo)

Two new rules were created this week requiring health care organizations, and other entities that interact with personal health records (PHRs), to issue notifications in the event of a data breach.

The key rule, issued Wednesday by the U.S. Department of Health and Human Services (HHS), requires health care organizations subject to Health Insurance Portability and Accountability Act (HIPAA) regulations to notify individuals whose information has been breached, when the breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals must be reported to the HHS annually. Read the full story [scmagazineus.com] 

From internetnews.com (Sean Michael Kerner)
 
Tens of millions of people around the world use Adobe’s Flash and PDF reader technologies. How many of them update regularly?

The issue of updated Flash and Adobe Acrobat PDF clients is an important one, as Adobe recently patched both technologies for security vulnerabilities that could expose users to risk. Yet security vendor Trusteer recently examined its own users and found that at least 80 percent were running unpatched versions of Flash and Adobe Acrobat. Read the full story [internetnews.com]

How much does a bot cost these days? Like everything else in our economy, the price of a bot-infected PC fluctuates significantly, based on supply, demand, volume purchased and any number of other factors. But according to research done by the folks at Cisco, bots can be had for as little as 10 cents right now. It’s a buyer’s market.

By Rich Mogull (Macworld)
As a security analyst and researcher, I often find myself exploring some of the darker corners of the Internet. In the course of staying current on security issues, I frequently must browse the sorts of Web sites no average person should go anywhere near; I’m also far more likely to be targeted in an attack. That’s forced me to develop a somewhat extreme approach to safer surfing.  Read the full story [macworld.com]