Ryan Naraine

Two of the largest U.S. banks —  Bank of America and Citigroup — have issued new credit and debit cards to Massachusetts customers after running into data-safety concerns.

Bank of America and Citigroup each recently issued replacement cards to consumers, telling them in letters that their account numbers may have been compromised.  Read the full story [bizjournals.com]

From CNN (John D. Sutter)
 
Remember Conficker? The hugely talked-about computer worm seemed poised to wreak havoc on the world’s machines on April Fool’s Day. And then … nothing much happened.
But while the doom and gloom forecast for the massive botnet — a remotely controlled network that security experts say infected about 5 million computers — never came to pass, Conficker is still making some worm hunters nervous. Read the full story [cnn.com]

From SC Magazine (Angela Moscaritolo)

Businesses are using a variety of technologies to help reduce the impact of threats, prevent breaches and meet compliance — but some of these products are more beneficial than others, according to a new Forrester report released Wednesday that examines the state of network threat mitigation. “Current attacks are very complex, and enterprise teams struggle to keep up,” the report states.

The report studies the benefits of many of the most popular technologies that business are using to secure their networks. Web application firewalls and intrusion prevention systems (IPS) are said to be necessary technologies for many businesses. At the same time, network access control (NAC) and unified threat management (UTM) technologies will continue to struggle to find a foothold, the report states.  Read the full story [scmagazineus.com]  Here’s a link to the Forrester report [forrester.com]

The current zero-day attacks against Adobe Flash Player are not quite zero-day after all.   According to new information, Adobe’s security response team knew about the vulnerability since December 31, 2008 (see image below) but it was misdiagnosed as a “data loss corruption” issue.

When word of the attacks surfaced this week, Adobe quickly locked access to the bug ticket with a note that it was “reclassified as a security bug.”  Read the full story [zdnet.com]

From Washington Post (Brian Krebs)

Microsoft may soon be taking the unusual step of issuing an out-of-band security update to address multiple weaknesses that stem from a Windows security flaw that the software giant tried to fix earlier this month.   Read the full story [washingtonpost.com]   See more details at Halvar Flake’s blog [blogspot.com]

From CNet News.com (Elinor Mills)

During their presentation at the Black Hat and Defcon hacker conferences next week in Las Vegas, security experts will release a tool that can be used to break into Oracle databases.

Chris Gates and Mario Ceballos will present Oracle Pentesting Methodology and give out “all the tools to break the ‘unbreakable’ Oracle as Metasploit auxiliary modules,” according to a summary of their presentation on the Defcon Web site. Read the full story [cnet.com]

From Viruslist.com (Alex Gostev)
Recently, vulnerabilities in Adobe products have come to pose a major threat, and the number of infections which they cause overtook those resulting from vulnerabilities in Windows or Internet Explorer long ago.  The latest zero-day vulnerability was identified this week and grabbed the attention of AV researchers right way, with PDF files with a marked Chinese connection appearing in the wild.
One of these files was called “Cao Chang-Ching The CPP made eight mistang Urumuqi incident_mm.pdf”. The events of the past few days in the Chinese town of Urumqui, where local residents clashed with police, made the news around the world, so it’s no surprise to see this topic being used to spread malicious programs.   [viruslist.com]