Ryan Naraine

From MediaPost (Laurie Sullivan)
A wave of fake Twitter email invitations sent in hopes of luring people to unzip a file to find out who invited them has been hitting unsuspecting victims. The message carries a mass-mailing worm. It looks around on infected computers and sends emails to addresses it finds.
The message appears as if it came from a Twitter account, but unlike a legitimate Twitter message, there is no invitation URL in the body of the email. Instead, the user sees an attachment that appears as a .zip file containing an invitation card. When the zip file is opened, the virus spreads. Read the full story [mediapost.com]

From DarkReading (Gadi Evron)

Facebook users are facing a new threat, 419 scams in chat form, masquerading as friends.
I know because it just happened to me (think: 419 scam). An “acquaintance” sent me a message using Facebook chat that said, “Hi.” Easy enough. I replied in kind. Then she told me a horror story of being held at gunpoint and stranded in London.  Read the full story [darkreading.com]

From The Wall Street Journal (Emily Steel)
On a Saturday night at the end of May, visitors to the forums section of Digital Spy, a British entertainment and media news Web site, were greeted with an ad that loaded malicious software onto their computers. The Web site’s advertising system had been hacked.
A number of such attacks have occurred this year, as perpetrators exploit the complex structure of business relationships in the online advertising, with its numerous middlemen and resellers. Web security experts say they have seen an uptick in the number of ads harboring malware as the economy has soured and publishers, needing to boost their ad revenues, outsource more of their ad-space sales.  Read the full story [wsj.com]

From SC Magazine (Angela Moscaritolo)
A financial services technology group is developing standards for making secure mobile payment transactions.  The goal of the project,  an effort of the Financial Services Technology Consortium (FSTC),  is to develop standards and processes so that banking customers are able to securely pay a merchant or another bank customer using their phone, no matter what mobile device or carrier they use.  Read the full story [scmagazine.com]

From Computerworld (Jaikumar Vijayan)
Heartland Payment Systems chief executive Robert Carr remembers what it felt like when he first heard about the massive data breach at his company earlier this year.
“I wanted to throw up. It was devastating,” says Carr, recalling how he felt upon realizing that one of his worst fears had come true. “People had asked me for years ‘what keeps you awake at night’ and I would keep telling them it was the fear of a data breach,” he said. Read the full story [computerworld.com]

From PC World (Erik Larkin)
It doesn’t take much to get started in Internet crime these days. Find the right site, hand over $50, and you can start wreaking havoc with 1,000 already-infected PCs.
Finjan, a San Jose, CA security company, looked into the “Golden Cash” site, used by black hats to buy and sell the use of hijacked computers. The crooks behind the site infect PCs (or pay others to do so) with the Golden Cash remote-control malware, and then sell access to those PCs. And that access doesn’t cost much.  Read the full story [pcworld.com]

Apple’s latest iPhone OS 3.0 software updates includes patches for multiple vulnerabilities, some with serious security implications.
The update, which is only available for download via iTunes, covers a total of 46 documented vulnerabilities, including several that allows malicious code execution if a user simply visits a rigged Web site or views a manipulated image.  Read the full Apple advisory [apple.com]