Ryan Naraine

A security researcher is warning that the Twitter API can be trivially abused by hackers to launch worm attacks.
The red-hot social networking/microblogging service has been scrambling to plug cross-site scripting and other Web site vulnerabilities to thwart worm attacks but, as researcher Aviv Raff points out, it’s much easier to misuse the Twitter API as a “weak link” to send worms squirming through Twitter.  Read the full story [zdnet.com]

From the Associated Press
Law enforcement computers were struck by a Mystery computer virus Thursday, forcing the FBI and the U.S. Marshals to shut down part of their networks as a precaution.
The U.S. Marshals confirmed it disconnected from the Justice Department’s computers as a protective measure after being hit by the virus; an FBI official said only that that agency was experiencing similar issues and was working on the problem. Read the full story [yahoo.com]

From CNet News (Liam Tung)

Cybercrime fighter Eugene Kaspersky can’t help but be impressed by the slick operations behind the Conficker botnet, and says that it could have been worse had the botnet been after more than just money. “They are high-end engineers who write code in a good way,” Kaspersky said. “They use cryptographic systems in the right way, they don’t make mistakes — they are really professional.”

From The Last Watchdog (Byron Acohido)
There’s power in simplicity. That’s the upshot of the phishing attack now bombarding Facebook users.  Many FB’ers are receiving messages titled, simply, “Hello.” The body of the text contains a brief imperative sentence: “Check areps.at” or “Check bests.at” Several USA Today staffers have received these bogus messages.
Clicking on the “areps.at” or “bests.at” hyperlink takes you to a realistic-looking, but counterfeit, Facebook login page, where you will be prompted to type your userID and password. You don’t have to be particularly gullible to fall for this. You can be in a hurry;  multitasking on the ragged edge, networking multiple places, as part of  a job where you’re being asked to do more with less. Read the full story [lastwatchdog.com]

A security researcher from nCircle is accusing Microsoft of gamesmanship in its description of an unpatched IIS vulnerability in the way the WebDAV extension  decodes a requested URL. The end result is that a successful exploit would allow a hacker to bypass authentication and gain unauthorized access to resources.

Borrowing a few pages from Microsoft’s playbook, Adobe today announced plans for a quarterly Patch Day for its Reader/Acrobat product lines and new initiatives to beef up its code hardening and security response processes.
Starting this summer, Adobe Reader and Acrobat security patches will be released on a quarterly schedule and will be timed to coincide with Microsoft’s second-Tuesday-of-the month bulletin releases. Read the full story [zdnet.com].  Also see Adobe’s announcement [adobe.com]

From SearchSecurity.com (Rob Westervelt)

IT managers are under pressure from the top executives in their organizations to relax their policies on Web security in order to make users more productive. A new survey of more than 1,000 IT managers found that sales and marketing personnel also are leaning on IT staffs to make life easier for users who already are using tools such as Google Apps and social networking sites on their own.