Ryan Naraine

From Computerworld (Gregg Keizer)
After discovering attack code on a brand new Windows XP netbook, anti-virus vendor Kaspersky Labs warned users yesterday that they should scan virgin systems for malware before connecting them to the Internet.

When Kaspersky developers installed their recently-released Security for Ultra Portables on an M&A Companion Touch netbook purchased for testing, “they thought something strange was going on,” said Roel Schouwenberg [viruslist.com], a senior anti-virus researcher with the Moscow-based firm. Schouwenberg scanned the machine — a $499 netbook designed for the school market — and found three pieces of malware.  Read the full story [computerworld.com]

From TechWorld (John E. Dunn)

The number of legitimate Websites being hacked to host malware has hit startling highs in recent days, new figures from MessageLabs have revealed.

Data taken from the days between May 4 and 8 showed that 84.6 percent of Websites blocked by the company for hosting malicious content were ‘well-established’ domains that have been around for a year or more.  Read the full story [pcworld.com]

Hundreds of thousand websites host vulnerable Adobe Flash files which can be exploited by malicious people to conduct convincing phishing and XSS attacks. In most cases, cookie hijacking is possible.
Unsuspecting users can be redirected from trustworthy SSL and non-SSL sites to malware, adware and spyware sites.  Read the full story [xssed.com]

Former director of security architecture at One Laptop per Child (OLPC) Ivan Krstic has joined Apple to help thwart hacker attacks against the Mac operating system.

Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this week and will work on core OS security.  His hiring comes at a crucial time for a company that ties security to its marketing campaigns despite public knowledge that it’s rather trivial to launch exploits against the Mac. Read the full story [zdnet.com]

Adobe joined the Patch Tuesday barrage late yesterday, dropping fixes for a pair of code execution holes affecting its Adobe Reader and Acrobat products.

The critical update [adobe.com] addresses a publicly known vulnerability that was being exploited with booby-trapped PDF files.

At a Churchill Club event in Santa Clara, Calif., Peter Solvik, managing director at Sigma Partners, talks to a panel of CIOs about how they’re making mobile devices more secure in the enterprise and whether their employees prefer the BlackBerry over the iPhone. The panel includes: Matt Carey, chief information officer of Home Depot; Karenann Terrell, CIO of Baxter; and Lars Rabbe, former CIO of Yahoo.

From eWEEK (Brian Prince)
Attackers pushing pirated, malware-laced copies of Microsoft’s upcoming Windows 7 operating system have been actively trying to build a botnet.

According to researchers at Damballa, attackers hid a Trojan inside of pirated copies of the operating system and began circulating them on BitTorrent sites. Damballa reported that it shut down the botnet’s command and control server May 10, but by that time infection rates had risen as high as 552 users per hour. Read the full story [eweek.com]