Exactly one month after malicious hackers started using rigged PowerPoint files to launch targeted attacks, Microsoft announced plans to ship a “critical” bulletin affecting its flagship presentation program.
The PowerPoint update is the only bulletin scheduled for this month’s Patch Tuesday on May 12, 2009 . It is rated “critical” (remote code execution) for all supported versions of Microsoft Powerpoint 2000 through 2007.
From CNet (Jon Oltsik)
As an analyst, it is my job to follow the industry, internalize trends, and then use this information to make predictions. OK, here goes: Within the next 18 months, Apple will begin recommending that Macintosh users install Internet security software on all systems.
Now I realize that this statement is blasphemy to dedicated Mac users, so let me start with a few qualifying statements. I am not comparing Mac OS with Windows, or Apple with Microsoft, and my prediction should not be interpreted as an attack on Apple, its developers, or the security of its code. Read the full story [cnet.com]
For the second time in two weeks, Google has shipped a new version of its Chrome browser to fix a pair of serious security vulnerabilities [blogspot.com].
One of the two flaws carry a “critical” rating because of the risk of code execution with the privileges of the logged on user. Read the full story [zdnet.com]
As more workers spend a greater part of their days on social networks like Facebook and Twitter, hackers have turned their energies toward spreading their malware across those services, harming workstations and company networks.
That’s the contention of a recent report measuring Web 2.0-targeted hacks that occurred in the first quarter of this year and was conducted by the Secure Enterprise 2.0 Forum, an industry group aimed at enabling the safe use of social media in the workplace. Read the full story [cio.com]
From InformationWeek (Thomas Claburn)
Windows 7 RC is now available, but Microsoft’s new operating system could use a bit more tinkering to improve security.
Specifically, Windows Explorer provides a way to hide a file’s extension. Virus writers use this feature to disguise executable files as something more innocuous, such as text files, F-Secure’s Mikko Hypponen explains in a blog post [f-secure.com]. By also changing the appearance of a malicious executable’s icon, malware authors have a much easier time convincing users to run malicious software using social engineering techniques. Read the full story [informationweek.com]
Adobe has set a May 12 date for the delivery of patches to cover a critical zero-day vulnerability in its Adobe Reader 9.1 and Acrobat 9.1 software products.
An official security advisory from Adobe confirms the severity of the vulnerability and reiterates the advice for users to turn off JavaScript as a temporary measure to avoid code execution attacks. However, customers have started to grumble that Adobe’s mitigation is difficult to implement and, even worse, useless in corporate environments. Read the full story [zdnet.com]
More than 15,000 students at Kapiolani Community College in Honolulu face an identity theft risk because of an Internet security breach, school officials said.
School officials found a computer on April 15 with the personal information of 15, 487 students who applied for financial aid between January 2004 and April 15 that was infected with malware that can steal sensitive data. The computer did not have sensitive information, but it was hooked up to a network that had access to names, addresses, phone numbers dates of birth and Social Security numbers. Read the full story [kitv.com]
After a two year absence, IBM X-Force is reporting [iss.net] a significant spike in image-based spam.
“Since March 20th, we have been witnessing a rebirth of image-based spam. At first, we saw a small trial of image-based spam, reaching 5-10%. Then, in late April, we saw another blast (this time a much bigger effort) reaching 15-22% of all spam, according to researchers Ralf Iffert and Holly Stewart.
From The H Security
Updating browsers without first asking users is apparently the most successful way of ensuring wide distribution for the latest version – thus minimising the number of vulnerable browsers. A joint study [techzoom.net] by Google Switzerland and the ETH (Swiss Federal Institute of Technology) in Zurich concludes that, if an update requires too much user interaction or effort, users will either abort the process or fail even to run it. Read the full story [h-online.com]
From WaPo Security Fix (Brian Krebs)
Hackers last week broke into a Virginia state Web site used by pharmacists to track prescription drug abuse. They deleted records on more than 8 million patients and replaced the site’s homepage with a ransom note demanding $10 million for the return of the records, according to a posting on Wikileaks.org, an online clearinghouse for leaked documents. Read the full story [washingtonpost.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
