From Computerworld (Gregg Keizer)
Pirated copies of Windows 7 Release Candidate (RC) on file-sharing sites contain malware, according to users who have downloaded the upgrade.
Some of the pirated builds include a Trojan horse, numerous users said in message forums and in comments on BitTorrent sites such as Mininova.org. Read the full story [computerworld.com]
Security researchers at University of California, Santa Barbara have broken into the nerve center of the Torpig botnet (also called Sinowal or Mebroot) to find a ten-day stash of 10,000 bank accounts and credit card numbers worth hundreds of thousands of dollars.
CBS News is reporting word about another data breach potentially compromising the personal information of thousands of people. Companies Lexis Nexis and Investigative Professionals have sent up to 40,000 letters to customers whose “sensitive and personally identifiable” information may have been viewed by individuals who should not have had access. Read the fully story [cbsnews.com]
From Mercury News (Elise Ackerman)
A computer worm that has alarmed security experts around the world has crawled into hundreds of medical devices at dozens of hospitals in the United States and other countries, according to technologists monitoring the threat.
Around March 24, researchers monitoring the worm noticed that an imaging machine used to review high-resolution images was reaching out over the Internet to get instructions — presumably from the programmers who created Conficker.
Twitter co-founder Biz Stone says the company “takes security very seriously” but the details behind the micro-blogging site’s recent hack shows that Twitter is light years away from having the most basic security controls in place.
From Techworld (Maxwell Cooter)
Enterprises are struggling to control the use of consumer applications within the workplace, despite the panoply of security tools being used within corporates.
According to new research [paloaltonetworks.com], nearly half of all bandwidth within corporate environments is being consumed by personal applications such as YouTube, peer-to-peer filesharing and various other consumer applications. Peer-to-peer is a particularly frequent problem, and according to the research, an average of six P2P applications were found in 92 percent of the organisations surveyed. Read the full story [cio.com]
From Stop Badware (Maxim Weinstein)
The Canadian House of Commons is considering bill C-27 [gc.ca], the Electronic Commerce Protection Act. In addition to providing civil penalties for unsolicited commercial e-mail (spam) and the unauthorized interception of e-mail (man in the middle attacks), it provides for similar penalties for the unauthorized installation of software.
The specifics of the software installation section of the bill are interesting. Read the full story [stopbadware.org]
Adobe has shipped a Flash Media Server patch to fix a vulnerability [adobe.com] that allowed attackers to execute remote procedures in Flash Media Interactive Server or Flash Media Streaming Server.
The update is available for Adobe Flash Media Streaming Server 3.5.1, Adobe Flash Media Interactive Server 3.5.1 and earlier. It is rated “important” and affects both Windows and Linux platforms. Read the full story [zdnet.com]
From SDTimes (David Worthington)
A majority of the industry’s leading software makers surveyed by SD Times lack transparency about the internal principles that they use for writing secure software. Analysts believe that those companies are either practicing security by obscurity, do not adequately perform security practices during software development, or are simply unwilling to talk about it. Read the full story [sdtimes.com]
From Information Week (George Hulme)
The Cloud Security Alliance (CSA) made its inaugural splash at last week’s RSA Security Conference 2009 in San Francisco. The group kicked off an ambitious white paper [cloudsecurityalliance.org] that attempts to define everything from the architecture of cloud services to the impact of cloud services on litigation and encryption. It was a herculean effort to try to get this off the ground. And there is still much more work to do — especially in the one area the group left out. Read the full story [informationweek.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
