Ryan Naraine

From Microsoft’s SDL blog (Chris Weber)
I’m writing to tell you about our new Watcher tool for web-app security auditing and testing.  Watcher is a plug-in for Eric Lawrence’s Fiddler proxy aimed at helping developers and testers find security issues in their web-apps fast and effortlessly.  Because it works passively at runtime, you have to drive it by opening a browser and cruising through your web-app as an end user.  For the developer, the tool can provide a quick sanity check, so you can find problems and hot-spots that warrant further attention.  In the hands of a pen-tester it can assist in finding issues that lead to other attacks like XSS and CSRF. Read the full story [msdn.com]

Psst! Psst!  Ryan here.  Did you notice that all the text on the cover of Verizon’s 2009 data breach report [pdf] is selectable?   A little birdie tells me that’s no coincidence.   Encrypted message, etc.  

Even better, the report contains some obvious clues to decrypt.  And something about cash prizes for those who figure it out.  If you hear/know more, hit me up on Twitter.  From the birdie’s beak to your ear…

From CNet (Jon Oltsik)

It’s nearly time for that annual spring ritual: the RSA Conference at the Moscone Center in San Francisco. ESG data tells me that, despite the recession, global organizations continue to spend on security products. So I expect another good show, though I do anticipate that the $500 kegs of Heineken at vendor booths will be omitted or replaced with Bud Light.

With the show less than a week away, here is the buzz I am anticipating. For this year, I’m including my hyperbole-to-reality ratio in my assessment.  Read the full story [cnet.com]

Multiple news outlets [ZDNet, CBC, The Register and Washington Post] are reporting on what appears to be the first malicious botnet made up only of machine’s running Apple’s Mac operating system.
The botnet is directly linked to a previously known Trojan that was embedded into pirated copies of Apple’s iWorks program.  It was being used in the past to launch denial-of-service attacks.  The full analysis of the botnet is available at Virus Bulletin [subscription required]

From SearchSecurity (Robert Westervelt)
The glum economy has put increased pressure on CISOs to cut costs while maintaining the same security defenses. Tightening budgets, coupled with increased compliance demands could have security professionals looking for answers next week at the 2009 RSA Conference. Read the full story [searchsecurity.com]

From DarkReading (Kelly Jackson Higgins)
Kernel rootkits are tough enough to detect, but now a researcher has demonstrated an even sneakier method of hacking Linux.
The attack exploits [dtors.org PDF] an oft-forgotten function in Linux versions 2.4 and above in order to quietly insert a rootkit into the operating system kernel as a way to hide malware processes, hijack system calls, and open remote backdoors into the machine, for instance. Read the full story [darkreading.com]

From The Register (John Leyden)
Scareware scammers are trying to game search engines into promoting crudware sites when a surfer searches for information on Ford cars.

The Ford scareware campaign [pandasecurity.com] features around one million links, all targeting the Ford Motor Company, designed to trick search engines into promoting malicious pages towards the top of search results. Malvertised pages are punting a rogue anti-virus product, called MS AntiSpyware 2009. The malicious application attempts the scare users into buying useless software on the basis of fraudulent scan results that report systems are infected, whether they are or not. Read the full story [theregister.co.uk]