Spammers Outsource CAPTCHA Decoding
Faced with stricter Internet security measures like CAPTCHAS, some spammers have begun
borrowing a page from corporate America’s playbook: they are
outsourcing. Read the full article. [The New York Times]
Cryptography
Blippy Accidentally Gives Up Credit Card Numbers
Blippy users recently got a taste of the social media fad’s dark side when simple Google searches turned up 127 transactions that included credit card numbers of four users. Read the full article. [The Register]
Affinity Health Warns 409K Customers of Breach
Affinity Health Plan, a New York managed care
service, is notifying more than 400,000 current and former customers
employees that their personal data might have been leaked through the
loss of an unerased digital copier hard drive. Read the full article. [Dark Reading]
How many botnets are there? Symantec says 6.8 million, but a former Symantec executive at Immunet and a key creator of the Internet Security Threat Report says his former company is off by several magnitudes of order. Gunter Ollmann of Damballa concurs with Immunet and puts the numbers between 19 and 24 million. Read the full article. [The Last Watchdog]
According to research, the malicious iframe used in the latest Network Solutions attack pointed to corpadsinc.com which then downloads Adobe exploits onto victims’ machines. The hacks raise an issue increasingly being faced by Website owners: what’s the responsibility of the ISP or service or cloud provider to provide more application-layer security?
A pair of security researchers has discovered a number of new attack vectors that give them the ability to not only locate any GSM mobile handset anywhere in the world, but also find the name of the subscriber associated with virtually any cellular phone number, raising serious privacy and security concerns for customers of all of the major mobile providers.
Researchers at the Univeristy of Texas at Dallas have developed a method for analyzing the activity log
files of corporate firewalls. Their analysis can determine what rules the firewall is actually applying
to incoming and outgoing network traffic and then compare these with
the original rules to spot errors and omissions. Read the full article. [Science Daily]
The SANS Institute has released critical security controls for cyber defense agreed to by a consortium of agencies including: “NSA, US Cert, DoD, DoD JTF-GNO, the Department of Energy Nuclear Laboratories, Department
of State, DoD Cyber Crime Center plus the top commercial forensics
experts and pen testers that serve the banking and critical
infrastructure communities,” according to the SANS website. Read the SANS Institute consensus audit guidelines.
Two Belarusian nationals suspected of operating a rent-a-fraudster
service for bank and identity thieves have been arrested overseas,
according to New York authorities, who unsealed an indictment for one of
the suspects. Read the full article. [Wired]
A week after Web hosting company Network Solutions dealt with a
large-scale infection of WordPress-driven blogs, the company
acknowledged that other sites it hosts have been compromised. Read the full article. [Computerworld]
