Malware

The Honeynet Project launched a new project Thursday that is designed to snare malware that spreads by infecting removable USB (universal serial bus) storage drives, citing the increased reliance of malicious programs on portable drives to move from computer to computer.

Chris Soghoian has made a name for himself as a security and privacy researcher and has been the bane of government agencies and organizations prone to being somewhat less than upfront about their security and privacy practices. In this video from the Personal Democracy Forum in New York this week, Soghoian discusses the implications of the U.S. government’s raid on Osama Bin Laden and usage of offensive cyberwar weapons such as Stuxnet and Duqu.

A joint letter from some of Washington D.C.’s leading minds in the areas of defense and diplomacy is urging Congress to pass a cyber security bill in some form this year, saying that the U.S. is urgently in need of a new policy and ill-prepared for cyber attacks.

U.S. Attorney General Eric Holder has issued an assignment to the U.S. District Attorneys to start an investigation into possible leaks of classified information, presumably by individuals within the Obama administration who recently spoke anonymously about the administration’s ties to the development of Stuxnet.

Researchers digging through the code of the recently discovered Flame worm say they have come across a wealth of evidence that suggests Flame and the now-famous Stuxnet worm share a common origin.

The attackers behind Flame can easily clean up compromised computers, according to research by security firm Symantec who found that some attackers have been able to use command-and-control (C&C) servers to completely remove the malware from certain machines.

Claims surfaced earlier this week that the French security firm VUPEN, which is known for selling zero-day vulnerabilities to third parties, had been compromised and more than 100 of the company’s secret bugs had been leaked. However, VUPEN’s CEO said that the claims were totally false and there was no hack, let alone a leak of the company’s vulnerability inventory.