Malware

Every week, hackers are creating 57,000 new Web addresses which they
position and index on leading search engines in the hope that unwary
users will click them by mistake. Read the full article. [Help Net Security]

A dangerous XSS bug surfaced on Twitter on Monday, and researchers have seen active exploits for the bug, which allows an attacker to steal the session cookie of a Twitter user with a simple click-and-you’re-owned technique.

There’s an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user’s authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way that IE 8 handles CSS style sheets.

The countdown to the saturation of the IPv4
address supply is now down to a matter of months: and along with the
vast address space of the next-generation IPv6 architecture comes more
built-in network security as well as some new potential security
threats. Read the full article. [Dark Reading]

Spammers have been quick off the mark in exploiting Apple’s new iTunes social network to punt survey scams. Read the full article. [The Register]

Scareware and rogue AV programs have enjoyed a very good run in the last few years, making millions of dollars for their creators and generally making life miserable for victims. And while there’s been some innovation recently in the mechanisms attackers use to keep the programs resident on infected machines, researchers say that for the most part, users’ lack of security savvy and laziness about updating their PCs essentially obviates the need for the use of novel techniques to make these scams work.

Mitigation has become the word of the moment at Microsoft, and the company on Thursday continued its recent flow of tools designed to lessen the effectiveness of certain attacks with the release of version 2.0 of its Enhanced Mitigation Experience Toolkit.