A researcher has discovered a flaw residing in the Windows Help and Support Center, a feature that
provides users with online technical support. Malicious hackers can
exploit the weakness of Windows by embedding commands in web addresses
that activate the feature’s remote assistance tool, which allows
administrators to execute commands over the internet. Read the full article. [The Register] Read the advisory. [Seclists.org]
WordPress users whose websites are hosted on GoDaddy servers have been
targeted by fake AV peddlers yet again. Read the full article. [Help Net Security]
Malaysian cops have busted an alleged text message spam scam ring
thought to have fleeced locals for hundreds of thousands of dollars. The group are suspected of raking in RM6.4m ($1.9m) between 2006 and April 2010
using fictitious lottery winnings as a bait for an advanced fee fraud. Read the full article. [The Register]
Unsuspecting users looking for videos on recent events like the Gulf of
Mexico oil spill and the NBA playoffs are being directed to maliciously crafted websites with
videos that appear to be identical to YouTube postings. Read the full article. [InfoSecurity]
A pair of academic researchers have analyzed the use of
passwords by many prominent online sites, and found that many sites
require passwords as a sort of security theater, requiring them in
contexts that are superfluous and failing to do their part to secure the
information on their end. The end result, they argue, is a tragedy of
the commons, with the commons being the finite memory of the average
user. Read the full article. [Ars Technica]. Read the study.
The exploit that is being used in the attacks against the latest zero-day vulnerability in Adobe Flash is a modified version of a harmless SWF file that is only one byte different from the original file. Researchers have seen the exploit being used in active attacks against the vulnerability in Flash, which Adobe is set to patch tomorrow.
Scareware has become such an indomitable economic force that the take
down of perhaps the largest, most vertically-integrated scareware
purveyor, Innovative Marketing, has had a negligible deterrent effect. Read the full article. [The Last Watchdog]
CAMBRIDGE–Researchers and security vendors have been telling us for years now that attackers have developed sophisticated, targeted attacks designed to separate victims from their money as quickly and cleanly as possible. If that’s so, why aren’t all of us being compromised on a regular basis? A researcher from Microsoft Research posited at the WEIS 2010 workshop Tuesday that the answer is simple economics.
The Microsoft Patch Tuesday train rolled into town today, dropping off a massive 10 security bulletins with fixes for at least 34 documented vulnerabilities. Three of the bulletins are rated “critical” because of the risk of remote code execution attacks. Affected products include the Windows operating system, Microsoft Office, the Internet Explorer browser and Internet Information Services (IIS).
CAMBRIDGE — For a minimal investment of about $160, a single porn site operator can infect more than 20,000 computers with malware for use in cybercrime, according to an academic study presented at the Workshop on the Economics of Information Security (WEIS 2010).
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
