Search Ads Distributing Malware
Malware that exploits holes in popular applications is being delivered
by big ad delivery platforms including those run by Yahoo, Fox, and
Google, according to researchers. Read the full article. [CNet]
Malware
MiTM Attacks Can Help Steal Data from SaaS
Researchers from Indiana University and Microsoft were able to
infer sensitive data by analyzing the distinct size and other
attributes of each exchange between a user and a website interaction. Using man-in-the-middle attacks, they could glean the
information even when transactions were encrypted using the Secure
Sockets Layer, or SSL, protocol or the WPA, or Wi-fi Protected Access
protocol. Read the full article. [The Register]
FBI Identifies Top 10 Jobs in Cybercrime
Criminal hacker organizations are operating with increasing corporate-life efficiency, specialization and expertise, said the FBI at FOSE conference. Here are the top ten operational positions in a cybercrime group. Read the full article. [Computerworld]
The prolific Pushdo spam botnet has found a new way to penetrate
Microsoft’s Live.com by exploiting weaknesses in the audio captchas
designed to prevent automated scripts from accessing the popular email
service. Read the full article. [The Register]
Dennis Fisher and Ryan Naraine preview this year’s CanSecWest conference, the Pwn2Own contest and talk about the recent zero-day flaw in Firefox.
Opera has announced the release of version 10.51 of its web browser for Windows-based systems, closing two “highly severe” security holes. The security and stability update addresses a previously reported vulnerability caused by an incorrectly set value in HTTP headers. Read the full article. [The H Security]
Cyber-criminals see law firms as particularly lucrative targets that
can earn them hundreds of thousands of dollars per heist. Cyberspies
also attack attorney firms to steal client data that can be sold or
used to learn the details of future litigation. Read the full article. [SF Chronicle]
Germany’s official cyber-security response team is advising surfers not
to use Firefox pending the release of a patch to defend against a
critical unpatched vulnerability. Read the full article. [The Register]
Computer hacker Albert Gonzalez deserves a quarter-century behind bars
for leading a gang of cyberthieves who stole tens of millions of credit
and debit card numbers from a transaction processor and several giant
retail chains, federal prosecutors argued in a recent court filing. Read the full article. [Wired]
Thorsten Holz, researcher at Vienna University of Technology, whose team not only participated in the recent takedown of the Waledac botnet, but released an interesting paper earlier this year, summarizing their findings based on 33GB of crimeware data obtained from active campaigns talks to Dancho Danchev of ZDNet. Read the full article. [ZDNet]
