Crooks have developed a man-in-the-middle-attack designed to circumvent authentication kit used by dedicated World of Warcraft gamers. The ruse relies on tricking gamers into installing Trojans disguised
as gaming ad-ons. Once applied the malware allows hackers to capture
and relay authentication commands next time a victim logs on to
Blizzard’s servers. Read the full article. [The Register]
The personal health and financial information stored in thousands of
North American home computers may be vulnerable to theft through
file-sharing software, according to a research study published online
in the Journal of the American Medical Informatics Association. Read the full article. [ScienceDaily]
The Lotus iNotes ActiveX control for reading email from within a
browser contains a programming error which can result in a buffer
overflow. This could be exploited by an attacker to infect an iNotes
user with spyware on visiting a crafted web page. Read the full article. [The H Security]
A ring of ticket brokers has been indicted in connection to an elaborate hacking scheme that used bots and other fraudulent means to purchase more than 1 million tickets for concerts, sporting events and other events. The defendants made more than $25 million in profits from the resale of the tickets between 2002 and 2009. Read the full article. [Wired]
A prominent security researcher has released an exploit that uses a new technique to defeat ALSR + DEP on Microsoft’s Windows operating system.
The exploit, released by Google security researcher “SkyLined,” uses the ret-into-libc technique to bypass DEP (Data Execution Prevention) and launch code execution attacks on x86 platforms.
Over the last two weeks, security researchers have reported eight different zero-day vulnerabilities in Apple’s Safari browser.Details of these vulnerabilities, all rated “high risk,” have been sold to Tippingpoint’s Zero Day Initiative (ZDI), a program that purchases the rights to vulnerability information in exchange for exclusivity to broker fixes with affected vendors.
Renukanth Subramaniam, 33, who had previously plead guilty was sentenced to 46 months for conspiracy to defraud and 10 months
for five counts of mortgage fraud, the terms to run consecutively. Also
sentenced was Darkmarket user John McHugh, 66, who had the sign in “Devilman” and created fake credit cards
that were sold through the site. Read the full article. [BBC News]
Japan’s “Cyber Clean Center” is a little-known effort by the Japanese Computer Emergency Response Team Coordination Center (JP-CERT) and a collection of 76 Japanese ISPs covering 90 percent of the nation’s Internet users to fight botnets and other security issues. Read the full article. [KrebsonSecurity]
Microsoft’s security response team is investigating reports of a potentially dangerous code execution vulnerability in its flagship Internet Explorer browser.
The company warned that an attacker could host a maliciously crafted web page and run arbitrary code if they could convince a user to visit the web page and then get them to press the F1 key in response to a pop up dialog box.
Microsoft has warned Windows users to be on their guard against a piece of rogue antivirus software passing itself off as Microsoft Security Essentials. Security Essentials 2010 is a piece of software Microsoft said installs a fake virus scanner on your machine and]monitors and blocks processes it doesn’t like. Read the full article . [The Register]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
