Google Buzz XSS Flaw Fixed
Google has fixed a Web flaw that gave hackers a way to take control of Google Buzz accounts. Read the full article. [Computerworld]
Malware
Top 25 Dangerous Programming Errors Updated
The 2010 CWE/SANS Top 25 Most Dangerous Programming Errors is a list
of widespread and critical programming errors that can lead
to serious software vulnerabilities. Read the full article. [Common Weakness Enumeration/Mitre]
Following the Malware Supply Chain
While many outside of the security industry
still perceive “hackers” as teenagers or isolated geeks who work alone, a recent research report encourages the general
public to see malware as a cooperative industry that supports
specialists, economies, and supply chains. Read the full article. [Dark Reading]
Cybercriminals have been capitalizing on the world’s interest in the Winter Olympics in Vancouver to spread malware, experts warned. Attackers have been using Twitter and black hat search engine (SEO) optimization tactics to promote fake Olympics videos that are spreading malware. Read the full article. [Secure Computing]
The City of Norfolk, Virginia is reeling from a massive computer meltdown in which an unidentified family of malicious code destroyed data on nearly 800 computers citywide. Read the full article. [KrebsonSecurity]
By Gunter Ollmann, Damballa2009 saw many, many new botnet outbreaks and advancements in their criminal management. Throughout the year Damballa tracked thousands of distinct criminal operated botnets and identified millions of newly compromised enterprise systems each day. This week I’m going to share some of our findings from the year now that we’ve finished analyzing terabytes of unique Command and Control (CnC) data.
A common Web programming error could give hackers a way to take over Google Buzz accounts with cross site scripting, a security expert said. Read the full article. [Computerworld]
An insurance firm in Michigan lost nearly $150,000 this month as a result of a single computer virus infection. Read the full article. [KrebsonSecurity]
Adobe
today released an out-of-band security update to patch a pair of gaping
holes that expose hundreds of millions of computer users to remote code
execution attacks.
The vulnerabilities are rated “critical” and affect Adobe Reader and Adobe Acrobat on all platforms — Windows, Mac and Linux.
A loose consortium of security experts from more than 30 organizations
today called on enterprises to exert more pressure on their software
vendors to ensure that they use secure code development practices. Read the full article. [Computerworld]
