The Malware Oscars Part 2
In part two of this three-part series, Team Cymru members discuss more of the most successful and innovative malware attacks of 2009.
Malware
Web Shopping Sites Get Independent Testing
U-Test has just completed a substantive, independent review of three major e-tailing sites–Amazon, Walmart and Target– and found a gaping cross-site scripting security hole in one of them. Read the full article. [The Last Watchdog]
NASA Hacked With SQL Injection
The websites of NASA’s Instrument Systems and Technology unit and
Software Engineering division were broken into by taking advantage of SQL Injection flaws and poor access controls. Read the full article. [The Register]
Team Cymru, an independent security research firm, discusses the most innovative malware attacks of 2009 in part one of a three-part video series.
Scam e-mail artists have launched a massive campaign to trick
webmasters into giving up the credentials needed to administer their
Web sites, targeting site owners at more than 90 online hosting
providers. Read the full article. [Washington Post]
HSBC Bank says a bug in its imaging software inadvertently exposed
sensitive data about some of its customers going through bankruptcy
proceedings. Read the full article. [Computerworld]
Phishers actually land a tiny percentage of
victims, but the end result is big bucks — to the tune of $2.4 million
to $9.4 million a year, according to a new study that measured real
phishing attacks on banks. Read the full article. [Dark Reading]
A security researcher has released a proof-of-concept attack that
exploits critical vulnerabilities that Apple patched on Thursday; The
vulns stem from bugs in the Java runtime environment that allow
attackers to remotely execute malicious code. Read the full article. [The Register]
A Swiss iPhone developer has released a new application that is capable of harvesting huge amounts of personal data from iPhones, including geolocation data, passwords, address book entries and email account information, all using just the public API.
An attacker with access to the target computer simply boots from a USB
flash drive and replaces the BitLocker bootloader with a substitute
bootloader which mimics the BitLocker PIN query process but saves the
PINs entered by the user to disk in unencrypted form. Read the full article. [The H Security]
