Security researchers are raising an alarm for a potent malware cocktail — backdoor Trojans and password stealers — being pushed to Windows users from about 55,000 hacked Web sites.
According to Mary Landesman, a researcher in ScanSafe’s security threat alert team, the cybercriminals have embedded a malicious iFrame into tens of thousands of Websites to fire exploits at unsuspecting PC users who surf to one of the rigged sites.
The most trusted websites, such as search engines, mainstream news sites and some blogs, are increasingly at risk of hosting malicious links that pass malicious code to their visitors, according to the latest data collected by researchers with IBM’s X-Force security team.
The report [ibm.com] outlines a sharp increase in new malicious Web links and consistent attacks against Web applications that could undermine the security of some database servers. Read the full story [techtarget.com]
The malware-infected CDs that were mailed to some credit unions may have been part of a penetration test designed to gauge whether an employee would run the software. The SANS Internet Storm Center says it was notified by a representative from Microsolved that the mailing was part of an authorized pen test.
Security researchers are raising an alarm for a potent malware cocktail — backdoor Trojans and password stealers — being pushed to Windows users from about 55,000 hacked Web sites.
According to Mary Landesman, a researcher in ScanSafe’s security threat alert team, the cybercriminals have embedded a malicious iFrame into tens of thousands of Websites to fire exploits at unsuspecting PC users who surf to one of the rigged sites.
It seems that hackers have not been taking the move to two-factor authentication lying down. Instead, they have been hard at work figuring out a method for siphoning off the one-time passwords generated by devices such as the RSA SecurID token and using them immediately to steal money from victims’ bank accounts.
In this Google Tech Talk, Neil Daswani, founder of Dasient and a former Google engineer, discusses the recent epidemic of attacks featuring legitimate Web sites that have been compromised by malware and what can be done to combat the threat.
Threatpost editors Ryan Naraine and Dennis Fisher discuss the botnet being controlled through Twitter, Obama and cybersecurity, as well as the new Linux kernel flaw.
Arbor Networks security researcher Jose Nazario has stumbled upon a crimeware botnet using Twitter as its command-and-control operation.
The botnet, which is linked to identity thieves in Brazil, uses Twitter status messages to communicate with bots — sending new links for the infected computers to contact and new commands and executables to download and run. Read the full story [arbornetworks.com]
Threatpost editors Ryan Naraine and Dennis Fisher discuss the DDoS
attacks against Twitter, Facebook and LiveJournal and delve into
Apple’s Mac OS X patch and Microsoft’s Patch Tuesday plans.
See photos taken from Black Hat 2009 and Defcon, both held last week in Las Vegas, Nev.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
