Robert “Rsnake” Hansen On Slowloris, DoS Attacks And RFC-1918 Networks
Dennis Fisher talks with Robert “Rsnake” Hansen about his Slowloris tool, low-bandwidth DoS attacks and the law of unintended consequences.
Malware
Hackers Pounce on Michael Jackson’s Death
As night follows day, malicious hackers are following high-profile news around celebrity deaths to launch attacks.
According to a warning from the U.S. Computer Emergency Response team, there are several spam campaigns, phishing attacks, and malicious code targeting the recent deaths of Michael Jackson and Farrah Fawcett.
High-Profile Twitter Hack Spreads Mac, Windows Trojan
From IDG News Service (Robert McMillan)
Former Apple Macintosh evangelist Guy Kawasaki posts Twitter messages about a lot of different thing, but the message he put up Tuesday was really out of character: “Leighton Meester sex tape video free download!”
His message included a link that, after some further clicking, landed Kawasaki’s followers on a fake porn site where online criminals try to install a nasty Trojan horse program on victim’s computers. And in an interesting twist, the program attacks both Mac and Windows users. Read the full story [computerworld.com]
From IDG News Service (Stephen Lawson)
Alan Ralsky, a spam kingpin who was convicted of felony bank fraud in 1995, could face more than seven years in prison after pleading guilty in a stock fraud case involving spam messages that pumped up Chinese “penny” stocks.
Ralsky and four other individuals pleaded guilty on Monday, joining three others who had pleaded guilty earlier, the U.S. Department of Justice announced Monday. Cases are still pending against three other people, they said. The defendants were indicted in the Eastern District of Michigan in 2007. Read the full story [pcworld.com]
From Websense Security Labs
Early last week, we posted an alert about a mass injection attack in the wild we named Nine-Ball. This attack compromised over 40,000 legitimate Web sites in an ongoing campaign. The scale of the attack was spotted June 2, 2009, and since then the campaign has evolved several times. In this blog we will provide further detail and analysis on the Nine-Ball campaign. Read the full post [Websense.com].
From Netcraft
Criminals often register their own domain name to perform phishing attacks. Unlike the other common phishing site scenarios (including hacked servers, open redirects, and abuse of free webhosting), phishing sites that have their own domain name can be harder to remove, because the website owner and domain owner is the fraudster. Only the hosting and DNS providers and the domain registrar are able to take the site down and also likely to cooperate. Read the full story [netcraft.com]
From MediaPost (Laurie Sullivan)
A wave of fake Twitter email invitations sent in hopes of luring people to unzip a file to find out who invited them has been hitting unsuspecting victims. The message carries a mass-mailing worm. It looks around on infected computers and sends emails to addresses it finds.
The message appears as if it came from a Twitter account, but unlike a legitimate Twitter message, there is no invitation URL in the body of the email. Instead, the user sees an attachment that appears as a .zip file containing an invitation card. When the zip file is opened, the virus spreads. Read the full story [mediapost.com]
Enterprise IT security staffs looking for some mitigation for the newly released HTTP DoS tool may have a few options. The analysts at the SANS Internet Storm Center are recommending that organizations running Web servers that are vulnerable to the tool’s attack make some basic configuration changes to their servers to help mitigate the effects of the attack.
From PC World (Erik Larkin)
It doesn’t take much to get started in Internet crime these days. Find the right site, hand over $50, and you can start wreaking havoc with 1,000 already-infected PCs.
Finjan, a San Jose, CA security company, looked into the “Golden Cash” site, used by black hats to buy and sell the use of hijacked computers. The crooks behind the site infect PCs (or pay others to do so) with the Golden Cash remote-control malware, and then sell access to those PCs. And that access doesn’t cost much. Read the full story [pcworld.com]
From Computerworld (Gregg Keizer)
A URL-shortening service that condenses long Web addresses for use on micro-blogging sites like Twitter was hacked over the weekend, sending millions of users to an unintended destination, a security researcher said today. Read the full story [cio.com] Also see commentary from Roel Schouwenberg [viruslist.com]
