At the Workshop on the Economics of Information Security at Dartmouth College, experts discussed the drivers of the underground cybercrime economy, how the security story has changed in the media in recent years and what can be done to address the malware pandemic.
Emergency IE Patch – Fri, January 9, 2009
Ryan and Roel dissect the latest wave of malware attacks against Microsoft Internet Explorer browser and discuss the company’s plans to ship an emergency out-of-band update.
USB Malware Mess – Fri, November 28, 2008
The boys explain the latest news around Lenovo distributing a malware-infected driver software and the network worm that forced the U.S. military to ban the use of USB drives and other forms of removable media.
Clickjacking: Ryan and Roel tackle browser-threat hype – Tue, October 21, 2008
The cross-browser clickjacking threat, malware on new Asus EEE machines, phishing and the elections/financial crisis, the iPhone security mess, Microsoft Patch Tuesday and the exploding fraudware/rogueware problems.
Welcome to the Show – Mon, October 20 2008
In this show, we introduce ourselves and recap the Virus Bulletin 2008 conference. We talk about the MBR Trojan (bootkit), the controversy surrounding anti-virus testing standards, information on the blackmarket for online gaming passwords and some data from Microsoft’s malicious software removal tool (MSRT).
(Download)
PDFs containing exploits for the recent 0-day vulnerability in Acrobat Reader are now being actively sent out through spambots. The folks at the IBM ISS X-Force say they’re seeing infected PDFs being spammed out and that it looks like the traffic is mainly coming from Taiwan, though those may be spoofed addresses.
In a statement on Monday, the BBC said that its decision to purchase and use a botnet to espose the malware epidemic had been “in the public interest”.
“It was not our intention to break the law,” the BBC told ZDNet UK on Monday. “There is a powerful public interest in demonstrating the ease with which such malware can be obtained and used; how it can be deployed on thousands of infected computers without the owners even knowing it is there; and its power to send spam e mail or attack other websites undetected.”
Credit card giant Visa has taken Heartland Payment Systems and RBS WorldPay off its list of service providers that are compliant with the PCI Data Security Standard.
Dave Kennedy and Kevin Long from Verizon’s security team are offering some of the best advice I’ve seen regarding the ongoing attacks against an unpatched Adobe Acrobat/PDF vulnerability.
I’ve complained bitterly about the lack of mitigation guidance from Adobe and I’m happy to see the Verizon researchers filling in the blanks and offering suggestions to reduce your exposure to these attacks.
On the Microsoft Secure Windows Iniative blog, software engineer Chengyun discusses the default behaviour of ActiveX controls embedded in Office documents. The software giant also provides information on how can an attacker abuse ActiveX and how Office users can change the behavior of ActiveX controls embedded in Office documents.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
