Adobe Releases Emergency Fix for Critical Reader Flaws
Adobe on Tuesday released an emergency patch for several critical vulnerabilities in Adobe Reader, including the recent Adobe Flash bug and a separate flaw that was disclosed earlier this month.
Vulnerabilities
Report: IRC Botnets Dying…But Not Dead
Once the most common form of malicious computer network, botnets that use the IRC (Internet Relay Chat) protocol are going the way of the Brontosaurus, according to a report from Internet security monitoring firm Team Cymru.
TDL4 Rootkit Bypasses Windows Code-Signing Protection
In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass the Windows driver-signing protection.
When it comes to security, it’s planning and execution – not the size of the budget – that matter.With the U.S. economy showing the barest signs of recovering from the recession, the consensus among economists is for a very flat recovery to continue through 2011. For IT security staff, that means tight IT budgets and flat spending, at best.
Adobe Inc. said on Friday that it is planning to release an out-of-cycle update to fix critical security holes in its Reader and Acrobat products, including a fix for a newly disclosed hole that is already being exploited in the wild.
The storm clouds over mobile security continued to gather this week with news of a new browser exploits for Android and a URL attack for iPhones, while OWASP’s AppSec conference in D.C. provided an update on Uncle Sam’s security priorities. Read on for Threatpost’s security Week in Review.
It’s bound to happen: you create a cool, forward looking incentive program designed to tap the “wisdom of the crowd” and help make your products better, only to find out that, in fact, the “crowd” isn’t all that wise – and now wants you to pay cold, hard cash for their tepid ideas.
Researchers at security firm Websense have found that Amnesty International’s Hong Kong site, amnesty.org.hk, is serving up a cocktail of malware that includes last week’s Internet Explorer 0-day.
Newly detected versions of the Lethic botnet are digitally signed using stolen credentials similar to those used by the Stuxnet worm, according to a blog post from Web security firm zScaler.
In a blog post Wednesday, zScaler Senior Security Researcher Mike Geide said the company had intercepted new Lethic variants that were signed using legitimate digital signatures belonging to Taiwanese semiconductor firm Realtek Semiconductor Corp. That’s one of two firms whose credentials were used to help the Stuxnet worm fool detection systems and install itself on target systems.
There’s a weakness in the Android operating system that could enable an attacker to install a malicious third-party application on Android devices without the user’s knowledge. A researcher has developed a proof-of-concept app that’s in the Android Market now.
