Vulnerabilities

FTC: P2P Networks Rife With Leaked ID Data

The Federal Trade Commission today finally voiced concern about the long-known problem of data leaking into criminal hands via LimeWire, BearShare, Kazaa and dozens of other  peer-to-peer (p2p)  file sharing networks. The FTC put nearly 100 companies and agencies on notice that their employees appear to be regularly leaking large amounts of sensitive customer and employee data on popular peer-to-peer, or P2P, file-sharing networks.  Read the full story [The Last Watchdog]

Free Blocking Tool to Thwart Drive-By Downloads

Researchers are preparing to release a free tool to stop
“drive-by” downloads: Internet attacks in which the mere act of
visiting a Web site results in the surreptitious installation of
malicious software. The new tool, called BLADE (Block All Drive-By
Download Exploits), stops downloads that are initiated without the
user’s consent. Read the full article. [Technology Review]

Twitter Hit By Phishing Attack

Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts. Read the full article. [The Register]

Online Crime Easier, More Budget Friendly

by Donald Sears

Mainstream attention to Operation Aurora and the Kneber (Zeus) botnet are welcome. It underscores how the Internet underground has advanced to the point where a plethora of
powerful hacking tools and services  is readily available to  novice
hackers and elite crime gangs alike –  with  prices  to fit every
budget. Read the full article. [The Last Watchdog]

Man in the Browser: Inside the Zeus Trojan

by Atif Mushtag, FireEye
3

By Atif Mushaq, FireEye
Man in the Browser a.k.a MITB is a new
breed of attacks whose primary objective is to spy on browser sessions
(mostly banking) and in that process intercept and modify the web page
contents transparently in the background. In a classic MITB attack, it’s very likely that what the user is seeing on his/her browser
window is not something which the actual server sent. Similarly, what
the server sees on the other end might not be what user was intending to
send.

IEEE and Cloud Security Alliance Form Partnership

by Donald Sears

The Cloud Security Alliance (CSA) and IEEE are joining forces to ensure
that best practices and standards are developed and available to
provide security assurance for cloud computing.
As a result of this collaboration, CSA and IEEE have been conducting a
survey to identify and define the most critical security concerns
surrounding enterprise cloud computing. Read the full article. [Help Net Security]

Chuck Norris Botnet Discovered By Honeypot

by Donald Sears
1

Czech security experts say they have uncovered
a global botnet that may be redirecting Web surfers to other sites for
the purpose of stealing their data.
The botnet’s creators have dubbed the network “Chuck Norris” after the famous Hollywood actor and martial arts expert. Read the full article. [Dark Reading]

Security Skeletons in Adobe’s Closet

by Aviv Raff
5

Guest editorial by Aviv Raff
We
all know what happens when a software vendor downplays the severity of
a security vulnerability. It usually comes back to haunt them, when the
vulnerability is eventually discovered by the bad guys and used to
exploit innocent computer users.
Microsoft, Apple and even Mozilla have all been guilty of this in the past. Lately (and sadly), Adobe has joined this train.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.