Vulnerabilities

Version 2.1 of the Cloud Security Alliance’s “Guidance for Critical Areas of Focus in Cloud Computing” provides more concise and actionable guidance across all
domains, and encompasses knowledge gained from real world deployments
over the past six months. Read the full article. [Help Net Security]

A Chinese court Wednesday sentenced 11 members of a malware ring for writing and distributing Trojan horse viruses meant to steal online game account passwords, according to state media. Read the full article. [IDG News Service]

Security researchers believe changes being made by the Chinese government to the DNS process could help limit the number of malicious sites using the .cn top-level domain. Read the full article. [eWEEK]

Web servers, FTP servers, and even SSL servers
are becoming prime targets for botnet operators, not as command and
control servers or as pure zombies, but more as a place to host their
malicious code and files, or in some cases to execute high-powered spam
runs. Read the full article. [Dark Reading]

Cisco today released a security update with patches for a half-dozen serious security flaws in its WebEx Recording Format (WRF) Player.The vulnerabilites vulnerabilities may lead to a crash of the WRF Player application, or in some cases, lead to remote code execution, the company warned.  Read the full advisory [cisco.com]

Here’s a quick update to the Adobe PDF Reader/Acrobat zero-day story that broke yesterday after the company confirmed that an unpatched vulnerabilities was being attacked in the wild.First up, an exploit has been fitted into the Metasploit point-and-click penetration testing tool and there are predictions that exploit code will be widely available within a day or two.

ISPs in Russia and Ukraine are home to some of the highest concentrations of customers whose machines are infected with the Conficker worm, shows data from the Shadowserver Foundation. Read the full article. [Washington Post]