A software engineer who created Trojans for the Swiss authorities to intercept Voice-over-IP (VoIP) phone calls has published the source code to his programs in order to draw attention to the surveillance threat posed by such software. Read the full story [idg.no]
The most trusted websites, such as search engines, mainstream news sites and some blogs, are increasingly at risk of hosting malicious links that pass malicious code to their visitors, according to the latest data collected by researchers with IBM’s X-Force security team.
The report [ibm.com] outlines a sharp increase in new malicious Web links and consistent attacks against Web applications that could undermine the security of some database servers. Read the full story [techtarget.com]
Apple’s commercials may give the impression that Macs are virus-free but the company isn’t taking any chances with the newest Mac OS X refresh.
Apple has quietly added a new Snow Leopard feature to scan software downloads for malware, a no-brainer move that coincides with a noticeable spike in malicious files embedded in pirated copies of Mac-specific software. Read the full story [zdnet.com]
From ZDNet (Dancho Danchev)
According to a research published by Trusteer earlier this month, 79.5% of the 2.5 million users of their Rapport security service run a vulnerable version of Adobe Flash, with 83.5% also running a vulnerable version of Acrobat.
The company has also criticized Adobe by insisting that their update mechanism “does not meet the requirements of a system that is used by 99% of users on the Internet and is highly targeted by criminals“, but is praising the update mechanism of Google’s Chrome and Firefox, whose silent updates close the window of opportunity for malicious attackers to take advantage of. Read the full story [zdnet.com] See the Trusteer study [PDF]
From C|Net (Elinor Mills)
Cisco Systems wireless local area network equipment used by many corporations around the world is at risk of being used in denial-of-service attacks and data theft, according to a company that offers protection for WLANs.
Researchers at AirMagnet, which makes intrusion-detection systems for WLANs, discovered the vulnerability, which affects all lightweight Cisco wireless access points, as well as the exploit that could be used against networks that have the Over-the-Air-Provisioning (OTAP) feature turned on. Read the full story [cnet.com]
From internetnews.com (Sean Michael Kerner)
Tens of millions of people around the world use Adobe’s Flash and PDF reader technologies. How many of them update regularly?
The issue of updated Flash and Adobe Acrobat PDF clients is an important one, as Adobe recently patched both technologies for security vulnerabilities that could expose users to risk. Yet security vendor Trusteer recently examined its own users and found that at least 80 percent were running unpatched versions of Flash and Adobe Acrobat. Read the full story [internetnews.com]
How much does a bot cost these days? Like everything else in our economy, the price of a bot-infected PC fluctuates significantly, based on supply, demand, volume purchased and any number of other factors. But according to research done by the folks at Cisco, bots can be had for as little as 10 cents right now. It’s a buyer’s market.
From Zero in a Bit (Tyler Shields)
Trust has long been a favorite target of malicious individuals. Most people would say that proper management of trust is one of the primary cornerstones of information security. Trust is a relative term and all trust relationships should be examined with a very critical eye. Ken Thompson’s seminal paper “Reflections on Trusting Trust”, which won a Turing Award, addresses in detail why we can never be fully sure of the trust relationships in our development environment. Read the full story [Zero in a Bit].
This video is a demonstration of an attack exploiting a vulnerability in Facebook. It is a companion video to this blog post [quaji.com] that describes and discusses the hack. In a nutshell, a Facebook user’s personal is stolen. The only thing he does is view a regular, legitimate forum site.
The “critical” WINS vulnerability that Microsoft issued a patch for last week is now being exploited actively in the wild, according to the SANS Institute [sans.org].
The Internet Storm Center (ISC), which is operated by SANS, is receiving preliminary reports that hackers are targeting Microsoft’s WINS service on Windows NT, 2000 and 2003 servers. Read the full story [networkworld.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
