Vulnerabilities

From The H Security
According to information which only recently came to light, in early April a botnet consisting of an estimated 100,000 PCs apparently destroyed itself – as its control server send out a command that made Windows inoperable. The botnet was based on the Zeus [rsa.com] botnet tool kit, which allows criminals to infect and subsequently remotely control users’ PCs. Read the full story [h-online.com]

From ZDNet (Dancho Danchev)
A newly discovered email worm dubbed OSX/Tored-A once again puts the spotlight on the potential worm-ability, and malware spreading tactics targeting Apple’s OS X.
The worm propagates through emails harvested from infected hosts, and has a backdoor functionality allowing its author to perform the following actions if a successful remote connection is established – attempts to create a botnet, has keylogging functionality, and can also perform DDoS attacks as well as send spam. Read the full story [zdnet.com]

Exactly one month after malicious hackers started using rigged PowerPoint files to launch targeted attacks, Microsoft announced plans to ship a “critical” bulletin affecting its flagship presentation program.
The PowerPoint update is the only bulletin scheduled for this month’s Patch Tuesday on May 12, 2009 .  It is rated “critical” (remote code execution) for all supported versions of Microsoft Powerpoint 2000 through 2007.

For the second time in two weeks, Google has shipped a new version of its Chrome browser to fix a pair of serious security vulnerabilities [blogspot.com].
One of the two flaws carry a “critical” rating because of the risk of code execution with the privileges of the logged on user. Read the full story [zdnet.com]

From InformationWeek (Thomas Claburn)
Windows 7 RC is now available, but Microsoft’s new operating system could use a bit more tinkering to improve security.
Specifically, Windows Explorer provides a way to hide a file’s extension. Virus writers use this feature to disguise executable files as something more innocuous, such as text files, F-Secure’s Mikko Hypponen explains in a blog post [f-secure.com]. By also changing the appearance of a malicious executable’s icon, malware authors have a much easier time convincing users to run malicious software using social engineering techniques. Read the full story [informationweek.com]

Adobe has set a May 12 date for the delivery of patches to cover a critical zero-day vulnerability in its Adobe Reader 9.1 and Acrobat 9.1 software products.
An official security advisory from Adobe confirms the severity of the vulnerability and reiterates the advice for users to turn off JavaScript as a temporary measure to avoid code execution attacks.  However, customers have started to grumble that Adobe’s mitigation is difficult to implement and, even worse, useless in corporate environments.  Read the full story [zdnet.com]

From The H Security
Updating browsers without first asking users is apparently the most successful way of ensuring wide distribution for the latest version – thus minimising the number of vulnerable browsers. A joint study [techzoom.net] by Google Switzerland and the ETH (Swiss Federal Institute of Technology) in Zurich concludes that, if an update requires too much user interaction or effort, users will either abort the process or fail even to run it. Read the full story [h-online.com]