Our security model is broken
This Google TechTalk features Rik Farrow, a longtime security consultant and author, discussing the fundamental flaws in the current security model on the Internet and the desktop.
Vulnerabilities
Botnet hijack: Researchers dissect Torpig malware operation
Security researchers at University of California, Santa Barbara have broken into the nerve center of the Torpig botnet (also called Sinowal or Mebroot) to find a ten-day stash of 10,000 bank accounts and credit card numbers worth hundreds of thousands of dollars.
Q&A: Chris Hoff on cloud computing
Chris Hoff, the former chief security architect at Unisys and the author of the consistently insightful and funny Rational Survivability blog, is among the most sought-after speakers in the security industry and an authority on cloud computing and virtualization security. In this interview, he talks about the goals of the Cloud Security Alliance, the vague terminology and concepts of cloud computing and why cloud computing will neither save the world nor trigger the apocalypse.
Adobe has shipped a Flash Media Server patch to fix a vulnerability [adobe.com] that allowed attackers to execute remote procedures in Flash Media Interactive Server or Flash Media Streaming Server.
The update is available for Adobe Flash Media Streaming Server 3.5.1, Adobe Flash Media Interactive Server 3.5.1 and earlier. It is rated “important” and affects both Windows and Linux platforms. Read the full story [zdnet.com]
In this video from Dojosec, Matthew Watchinski from Sourcefire’s Vulnerability Research Team reveals the timeline, from discovery to sale to exploitation to disclosure to patch, of the Adobe JBIG PDF flaw.
Security holes in the Apache Geronimo Application Server and SAP cFolders headline a list of five serious Web app vulnerabilities that demand immediate attention.
According to Mark Painter from the HP Security Laboratory, the Geronimo flaws expose users to a variety of attack vectors that could lead to the theft of sensitive information and cookie-based authentication credentials. Here’s the top-five list [zdnet.com]
The swine flu outbreak has inspired a flood of comparisons and false analogies to Conficker and other worms, most of which miss the many key differences between the Internet infrastructure and the human population. But there are lessons that security personnel can learn from the ways that health organizatons respond to and handle epidemics.
From the Windows Security Blog (Paul Cooke)
RSA was great last week – security was clearly top of mind for the attendees, and I fielded a number of different questions last week about how Microsoft protects our customers. Some are pretty straightforward around how the various Windows 7 security technologies work, but many have focused on how we actually deliver protection to customers on an ongoing basis.
One question that comes up more than I would have ever expected is: Who gets security updates? Read the full blog entry [windowsteamblog.com]
From IDG News Service (Jeremy Kirk)
A study from security vendor Qualys has found that companies are patching just a hair faster than they were five years ago.
From Computerworld (Ryan Faas)
One of the commonly touted advantages to using a Mac is that it’s more secure and less prone to malware than a PC running Windows. It’s easy to see where this attitude comes from: The prevalence of viruses and network attacks against Windows machines is greater by several orders of magnitude.
