Web Security

CAMBRIDGE–Researchers and security vendors have been telling us for years now that attackers  have developed sophisticated, targeted attacks designed to separate victims from their money as quickly and cleanly as possible. If that’s so, why aren’t all of us being compromised on a regular basis? A researcher from Microsoft Research posited at the WEIS 2010 workshop Tuesday that the answer is simple economics.

The Microsoft Patch Tuesday train rolled into town today, dropping off a massive 10 security bulletins with fixes for at least 34 documented vulnerabilities. Three of the bulletins are rated “critical” because of the risk of remote code execution attacks.  Affected products include the Windows operating system, Microsoft Office, the Internet Explorer browser and Internet Information Services (IIS).

CAMBRIDGE — For a minimal investment of about $160, a single porn site operator can infect more than 20,000 computers with malware for use in cybercrime, according to an academic study presented at the Workshop on the Economics of Information Security (WEIS 2010).

The number of malware and spyware programs found
on smartphones like the Android, BlackBerry and Windows Mobile devices has more than doubled in the past six months, and some
types of malware are more prevalent on certain smartphone platforms than
others. Read the full article. [Dark Reading]

Researchers have released software that exposes private information and
executes arbitrary code on sensitive websites by exploiting weaknesses
in the widely used web development technology JavaServer Faces. Read the full article. [The Register]

Apple has shipped new versions of its Safari browser with patches for at least 48 security vulnerabilities.The Safari 4.1 and 5.0 updates, considered “highly critical,” is available for both Windows and Mac OS X.  Exploitation of some of these vulnerabilities could lead to drive-by download (remote code execution) attacks.

LIMASSOL, CYPRUS–The operators of large-scale botnets such as Gumblar and others for years have relied upon stealth, creativity and guile to hide their creations from researchers and authorities for as long as possible. This has been especially vital for botnets with centralized command-and-control mechanisms. But the recent success of sophisticated, resilient peer-to-peer botnets has shown that level of effort isn’t necessary anymore.