The prolific Pushdo spam botnet has found a new way to penetrate
Microsoft’s Live.com by exploiting weaknesses in the audio captchas
designed to prevent automated scripts from accessing the popular email
service. Read the full article. [The Register]
Dennis Fisher and Ryan Naraine preview this year’s CanSecWest conference, the Pwn2Own contest and talk about the recent zero-day flaw in Firefox.
Opera has announced the release of version 10.51 of its web browser for Windows-based systems, closing two “highly severe” security holes. The security and stability update addresses a previously reported vulnerability caused by an incorrectly set value in HTTP headers. Read the full article. [The H Security]
Cyber-criminals see law firms as particularly lucrative targets that
can earn them hundreds of thousands of dollars per heist. Cyberspies
also attack attorney firms to steal client data that can be sold or
used to learn the details of future litigation. Read the full article. [SF Chronicle]
In their constant quest to find new and interesting ways to abuse the Internet, attackers recently have begun using an old technique to obfuscate URLs and IP addresses to bypass URL filters and direct users to malicious sites.
Computer hacker Albert Gonzalez deserves a quarter-century behind bars
for leading a gang of cyberthieves who stole tens of millions of credit
and debit card numbers from a transaction processor and several giant
retail chains, federal prosecutors argued in a recent court filing. Read the full article. [Wired]
Thorsten Holz, researcher at Vienna University of Technology, whose team not only participated in the recent takedown of the Waledac botnet, but released an interesting paper earlier this year, summarizing their findings based on 33GB of crimeware data obtained from active campaigns talks to Dancho Danchev of ZDNet. Read the full article. [ZDNet]
Google has released its own Web application security scanner, called Skipfish. The free scanner is designed to work within a variety of existing Web application frameworks and is built with an emphasis on speed and low false-positives, the company said.
Security blogger Brian Krebs has compiled lists of the top 10 ISPs who are hosting the worst botnets, spam, phishing, and other malware from independent tracking organizations. These lists come from: Stop Badware, F.I.R.E., Phishtank, Zeustracker, Malware Domain List, Arbor Top ASN List, Emerging Threats Compromised IPS, Emerging Threata RBN, Shadowswerver, and Google Safebrowsing. Read the full article. [KrebsonSecurity]
Here are four techniques and related technologies several cited as
underrated in today’s security fight. Since one security pro’s miracle
tool is another’s waste of budget, it’s no surprise that a couple of
the technologies panned earlier are praised here. Read the full article. [CSO]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
