Twitter Hit By Phishing Attack
Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts. Read the full article. [The Register]
Web Security
Online Crime Easier, More Budget Friendly
Mainstream attention to Operation Aurora and the Kneber (Zeus) botnet are welcome. It underscores how the Internet underground has advanced to the point where a plethora of
powerful hacking tools and services is readily available to novice
hackers and elite crime gangs alike – with prices to fit every
budget. Read the full article. [The Last Watchdog]
Man in the Browser: Inside the Zeus Trojan
By Atif Mushaq, FireEye
Man in the Browser a.k.a MITB is a new
breed of attacks whose primary objective is to spy on browser sessions
(mostly banking) and in that process intercept and modify the web page
contents transparently in the background. In a classic MITB attack, it’s very likely that what the user is seeing on his/her browser
window is not something which the actual server sent. Similarly, what
the server sees on the other end might not be what user was intending to
send.
The Cloud Security Alliance (CSA) and IEEE are joining forces to ensure
that best practices and standards are developed and available to
provide security assurance for cloud computing.
As a result of this collaboration, CSA and IEEE have been conducting a
survey to identify and define the most critical security concerns
surrounding enterprise cloud computing. Read the full article. [Help Net Security]
Czech security experts say they have uncovered
a global botnet that may be redirecting Web surfers to other sites for
the purpose of stealing their data.
The botnet’s creators have dubbed the network “Chuck Norris” after the famous Hollywood actor and martial arts expert. Read the full article. [Dark Reading]
How did the Kneber botnet manage to stay beneath the radar? Who’s behind it?
Is it an isolated underground project, or a part of the malicious
portfolio of a cybercrime organization diversifying on multiple fronts
within the underground marketplace? Read the full article. [ZDNet]
eBay is working on a fix for a cross-site request forgery problem that could allow an attacker to change a user’s password and get access to that user’s account. Read the full article. [eWEEK]
Robert Thompson, also known as John Lawson, age 43, of Zachary, La., was sentenced to a term of 309 years in prison. Thompson, the leader of a massive identity theft and bribery scheme, was sentenced based on charges of conspiracy, wire fraud, mail fraud, bank fraud, computer fraud, access device fraud, aggravated identity theft, money laundering, and obstruction of justice. This is the longest sentence of any white collar offender in the history of the Middle District of Louisiana. Read the full FBI statement. [FBI.gov]
More than 74,000 PCs at nearly 2,500 organizations around the globe
were compromised over the past year and a half in a botnet infestation
designed to steal login credentials to bank sites, social networks, and
e-mail systems, researchers have discovered. Read the full article. [cnet]
The Mozilla developers have announced the release of version 3.5.8 and 3.0.18 of their open source Firefox web browser. In addition to the usual bug fixes and stability improvements, the updates address a total of five vulnerabilities, three of them rated critical. Read the full article. [The H Security]
