Free Tool Helps Graphically Visualize Attacks
The free Picviz tool from the Honeynet Project takes data from various log analysis sources and converts them into a multidimensional visual map of events. Read the full article. [Dark Reading]
Web Security
DNS Rebinding Attacks Explained
Security researcher Robert “Rsnake” Hansen discusses the concept of DNS rebinding attacks and the threat they pose.
Clientless SSL VPNs Break Web Browser Security Models
Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms, according to a warning from the U.S. Computer Emergency Response Team (US-CERT).
This security problem, discussed since at least 2006, could let an attacker could use these devices to bypass authentication or conduct other web-based attacks.
A U.S. district court judge has ordered the largest “spam gang” in the
world to pay nearly $15.2 million for sending unsolicited e-mail
messages marketing male-enhancement pills, prescription drugs, and
weight-loss supplements, according to the U.S. Federal Trade Commission. Read the full article. [InfoWorld]
Security experts are warning of a new malicious spam campaign with a Trojan Horse designed to harvest the log-in credentials of online gamers with sexually explicit images of Asian women. Read the full article. [SC Magazine]
Researchers have released code that can compromise
Microsoft’s Internet Explorer browser, but the software is not as
reliable as first thought. Read the full article. [Computerworld]
The latest malware spam email requests users to click on Flash download and install the “flashinstaller.exe,” but it has banking trojan behind it. Read the full article. [HelpNet Security]
Dennis Fisher talks with Steve Lipner of Microsoft about the Security Development Lifecycle, changes in the threat modeling process and the security of Windows 7.
Alan M. Ralsky, the “Godfather of Spam,” was sentenced to 51 months in prison for long term involvement in pump and dump schemes. Read the full article. [Washington Post]
Facebook administrators have blocked a clickjacking exploit that
displayed images of a scantily clad woman on profile pages without
first prompting the user for permission. Read the full article. [The Register]
