There are security conferences, and then there is Virus Bulletin. While virtually all of the presentations are from researchers working at antimalware vendors and other security companies, the talks are quite technical and this year’s conference, which starts Wednesday in Geneva, Switzerland, features one most interesting speaker: Eric Davis of Google.
Locked in a cat-and-mouse game with spammers who use bots to defeat anti-fraud mechanisms and create fake accounts, Google today announced a deal to acquire reCAPTCHA, a company that provides those squiggly words at login screens.
The ReCAPTCHA deal isn’t exactly a security transaction. Strategically, it gives Google an excellent crowd-sourcing tool to beef up its already impressive machine-vision algorithms (think book-scanning and maps) but, in the long run, the ability to use CAPTCHAs that are near-impossible for bots to decipher allows Google to raise the bar significantly in the fight against bots and spam.
Microsoft’s Security Development Lifecycle (SDL) team has released two new security tools to help developers test and verify the security of software programs.
The tools — BinScope Binary Analyzer and MiniFuzz File Fuzzer — are available for download at no cost.
Mozilla has released a new version of its flagship Firefox browser to fix 10 vulnerabilities that put Web surfers at risk of code execution attacks.
The Firefox 3.5.3 update — available for Windows, Mac and Linux users — patches security holes that could allow drive-by download attacks if a user simply surfs to a booby-trapped Web site.
DarkReading is reporting on the launch of a new experimental service set up to detect spam and threats on the popular Twitter microblogging service.
The experiment, called TwiGUARD, lets Twitter users check if a follower is a spammer or if a link embedded in a tweet is malicious.
Starting with the upcoming releases of Firefox 3.5.3 and Firefox 3.0.14, Mozilla will warn users if their version of the popular Adobe Flash Player plug-in is out of date, according to Mozilla Human Shield Johnathan Nightingale.
Once the browser is updated, Mozilla will present the user with a visual notice on its first-run Web site that the Flash Player plugin contains security and stability vulnerabilities.
Security researchers have intercepted a fake Flash Player update creating a Firefox add-on that spies on the user’s Google search results.
The malicious Firefox extension, called “Adobe Flash Player 0.2,” injects ads into the user’s Google search results pages and even has the capability to monitor the user’s browsing activities, particularly Google search queries using the Firefox browser. It then sends the information it gathers to a hacker-controlled server.
Apple’s commercials may give the impression that Macs are virus-free but the company isn’t taking any chances with the newest Mac OS X refresh.
Apple has quietly added a new Snow Leopard feature to scan software downloads for malware, a no-brainer move that coincides with a noticeable spike in malicious files embedded in pirated copies of Mac-specific software. Read the full story [zdnet.com]
This video is a demonstration of an attack exploiting a vulnerability in Facebook. It is a companion video to this blog post [quaji.com] that describes and discusses the hack. In a nutshell, a Facebook user’s personal is stolen. The only thing he does is view a regular, legitimate forum site.
Arbor Networks security researcher Jose Nazario has stumbled upon a crimeware botnet using Twitter as its command-and-control operation.
The botnet, which is linked to identity thieves in Brazil, uses Twitter status messages to communicate with bots — sending new links for the infected computers to contact and new commands and executables to download and run. Read the full story [arbornetworks.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
