James Butler and Peter Silberman talk malware
James Butler and Peter Silberman of MANDIANT with Threatpost’s Robert Vamosi about malware and their new memory forensic software, Memoryze.
Web Security
French hacker gains access to Twitter’s admin panel
From ZDNet (Dancho Danchev)
Yesterday, a French hacker claimed to have gained access to Twitter’s administration panel, and based on the screen shots that he included featuring internal data [zataz.com] for accounts belonging to U.S President Barack Obama, Britney Spears, Ashton Kutcher, and Lily Allen, as well as a detailed overview of different sections behind the scenes of Twitter, his claims [mashable.com] seem pretty legitimate. Read the full story [zdnet.com].
Identity thieves attack Facebook users
Identity thieves are currently launching a massive attack on Facebook [techcrunch.com], using fake log-in pages to hijack usernames and passwords.
The attackers are using Facebook’s mail system to send a one-line message luring users to “fbaction.net,” a site that clones the social networking site’s log-in screen. Read the full story [zdnet.com]
Security holes in the Apache Geronimo Application Server and SAP cFolders headline a list of five serious Web app vulnerabilities that demand immediate attention.
According to Mark Painter from the HP Security Laboratory, the Geronimo flaws expose users to a variety of attack vectors that could lead to the theft of sensitive information and cookie-based authentication credentials. Here’s the top-five list [zdnet.com]
By Ozzie Diaz
There are those that would argue U.S. House Representative Pete Hoekstra is too connected. According to a recent article in a top security trade publication, Rep. Hoekstra sent tweets during his recent trip to Iraq. Some of the tweets included: “Just landed in Baghdad. I believe it may be first time I’ve had bb service in Iraq. 11th trip here.” and “Moved into green zone by helicopter Iraqi flag now over palace. Headed to new US embassy Appears calmer less chaotic than previous here.”
From The H Security (Jürgen Schmidt)
Secure data transmission on the internet relies on encryption and security certificates. Mozilla has revised the way Firefox 3 handles certificates, but not always for the better. A few modifications will sort things out – and give you more security. Read the full story [h-online.com]
From ZDNet Zero Day
Now that Oprah’s all a twitter, it looks like everyone’s favorite micro-blogging tool is finally taking a hard look at security.
According to a job listing posted online, Twitter is searching for software engineers to focus specifically on application and infrastructure security. Read the full story [zdnet.com]
The United States Computer Emergency Response Team (US-CERT) has released a new ActiveX fuzzer to help developers pinpoint browser-based security vulnerabilities.
The tool, called Dranzer, lets software developers test ActiveX controls for vulnerabilities before the software is released to the public. It is available as an open-source utility.
In this Google Tech Talk, Nick Feamster, an assistant professor at Georgia Tech, dives into the murky world of phishing and online scams as they relate to the epidemic of spam.
From USA Today (Byron Acohido)
It’s become the new front in cybercrime: scams and identity-theft programs that attack e-mail accounts and users of social-networking sites such as Facebook and MySpace.
To carry out many of these automated attacks, cybercriminals first must overcome “captchas,” the distorted letters and characters that users of an e-mail or social-networking account are required to type to complete certain online forms. For years, captchas have helped to stop or bog down automated programs aimed at creating, among other things, e-mail accounts that promote scams such as fake computer virus protection and bogus accounts on social websites that can be used to collect personal information on legitimate users.
