Monday, December 12, 2005

Study: One in Four Users Is Target of E-Mail Phishing Scams. Study: One in Four Users Is Target of E-Mail Phishing Scams. Roughly one in four U.S. Internet users are targets of phishing attacks[~]phony e-mails seeking personal financial data[~]according to a study conducted by Time Warner Inc.'s Internet unit AOL and the National Cyber Security Alliance.   [eWEEK Security] 2:04:31 PM  PermaLink   / trackback []

Most Americans Unprepared For Phishing Attacks. Most Americans Unprepared For Phishing Attacks. Americans are increasingly unable to tell the difference between legitimate and scam e-mail, a survey released Wednesday showed. [Security Pipeline] 2:00:54 PM  PermaLink   / trackback []

The secret life of a rootkit. The secret life of a rootkit. Opinion: Rootkits can cause a lot of trouble for IT managers. They can hide malicious code so it remains undetected by most security software. However, there are ways to find them, and Matthew Williamson of Sana Security explains how.   [Computerworld Security News] 1:58:17 PM  PermaLink   / trackback []

Intel readies rootkit- rooting hardware. Intel readies rootkit- rooting hardware. System protection chips due 2008-09 Intel has begun developing rootkit-detection technology with a view to preventing malicious code from modifying the host system's memory. [The Register - Security] 1:55:24 PM  PermaLink   / trackback []

Sites Installing Spyware Via Zero-Day IE Bug. Sites Installing Spyware Via Zero-Day IE Bug. A still-unpatched Internet Explorer vulnerability that's been used by attackers late November to compromise Windows PCs is now being used by large numbers of malicious Web sites to plant spyware and adware, a security company claimed Thursday. [Security Pipeline] 1:52:59 PM  PermaLink   / trackback []

Rootkits Making More Spyware, Adware Stick. Rootkits Making More Spyware, Adware Stick. The sharp rise in rootkits is due to spyware and adware purveyors trying to prevent their wares from being easily uninstalled, security experts said Thursday. [Security Pipeline] 1:49:18 PM  PermaLink   / trackback []

Airport passcodes leaked from virus-infected PC. Airport passcodes leaked from virus-infected PC. Passcodes needed to enter secure areas at 17 airports have appeared on the Internet after a virus infected a PC belonging to a JAL co-pilot.  [Computerworld Security News] 1:47:26 PM  PermaLink   / trackback []

Microsoft tightening security defaults in IE 7. Microsoft tightening security defaults in IE 7. Microsoft plans to introduce several changes in how Internet Explorer 7 classifies Web sites for security, a move aimed at reducing the likelihood that users will fall victim to malicious code. [Computerworld Security News] 1:43:42 PM  PermaLink   / trackback []

Small security bug in Firefox, users unscathed. Small security bug in Firefox, users unscathed. History repeating Mozilla has warned of a flaw in the latest version of its open source web browser software, Firefox 1.5. The security bug is liable to cause a browser to freeze up under certain conditions but all indications are that it fails to expose systems to more invasive hacker attacks. The medium to low risk vulnerability is the first to affect Firefox 1.5 and comes days after the release of the much heralded update.âo[oe] [The Register - Security] 1:42:27 PM  PermaLink   / trackback []

Hackers target Christian charity. Hackers target Christian charity. Donors' details swiped The Charity Commission has warned charities to protect themselves against internet risks after hackers attacked the online security systems of a Christian charity, Aid to the Church in Need, and stole details of over 2,000 online donors. [The Register - Security] 1:40:55 PM  PermaLink   / trackback []

A Fool's Choice: Features Or Security In Web Applications. A Fool's Choice: Features Or Security In Web Applications. New tools help developers find and fix flaws. But the strategy also must change. [Security Pipeline] 1:39:05 PM  PermaLink   / trackback []

Port Scans Don't Always Precede Network Hacks. Port Scans Don't Always Precede Network Hacks. Contrary to popular perception, port scans alone are not a reliable indicator of an impending hacker attack, according to a researcher at the University of Maryland.   [Computerworld Cybercrime News] 1:36:59 PM  PermaLink   / trackback []

SANS to launch graduate-level programs in information security. SANS to launch graduate-level programs in information security. The SANS Institute is adding two new graduate-level degree programs to the list of information security training and certification courses it offers.  [Computerworld Security News] 1:35:06 PM  PermaLink   / trackback []

Fingerprint Scanners Fooled By Play-Doh. Fingerprint Scanners Fooled By Play-Doh. * * Beatles-Beatles writes to tell us YubaNet is reporting that in recent tests by Stephanie C Schuckers, an associate professor of electrical and computer engineering at Clarkston University, she has shown that, among other things, biometric security measures were fooled 90% of the time by simple attacks like Play-Doh molds. From the article: "Schuckers' biometric research is funded by the National Science Foundation (NSF), the Office of Homeland Security and the Department of Defense. She is currently assessing spoofing vulnerability in fingerprint scanners and designing methods to correct for these as part of a $3.1 million interdisciplinary research project funded through the NSF." [Slashdot] 12:31:39 PM  PermaLink   / trackback []

Microsoft Excel Unspecified Memory Corruption Vulnerability An unspecified vulnerability has been reported to exist in Microsoft Excel. The vulnerability was announced on eBay. The discoverer was offering to sell the vulnerability details until the auction was terminated by eBay. According to the auction description, it is possible to have a large value passed to "msvcrt.memmove()" through data fields in an Excel .xls file. The discoverer has claimed that code execution is possible. This entry will be updated as more details become available. **UPDATE (Dec 9, 2005): Microsoft has confirmed that this vulnerability exists. See eWeek link in reference section. The original listing on eBay has been pulled. 12:29:38 PM  PermaLink   / trackback []

MS Excel exploit on auction. MS Excel exploit on auction. geo_2677 writes  "Someone had put up for auction on eBay the details of an exploit in Microsoft Excel according to a recent article on Securityfocus. According to the article Microsoft has confirmed that this vulnerability exists, but in the meantime the original listing on eBay has been pulled. " ---  The now pulled auction, but it does appear that Microsoft has confirmed the vulnerability in an eweek article. [Slashdot] 12:28:14 PM  PermaLink   / trackback []

"Fast Track" Air Traveler Identification System Expands. "Fast Track" Air Traveler Identification System Expands. Just one U.S. airport -- in Orlando, Fla. -- has a Registered Traveler program, in which passengers who pay a fee and get a background check can bypass an airport's general checkpoint and use a special lane for security clearance. The Transportation Security Administration wants to expand the program nationally by summer, using private companies to sign up participants and run the checkpoints. [Privacy.org - The Source for News, Information, and Action] 12:23:55 PM  PermaLink   / trackback []

Secondary Screening: Hacks And Bloggers's Epics on Gilmore Epic Kevin Drum at the Washington Monthly picked up on the Gilmore Epic, and has prompted me to post this post-mortem media round-up on Gilmore's hearing on Thursday. My take, published on Thursday in Wired News 12:19:44 PM  PermaLink   / trackback []

An Industry Unwilling to Play by Rules of 'Fair Use'. An Industry Unwilling to Play by Rules of 'Fair Use'. Scarcely a week passes without the entertainment industry warning us that its business model is about to be exterminated by some new technology. The Internet, satellite radio and TiVo are among the mortal threats that have sent media executives scurrying to Washington with proposals to rein them in, tax them, even ban them. The music labels, TV networks and movie studios never propose to alter their own models to accommodate new technologies âo[per thou] they merely insist that everybody else change to accommodate them. When they don't get their own way with lawmakers, they take it out on consumers. [Public Knowledge - Breaking News] 12:12:30 PM  PermaLink   / trackback []