We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.
The practice of holding websites hostage under the threat of denial-of-service (DoS) attacks is declining, according to security researchers at Symantec. DoS attacks are carried out by botnet operators using armies of remotely controlled PCs to flood a site with traffic and information requests. The attacks can cause sites and web services to run slowly or shut down altogether.
Researchers at SecureWorks have uncovered a new type of phishing attack that tries to trick victims into forwarding their telephone calls to the attacker to thwart attempts by a bank to detect fraud. The attack, found by the Atlanta-based security vendor this week, begins with an e-mail sent from the phisher telling the potential victim their bank needs to verify their phone number immediately, and their account will be suspended if they do not confirm the number. The victim is told to confirm their number by dialing *72 and then another number, effectively forwarding their calls to the phisher's telephone.
Numerous confirmed sources reporting to us, at this precise moment, that successive blog posts turn out to be a crappy way to convey the details of important vulnerabilities.
A New York teenager broke into AOL networks and databases containing customer information and infected servers with a malicious program to transfer confidential data to his computer, AOL and the Manhattan District Attorney's Office allege.
Security experts have warned that password recovery tools for OpenOffice, the open-source application suite, are vulnerable to abuse. The release of version 1.0.4 of Intelore's OpenOffice Password Recovery software on Thursday allows IT managers and systems administrators to recover OpenOffice passwords and discard formatting and editing restrictions--for example, locked cell protection and permissions. The software allows password recovery through brute force and dictionary-based attacks, or a combination of both.
You will notice in the picture at right that the KeeLog product is the smallest of the three, followed by the plug style KeyGhost and then the cable style KeyGhost. I tossed the KeyCarbon from my previous article in to help you with the size comparison. I'm not sure why KeyGhost chose to make their Time/Date stamping cable as big as it is. One failed on me during testing so I took it apart to see if I could reset it somehow. The core electronics look like they could easily be put into a smaller package. Maybe in later releases they will shrink down the housing. All of these keyloggers have their tradeoffs which I will cover shortly.
Cody Pierce knew right away what he had found, but he wasn't exactly sure how serious it was. Pierce and his fellow researchers at TippingPoint had spent much of the early part of last year poking around in the ActiveX controls in Windows XP, looking for controls that might be vulnerable. The team had decided at the beginning of the year that with all of the applications and code now running on the Web instead of desktops, ActiveX would be a prime avenue of attack for hackers in the coming months and years, and they wanted to get there before the attackers did.
Eight out of ten Web sites contain common flaws that can allow attackers to steal customer data, create phishing exploits, or craft a variety of other attacks, a security company reported today. WhiteHat Security regularly scans hundreds of "very popular, very high-traffic sites" for its online business customers, says Jeremiah Grossman, the company's founder. "More than likely, you have shopped there, or bank there," he says. Thirty percent of scanned sites contain an urgent vulnerability, such as one that allows direct access to a company database with customer information, he says.
Cybercrooks who rig Web sites to break into PCs are getting better at hiding their malicious code, a security expert said Wednesday. Increasingly the actual code, often JavaScript, used to attack PCs is hidden in Flash animations or scrambled so that anyone who examines the source of a page can't easily identify it, said Jose Nazario, a senior software engineer at Arbor Networks, in a presentation at the CanSecWest security confab here.
A break-in targeting State Department computers worldwide last summer occurred after a department employee in Asia opened a mysterious e-mail that quietly allowed hackers inside the U.S. government's network.
As JavaScript becomes an increasingly key component of online attacks, attackers are investing more energy in obfuscation and other techniques to make defenders' attempts at reverse engineering more difficult, a security researcher told attendees at the annual CanSecWest conference on Wednesday.
Think botnets are bad now? We ain't seen nothin' yet. A select group of some 40 security researchers gathered on April 10 in the first Usenix event devoted to these networks of infected machines. The invitation-only event, called HotBots, was held in Cambridge, Mass. At the event, researchers warned that botnets
The largest proliferation of email virus attacks in more than a year is likely to have occurred last Thursday, according to security company Postini. Postini said two variations of the Storm Worm virus, which originally spread across the internet in January, have quickly driven global virus levels 60 times higher than their daily average. Email users should be on alert for messages with "love"-related subject lines and an executable attachment that would contain a Trojan virus, as well as messages with "Worm Alert!" subject lines that contained a dot-zip file full of malicious code.
A worm targeting Skype's VoIP application is harvesting e-mail addresses and directing users to a range of sites hosting other malicious software, security vendors said Monday. Once a machine is infected, the worm sends a malicious link via instant messages to other users in person's Skype contact list, according to F-Secure's blog.
Cyber criminals will increasingly target smartphone and PDA devices, according to the latest Global Threat Report from security vendor McAfee. The global smartphone market is expected to exceed $250bn (
Security organizations are tracking what's being described as the largest email attack since last year's Warezov outbreak, and the second onslaught this week to steal a page from the Storm Trojan's playbook. Adam Swidler, senior manager of solutions marketing for San Carlos, Calif.-based security vendor Postini Inc., said bot herders are using the outbreak to expand their array of zombie machines.
Due to the interactive nature and required access to exploit, local privilege escalation vulnerabilities have traditionally been thought to have a minimal impact on the strategies enterprise IT departments incorporate to protect networks when compared to other code execution vulnerabilities.
The Sdbot and Gaobot families are responsible for most botnets worldwide. These two families were responsible for 80 percent of detections related to bots during the first quarter of 2007. Other culprits, although on a much lesser scale, included Oscarbot, IRCbot or RXbot.
The recent buzz about security threats posed by iPods to corporations has reinforced the need for IT managers to treat these devices like any other removable media that employees with malicious intent can use to extract sensitive data. Following the suggestion recently made by a security company that iPods be banned from the workplace until proper protection is in place, and the emergence of a proof-of-concept iPod virus, it would seem that iPods pose a particularly high risk to corporations that let employees wander into work with these devices strung to their ears. Those same devices that entertain workers during their commute can be used to copy personal or financial data, intellectual property and other sensitive information from corporate PCs, often without a trace. The idea of stealing corporate data with an iPod has gained so much attention lately that it
A Juniper Networks security researcher says he's discovered a new type attack that can compromise embedded devices such as routers and mobile phones. The vulnerability lies in the Arm and XScale microprocessors, two chips that are widely used in these devices. "There are interesting quirks in the ARM and XScale architectures that make things very easy for an attacker," said Juniper's Barnaby Jack.
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
