Week in review: Compromised hardware, AV failures and published IE 0-day exploit
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Zuckerberg hacked into journalists’ email?
The Facebook co-founder has been accused three years ago of stealing the source code and the business plan for the social network from some Harvard colleagues, but it seems that two other charges could be laid at his door.
USB battery charger installs Trojan
The software that shows to which extent the battery is charged through the Energizer DUO USB recharger comes bundled up with a Trojan, says US CERT.
There is a social engineering scheme for everyone
Mike Bailey and Mike Murray are security penetration testers. They say that even though they engage in plenty attacks that exploit vulnerability in the technology, it is usually easier to resort to social engineering techniques to get “inside”.
Serious Apache vulnerability disclosed
A serious vulnerability in Apache’s HTTP web server that enables the attacker to gain remote access to the server and total control of a database has been discovered by Sense of Security Labs.
Mariposa bot distributed by Vodafone’s infected phone
Here is another piece of equipment whose software comes bundled with malware: the new Vodafone HTC Magic with Google’s Android OS.
UK threatens to retaliate over cyber attacks
The UK Government says that if the attacks continue much longer the country will be forced to start returning like for like and engage in a matching counterattack.
Eight vulnerabilities fixed, one IE 0-day warning for Patch Tuesday
This month’s Patch Tuesday delivers only 2 bulletins that fix 8 vulnerabilities targeting Movie Maker and Office, and that their rating is merely “Important”. Also published is a security advisory warning of a zero-day vulnerability in Internet Explorer that could allow remote code execution.
An introduction to virtualization security
The major components of a virtualization infrastructure and the IT strategy related to deployment and maintenance of virtualization technologies can be planned and secured fairly well.
Twitter tackles phishing problem
In a bid to obstruct the phishing onslaught that has lately been targeting its users, Twitter has announced that it will rout the submitted direct messages through a new URL service called twt.tl.
Basic security measures do wonders
Even successful hackers are not omnipotent, nor do they usually come, hack, and leave without a trace. We have multiple tools at our disposal that we must start combining to get a clear picture of what’s normal, so that we can notice when it’s not.
9 million ZeuS attacks blocked in the last 6 months
Trend Micro examines the Eastern European criminal enterprise behind one of the world’s most prolific crimeware kits designed for wholesale monetary theft.
Targeted attacks exploiting PDF bugs are soaring
Adobe Reader exploits seem the weapon of choice of many a cyber criminal – as can be attested by the statistics regarding the samples gathered by F-Secure’s Lab.
Exploit for IE 0-day flaw published, patch still unavailable
An Israeli hacker has created an exploit for the IE zero-day flaw that Microsoft warned about on Tuesday, and the code is already being inserted into the Metasploit Framework.
Koobface worm doubles its number of command and control servers
The shut down and recovery of the Troyak-as command and control center (C&C) for the active Zeus botnet was good news for the whole IT security community. Unfortunately, as some botnets struggle, others stay unaffected.
Apple Safari 4.0.5 patches critical vulnerabilities
Safari 4.0.5 includes improvements to performance, stability, and security.
The threat landscape is changing, AV fails to adjust
A recent testing conducted by NSS Labs presented us with some deplorable results: of the seven antivirus products tested two weeks after the IE bug used for breaching Google was revealed, only McAfee stopped both the original attack AND a new variant.
Q&A: Google hacking
Robert Abela is a Technical Manager at Acunetix and in this interview he discusses the importance of Google for security research, provides tips on Google for information gathering and more.