Week in review: Mac OS X Trojan, Bredolab shutdown and Firefox add-on for hijacking online accounts
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Firefox extension makes social network ID spoofing trivial
“When it comes to user privacy, SSL is the elephant in the room,” said Eric Butler, the developer of the extension in question, dubbed Firesheep.
Most users still vulnerable to attacks that exploit Java flaw
More than a week after Oracle released a critical patch for Java, more than 68% percent of Internet users are still vulnerable to attacks that exploit these vulnerabilities. This is a huge issue, since 73 percent of Internet users use Java.
Wireless security considerations
Brad Haines is chief researcher of Renderlab.net and the author of Seven Deadliest Wireless Technologies Attacks and a contributor to RFID Security and Kismet Hacking. In this interview he discusses wardriving, client attacks, WPA encryption, RFID technology and his latest book.
Fabric weaves security into program code
Wouldn’t it be wonderful if we could build security into a program as it is written? This idea spurred a number of researchers from Cornell University to try and develop a new platform and a new language for building secure information systems, which they dubbed Fabric.
Iranian Cyber Army behind TechCrunch Europe hack?
In 2009, the “Iranian Cyber Army” hacked several popular websites to express their discontent over the US embargo on Iran. A month ago, TechCrunch’s European website was hacked and was redirecting readers to a server serving malware. At first glance, nobody would tie all those events to the same attackers.
iOS security loophole allows access to passcode-protected iPhone
A security hole in Apple iOS 4.1 allows anyone to bypass the passcode screen and access certain functions of the iPhone.
Bredolab botnet beheaded
Botnet takedowns have become a common occurrence this year, and the last one to be hit is Bredolab. Counting some 30 million bots and nearly 150 command and control centers, it was one of the biggest in existence – until this week.
A closer look at Watchmac
Watchmac (v.1.6) is a handy piece of software that will tell you if someone has fiddled with your laptop while you were gone – moved it, removed its battery or unplugged its power cord – not to mention tried to unlock it or authenticate into the software. It can also be used as an alarm to deter thieves.
Most Americans support an Internet kill switch
Sixty-one percent of Americans said the President should have the ability to shut down portions of the Internet in the event of a coordinated malicious cyber attack.
Alleged spam kingpin under investigation
31-year old Russian Igor Gusev is being investigated by the Russian police because they believe him to be the central figure behind the well-known spamming affiliate program SpamIt.com, which ceased to operate some three weeks ago.
Boonana Trojan for Mac OS X spreads via social media
The Trojan horse, Trojan.osx.boonana.a, is spreading through social networking sites, including Facebook, disguised as a video. The Trojan is currently appearing as a link in messages on social networking sites with the subject “Is this you in this video?”
Cloud security risks, benefits and cost savings
Harold Moss is the Emerging Tech & Cloud Computing Technical Architect, IBM Security Strategy. In this interview he talks about the security of cloud service providers, cost savings and risks involved in enterprises using cloud computing and IBM’s approach to cloud security.
Firefox 0-day compromises visitors of Nobel Peace Prize website
The official site of the Nobel Peace Prize has been compromised by using a malicious PHP Script, and has been found serving malware by taking advantage of a Firefox zero-day vulnerability.
ZeuS-SpyEye merger
Feeling the heat of the attention of international law enforcement and the recent takedowns of various botnets and the worldwide arrests of gang members using his malware, the developer of the ZeuS Trojan has chosen to disappear and lay low for a while.
New 0-day flaw in Flash Player exploited in the wild?
Bad news just keep piling on Adobe – it looks like there is a new zero-day vulnerability in their Flash Player that is being exploited in the wild.
Microsoft contemplating SSL for Bing
HTTP session hijacking as a possibility and tools to execute it have been around for more than half a decade, but it took an easy-to-use Firefox add-on like Firesheep to point out “the elephant in the room” – the lack of full-end encryption on popular sites such as Facebook, Twitter, Yahoo, Bing, and many others.
A new approach for malware distribution
Some malware developers sell their product, other offer its source code for free. So, what’s the catch? What’s in it for them?
A peek into Google’s anti-malware operation
Google goes to great lengths to secure its users from threats lurking on the Web, because a half-hearted effort would soon drive them out of business. But Google security researcher Fabrice Jaubert revealed that sometimes even seemingly good methods are thwarted by careless users.