Week in review: New cybercrime currency, massive SQL injection attack and Facebook battling scammers
Here’s an overview of some of last week’s most interesting news, videoas and articles:
Intellectual capital is the new cybercrime currency
Cybercriminals understand there is greater value in selling a corporations’ proprietary information and trade secrets which have little to no protection making intellectual capital their new currency of choice.
Lone hacker owns the Comodo certificate compromise
By his own admission, the hacker is Iranian, but claims not to be a member of the Iranian Cyber Army. He says he is “a single hacker with experience of 1000 hackers”, saying that Comodo’s researchers are wrong in their assumption that a team of hackers was behind the incident.
MySQL.com compromised by SQL injection attack
The compromise has garnered quite an interest from the security community for two simple reasons.
New ransomware variant in the wild
A new variant of a piece of ransomware seen in the wild late last year has begun targeting users that made the mistake of landing on the site that serves it via drive by download.
McAfee.com filled with vulnerabilities
Discovering that your site is chock full of security vulnerabilities must be embarrassing for any company, but is surely doubly so when you are a company offering to secure your customers’ websites.
Global spam drops by a third as Rustock botnet is dismantled
Symantec analysis reveals that in March, prior to its takedown, the Rustock botnet had been sending as many as 13.82 billion spam emails daily, accounting for an average of 28.5% of global spam sent from all botnets in March.
Facebook XSS flaw misused for automatic Wall posting
A currently unpatched XSS vulnerability in the mobile API version of Facebook is being exploited to post messages to users’ Walls, which serve as a gateway to the specially crafted website exploiting the flaw.
Qualys partners with StopBadware
Qualys is partnering with the non-profit anti-malware organization StopBadware. The two organizations will leverage one another’s strengths to bolster the Web’s collective defenses against malware.
Social media threats and targeted attacks
In the video below, Alexandru Catalin Cosoi, the Head of Online Threats Lab at BitDefender, talks about the new breed of social media threats and sophisticated targeted attacks.
BP loses laptop with personal data of 13,000 claimants
A laptop containing personal information of some 13,000 people who filed claims for compensation after last year’s big oil spill in the Gulf of Mexico has been lost, announced the spokesman of oil giant BP.
European Parliament computer network breached
The computer network of the European Parliament has been targeted by a cyber attack that may or may not be linked to the attack against the European Commission and the External Action Service networks that took place a week ago.
Two more Comodo RAs compromised
The investigation Comodo has mounted following the recent compromise of one of its Registration Authorities and the issuing of rogue certificates for popular sites has revealed that two additional RAs have been compromised but that no more bogus certificates had been issued.
NASA networks open to cyber attacks
Experts from the Office of the Inspector General (OIG) are not satisfied. Their audit of the computer networks on which NASA relies on to carry out its various missions has discovered that despite the recommendations for a consistent security policy and program they made after the previous audit back in May, the agency has yet to apply them.
A closer look at Disk Drill PRO
Disk Drill PRO (v1.2.97) is a Mac data recovery software that recovers data from HFS/HFS+, FAT, NTFS and other file systems. Disk Drill locates and recovers deleted files from any mountable media – main drives, external hard disks, memory cards, iPods Classic, etc.
Tips for protecting against advanced evasion techniques
By challenging the rules of traditional evasion techniques and combining multiple evasions, AETs are currently unable to be detected by existing network security systems.
Key security experts unfamiliar with DNSSEC
Half of IT personnel in charge of Internet security at the world’s largest organizations either haven’t heard of DNSSEC or have limited familiarity with it, according to IID.
Half of U.S. tax payers are unaware about identity theft risks
While consumers take steps to protect themselves against identity theft and remain concerned about the possibility of a data breach when sharing their personal information, they remain uneducated about the prevalence and methods of tax-related identity theft.
Massive SQL injection attack compromises 380,000 URLs
The injected script redirects users that have landed on the various infected pages to the domain in the script, which then redirects them further to a website simulating an anti-malware check and peddling a rogue AV solution.
Facebook battles likejacking scammers
Facebook has finally moved and put into effect a new system that is supposed to detect anomalous “Like” patterns and, once it does, asks the user to “Confirm” that he has presses the “Like” button.
Computer experts back appeal in Twitter-Wikileaks case
A number of respected security experts have decided to formally speak up in favor of the appeal that lawyers have filed against the Twitter data handover decision in WikiLeaks case, so they filed an amicus brief stating that they think the government needs to obtain a search warrant if they want to get the IP addresses of the Twitter users linked to WikiLeaks.
Recidivist youngster sentenced for new hack
27-year-old Van T. Dinh has been sentenced to three years in prison and ordered to pay $125,000 in restitution for having breached an online currency exchange service operating from New York and illegally transferred $110,000 to his own account. This news wouldn’t be so interesting were it not for the fact that this isn’t the first time Dinh has been caught hacking.
New Android Trojan punishes pirates
A new Android Trojan is up an about, and can be find on several of the most popular file sharing sites in the US and Asia. Disguised as a non-existent version of the legitimate Walk and Text application that can be found on Google’s Android Market, Android.Walkinwat aims to collect user information and shame them for having resorted to downloading what they thought was a cracked version of the app.