Week in review: Mobile drive-bys, Facebook bug bounty and Operation Shady RAT
Here’s an overview of some of last week’s most interesting news and articles:
Facebook introduces bug bounty program
Facebook has decided to follow in Google’s and Mozilla’s steps and institute a bug bounty program rewarding the responsible disclosure of security vulnerabilities in the social networking platform.
Mass iFrame injection attack now counts millions of compromised web pages
Armorize researchers have been keeping an eye on the unfolding situation and point out that the attackers are taking advantage of a number of vulnerabilities in the Open Source online shop e-commerce solution osCommerce.
A unique malware file is created every half-second
Sophos has released its Mid-Year 2011 Security Threat Report, which reveals that since the beginning of 2011, the company has identified an average of 150,000 malware samples every day.
Testing the cloud
Managing IT networks requires a broad set of competencies in a growing number of technologies and products. It therefore makes sense that these competencies are centralized in larger data centers providing cloud services to a number of smaller enterprises for which IT is not a core competency.
Mac Trojan disguised as Flash Player initiates redirection attack
There’s a new Mac OS X Trojan in town, and it masquerades as a FlashPlayer.pkg installer, warns F-Secure.
Alleged LulzSec hacker released on bail
Jake Davis – the teenager from Shetland Islands that was arrested last week in connection to LulzSec and Anonymous attacks and is believed to be the infamous “Topiary” – has been released on bail and has been ordered to appear before the court again on August 30.
“Assume you are compromised,” say top security officers
In an environment where the focus shifts from the impossible task of preventing intrusion to the crucial task of preventing damage, the report includes instructive guidance from 16 global security leaders for confronting this new class of threat.
The Sun readers’ personal information leaked
The users affected by this leak are those who entered various competitions and polls on the website, and the stolen data contains names, addresses, phone numbers, emails and birth dates – but, luckily, no financial information.
Malware hides behind DWORD formatted IP addresses
Internet users know what a domain name is, and many of them are aware of the fact that it is a “translation” of a dotted decimal IP address. But how many of them know that there are other formats that a domain name can be presented in?
Zero-day bug found in WordPress themes
A bug in a popular WordPress utility is being misused by attackers to upload and make appear on the targeted site annoying and possibly malicious content.
Unprecedented state-sponsored global cyberattack revealed
The news that at least 72 government agencies, corporations and political organizations based all over the world have been targeted (and compromised) for over five years by what seems to be a single and likely state-sponsored group has resounded like a bomb blast all over the Internet.
Microsoft offers $250,000 prize for innovative security technology
Microsoft may not believe in bug bounties, but it’s not adverse to paying for knowledge when it comes to ingenious defensive solutions.
An epidemic of security worst practices
The majority of organizations fail to adhere to simple data protection standards and, in many cases, are fully unaware of what security practices are currently in place.
Mobile threats soared in past six months
Mobile malware has increased significantly, and Android users are two-and-a-half times as likely to encounter malware today than just six months ago.
Coding error reveals RSA attackers operated from China
A simple error message returned by a server to which a malware sample was trying to connect revealed to Dell SecureWorks researchers the origin of the RSA attack.
Cisco warranty CDs take users to malware site
Cisco has issued a warning about information packet and warranty CDs shipped to its own customers between December 2010 and August 2011, saying that they contain a reference to a third-party website known to be a malware repository.
Spam king facing criminal charges for Facebook spamming
Sanford “Spamford” Wallace has long been a thorn in the side of social networks and has already been successfully sued in civil court by the FCC, MySpace and Facebook.
Drive-by attacks targeting smartphones are in our future
A new study that has analyzed the behavior of 10,000 applications downloaded from the Android Market, shows that many mobile applications leak personal information and that mobile devices may be as vulnerable to drive-by downloads as PCs.
Was your company one of the targets of Operation Shady RAT?
“I divide the entire set of Fortune Global 2000 firms into two categories: those that know they’ve been compromised and those that don’t yet know,” said McAfee’s Dmitri Alperovitch when the report about the state-sponsored global cyberattack Operation Shady RAT was made public.