Week in review: Massive Zeus C&C servers seizure, Android security, and the challenges of being a CISO
Here’s an overview of some of last week’s most interesting news, reviews, podcasts, interviews and articles:
Microsoft disrupts massive cybercrime operation
In its most complex effort to disrupt botnets to date, Microsoft, in collaboration with the financial services industry announced it has successfully executed a coordinated global action against some of the most notorious cybercrime operations that fuel online fraud and identity theft.
Android security from the ground up
Georgia Weidman is a penetration tester, security researcher, and trainer. She’s also one of the speakers at the upcoming HITBSecConf 2012 Amsterdam conference. In this interview she discusses the security issues on the Android platform and offers advice for application developers.
Facebook users targeted with account-hijacking Chrome extensions
With the steady rise in popularity of both Facebook and Google’s Chrome browser, cyber scammers have turned to targeting users of both.
Exploiting legitimate online technology
Criminals intent on distributing images of children being sexually abused are finding new ways of exploiting legitimate online technology, according to the Internet Watch Foundation (IWF).
How much does a 0-day vulnerability cost?
The market for exploits for zero-day vulnerabilities has exploded in the last year, says Adriel Desautels, the founder of Netragard, a penetration testing and vulnerability assessment outfit that, among other things, acquires and develops exploits.
Security main reason for stalled next generation data centre deployments
New survey results from Crossbeam identify network security as the number one reason IT organizations are stalled in their efforts to transition to cost- and energy-efficient Next Generation Data Centres (NGDCs).
Widespread use of vulnerable open source components
Sonatype and Aspect Security collaborated on a study of the real-world use of vulnerable versions of open source libraries.
The current challenges of being a CISO
In this podcast recorded at RSA Conference 2012, Rafal Los, Chief Security Evangelist at HP Software, talks about the evolution of the CISO role, its current reality, and offers a few tried and tested solutions for a number of problems all CISO practitioners face sooner or later.
Metasploit: The Penetration Tester’s Guide
Metasploit Framework (MF), the open source tool for launching exploits against remote machines, is a well-loved instrument that allows penetration testers to automate routine and complex tasks. This book explains how to use it and other assorted tools and will have you up and running your own exploits in a flash.
Rising SpyEye malicious code threat
AhnLab announced that its research has identified a significant majority of the domains and hosts for the SpyEye Banking Trojan are in the US. The malicious code has gained attention as of late for the threat it poses to online banking user information.
MasterCard releases tool that predicts ecommerce fraud
The new tool enhances insight into card behavior beyond a merchant’s website or a cardholder’s shopping cart. The service provides merchants with a predictive fraud score for Card-Not-Present transactions in real time to measure the likelihood that a transaction is fraudulent.
Scammers advertise Pinterest bots on Facebook
Internet scammers have launched a paid advertising campaign on Facebook targeting Pinterest fans, bringing the hunt for victims to a higher level of investment and sophistication to online social fraud, according to Bitdefender.
Complex security architectures and innovation
Martin Borrett is the Director of the IBM Institute of Advanced Security in Europe, and in this interview he discusses information security innovation, the importance of artificial intelligence in complex security architectures, CISO nightmares, and more.
The dangers of uncoordinated backup practices
One-third of SMBs allow employees to select their own method of backup for their data at work – essentially passing the buck when it comes to data protection, according to Mozy.
Six ways to improve SCADA security
When it comes to securing SCADA networks, we are years or even decades behind when compared to securing typical IT networks. In this article, Amol Sarwate, Security Research Manager at Qualys, presents some of the SCADA security’s most daunting challenges along with some recommendations to secure SCADA networks.
Targeted domain controller attacks increase 150%
Attackers, largely nation states and cyber criminals, are targeting intellectual property (IP) on these servers – everything from chemical formulas and vaccines to military data, and reports on global economic conditions.