Week in review: Java 0-day finally patched, and fast and furious reverse engineering
Here’s an overview of some of last week’s most interesting news, videos, interviews and articles:
Fast and furious reverse engineering
Tomislav Pericin is one of the founders of ReversingLabs and the company’s Chief Software Architect. In this video, recorded at Hack in The Box Amsterdam 2012, he talks about TitanEngine, a Swiss army knife for reverse engineers that can be automated.
Dropbox introduces 2-factor authentication
Early this month, popular file hosting service Dropbox confirmed an internal breach the resulted in its European users receiving spam advertising gambling websites, and announced a number of new security features – among them was the introduction of optional two-factor authentication.
Hackers leak information stolen from over 100 sites
Hacker collective Team GhostShell has posted on Saturday on their Twitter account links to a massive leak that supposedly includes over one million of user record sets stolen from around 100 website across the globe.
What keeps information security leaders awake at night
In this interview, Herbert ‘Hugh’ Thompson, Program Committee Chair for RSA Conferences and Chief Security Strategist at People Security, talks about challenges faced by information security leaders, privacy issues, social networking, and RSA Conference Europe 2012.
Fake Facebook photo notifications carry malware
Fake Facebook notifications informing users that a friend has posted a new photo of them on the social network have been spotted hitting inboxes around the world.
BYOD is not for every company, or every employee
The rise of bring your own device (BYOD) programs is the single most radical shift in the economics of client computing for business since PCs invaded the workplace, according to Gartner. Every business needs a clearly articulated position on BYOD, even if it chooses not to allow for it.
Map of state data breach notification laws
Imation used publicly available sites (including information obtained via the National Conference of State Legislatures) to analyze state compliance laws in the 46 U.S. states that have such laws, as well as in Puerto Rico, the District of Columbia and the U.S. Virgin Islands.
Hackers allegedly breached Saudi Aramco again
Saudi Aramco, the national oil company of Saudi Arabia and the biggest oil company in the world, has issued a statement announcing that it has restored all its main internal network services that were impacted in a recent cyber attack which affected about 30,000 workstations – a number that corresponds with that shared by the Cutting Sword of Justice, the hacker group that took credit for the breach.
Beware of fake Symantec AV notifications
Malware peddlers occasionally take advantage of the good reputation of big security companies to spread their malicious wares, and in a recently spotted malicious email campaign, they are misusing the names of a number of them.
Key challenges in proactive threat management
There is a downward trend in IT’s ability to consistently coordinate, measure and improve security data management processes, including log management, compliance reporting, real-time monitoring, forensic investigation and incident response, according to Sensage.
Toyota accuses ex contractor of hacking, stealing trade secrets
A former contractor of Toyota’s U.S.-based manufacturing company has been accused of hacking into the toyotasupplier.com website, of downloading sensitive proprietary information from it, of unauthorized accessing of the Toyota computer system, and of sabotaging the company’s internal software.
Another alleged LulzSec member arrested for Sony hack
Another suspected LulzSec member has been charged for his alleged role in the attacks against Sony Pictures Entertainment’s website and computer systems, the theft of over one million user accounts, and their subsequent publishing on the Internet.
Cybercriminals use throw-away domains to infiltrate enterprise networks
Research shows that over 95 percent of companies are compromised by advanced malware and most are not aware of the attack.
Cross-platform Wirenet Trojan targets Mac and Linux users
Since Windows users constitute the majority of computer users around the world, most malware is designed to target that particular OS and software made for it. Still, every now and then, malware that eschews that oft trodden route turns up.
UK data breaches up 1000% in five years
Imation today released figures obtained through a request under the Freedom of Information Act which show that data breach numbers in the UK have increased by more than 1000% in the past five years.
AV-killing worm spreads via Facebook chat and IM clients
A rather industrious piece of malware that – among other things – paves the way for other malware by disabling AV solutions and software update modules has been spotted spreading via several Instant Messaging applications (ICQ, Skype, GTalk, Pidgin, MSN, YIM) and Facebook.
Preparing for your first security breach
You have probably realized this in your first week on the job – security professionals are not well-renowned for the quality of their sleep, or the health of their livers. This is a guide for everyone who is dreading the day when the excrement impacts the oscillator.
Virus shuts down gas company’s site and offices
The official website and the email servers of Ras Laffan Liquefied Natural Gas Company – the world’s second largest liquefied natural gas company which distributes some 36 million tons of it every year – have been taken offline after a still unknown virus hit the company’s office systems.
Oracle patches Java 0-day, researchers say there’s another one
Oracle has finally issued an update for Java 7 (v 1.7.0_07) which solves the problem of the CVE-2012-4681 vulnerability (which actually consists of two distinct flaws). Still, researchers from Polish firm Security Explorations – the ones who alerted Oracle about them in the first place – claim that they have discovered a similar vulnerability (and, again, reported it to Oracle) that could very soon put Java users in danger again.