Week in review: Twitter and NYT hacks, the future of scareware
Here’s an overview of some of last week’s most interesting news and articles:
Trojan uses anti-spam system to keep in touch with C&C servers
Most malware is severely crippled if it can’t contact the C&C servers from which it receives its instructions and updates, so malware authors are constantly coming up with new ways to thwart firewalls, intrusion prevention systems and local gateways blocking such communication.
CEO hot seat: Dave Hansen
Recently SafeNet announced the appointment of Dave Hansen, an information security and cloud veteran, as the company’s new President and CEO. Help Net Security put him in the hot seat to learn more about his background, as well as future plans.
AV developer Avast starts bug bounty program
Rewards are offered only for security-related bugs in the software – information about UI, localization, bugs in the company’s website, and similar is, of course, welcome, but researchers will not be paid for it.
Events that defined the European information security landscape in 2012
We’ve reached out to a number of information security professionals all over Europe and here are some of the comments regarding the past 12 months that we’ve received.
U.S. DoD’s cybersecurity force to increase fivefold
The Pentagon is poised to start searching for more than 4,000 new employees for the Defense Department’s Cyber Command, in a bid to boost its cyber defensive and offensive capabilities.
Google offers over $3M for breaking Chrome OS
With $3.14159 prize pool and a completely new target, Google’s Pwnium contest has become an even greater challenge for security researchers out to make a buck from their knowledge and efforts.
Privacy tips for social networking, apps and geolocation
Many people confuse data privacy and data security. While there are similarities, privacy and security are not the same thing. Data security focuses on the confidentiality, integrity and availability of information and information technology resources, whereas data privacy is about an individual’s ability to retain control over his or her personally identifiable information (PII).
Trojan stole over 16,000 Facebook credentials
The ‘PokerAgent’ Trojan targeted Zynga Poker, the most popular online poker site in the world.
The effectiveness of bug bounty programs
Veracode released an infographic that examines the success of bug bounty programs. The past decade has witnessed major growth in demand for bug hunters, with online giants such as Google, Mozilla, Facebook, and PayPal turning to bug bounty programs to improve the security of their products.
Firefox will block by default nearly all plugins
Following the recent debacle of the critical Java 0-day that was being actively exploited in the wild, in an attempt to minimize its users’ attack surface Mozilla has enabled “Click To Play” for recent versions of Java on all platforms, ensuring that the Java plugin will not load unless a user specifically clicks to enable the plugin. But now it seems that all plugins will soon be on the chopping block (so to speak).
How do you protect your phone and your data?
Given the risks we run in not securing our phones, you’d be forgiven for thinking it must be a task requiring a doctorate in computer science. In reality, however, securing a smart phone can take only a few simple steps.
OS X Mountain Lion: The Missing Manual
With more than 200 new features in Mountain Lion, Apple has once again delivered a robust operating system that stays ahead of the curve. This immense book is here to help you grasp what’s new and learn every corner of the operating system.
High-risk Broadcom UPnP stack remote root vulnerability
Recently, DefenseCode researchers have uncovered a remote root access vulnerability in the default installation of Linksys routers. Further research revealed that the vulnerability is even more dangerous, since the same vulnerable firmware component is also used by numerous other router manufacturers.
China-based hackers infiltrated New York Times’ network
The New York Times’ computer systems and network has been breached and its journalists’ private computers and email correspondence spied on for a period of four months by hackers believed to be based in China, the NYT reported on Wednesday.
GitHub MitM attack orchestrated by Chinese censors?
China-based users and visitors of GitHub, the globally popular online source code repository, have been targeted with an man-in-the-middle attack late last Friday, reports GreatFire.org, a non-profit organization that reports on the government’s online censorship efforts in China.
Scareware trends and expected developments
While rogueware (mostly fake AV solutions) does its utmost to scare and annoy, ransomware thrives on fear of loss of important data, criminal punishment and, most of all, public embarrassment or hostile judgement – especially when it comes to accusations that can negatively impact the remainder of the victims’ lives. Looking at that difference from a psychological point of view, it’s obvious why ransomware has overtaken rogueware as cyber crooks’ preferred method of parting users with their hard-earned money.
Cybergangs embracing crimeware over social engineering
The APWG reports that there was a constant decline in the number of traditional phishing websites through September 2012, counterfeits usually impersonating well-known financial services companies or other brands.
Wall Street Journal says it has also been hacked
The Journal shared that the attackers managed to infiltrate its global computer system by initially targeting the journalists and the chief of its Beijing bureau. As with the NYT intrusions, the attackers weren’t after customer data or information that would help them gain commercial advantage.
Malicious Chrome extensions promoted via Facebook
Malicious Chrome extensions are lurking on the official Chrome Web Store, warns Kaspersky Lab Expert Fabio Assolini, and the campaign for leading users to them starts on Facebook.
Twitter confirms hack compromised 250,000 user accounts
Twitter has reset the passwords and revoked session tokens of some 250,000 Twitter users following a successful breach of a database containing user data.
Information risks in the enterprise
Ian Whiting is the CEO Titania, a developer of security auditing and testing software. In this interview he discusses managing information-related risks in the enterprise, Titania Labs free tools, current information security threats, and more.