• Patching Mobile Computers

    Updated: 2010-09-02 14:53:28
    A growing number of users are mobile.   While I’ve heard some people say these people will VPN and thus get security updates, I think that many of them don’t VPN in.   They can do so much over on their phone, connect to mail over ISA, perhaps they are using a customers mailbox.   Some are at [...]

  • Guest blog: Information Rights Management ready for prime time?

    Updated: 2010-09-02 10:29:29
    In this guest blog product manager John Stringer explores how Sophos's Data Loss Protection (DLP) technology can help companies tackling Information Rights Management. Over to you John.. In "Up in the Air" George Clooney's character loved to travel - for the reward points and the free miles kickback. Now, in business, it's not just the axe [...]

  • Zeus Botnet Attacks via FedEx Scam

    Updated: 2010-09-01 02:18:25
    Yesterday we discovered a new Zeus campaign. Most of the messages associated with the new spam campaign are linked to the Asprox botnet. This time, the focus is on FedEx. Most of the attachments start with either FedExDoc[randomnumbers].exe or FedExInvoice[randomnumbers].exe. Those attachments are recognized as the Bredolab Trojan, which will download the Zeus component. This Zeus variant [...]

  • How Much Does My Identity Cost? (the Sequel)

    Updated: 2010-09-01 01:48:07
    Two weeks ago, I posted a blog entry talking about the counterfeiting of legal documents. I have received many comments and requests for further data from various Eastern Europe countries, France, and even the United States, related to this type of fraud. Aside from journalists, for whom it is their job, many people have contacted [...]

  • Cyber-Ark Password Vault

    Updated: 2010-09-01 01:31:29
    We bought Cyber-Ark’s Enterprise Password Vault product last year to provide an enterprise-grade method of protecting passwords.   Administrator passwords to corporate systems are essentially corporate assets and its a big hassle when the password is forgotten or held hostage.   (no hostage taking here, but I have seen issues caused by forgotten passwords).  Passwords are often [...]

  • Auditors and Company Policy, Part 2

    Updated: 2010-09-01 00:30:23
    Back in 2007 I posted a blog entry about catching our auditors violating company policy by putting their company’s computer on our network.   Today, new group of FISMA auditors, same issue.   If the auditors were a bit slicker, I”d believe them when they said they were testing our controls for unauthorized computers.   (trust me, this [...]

  • How to Quantify Risk

    Updated: 2010-08-31 19:00:36
    There has been much criticism of risk assessment and analysis over the past few years that amount to much ado about nothing. Why is it much ado about nothing? Well, because, quite simply, people oftentimes don’t understand what it is they’re criticizing, especially in the case of quantified risk analysis methods. Before we get into risk [...]

  • Labs Releases Whitepaper on Cooperative Anti-Malware on Endpoint and Gateway

    Updated: 2010-08-31 18:27:14
    The Anti-Malware engine is a critical and core piece of the McAfee anti-malware solutions. As with any core technology, the engine must be rock-solid stable, fast, and functionally rich. A new McAfee Labs whitepaper outlines these engine technologies and values, covering both endpoint and gateway uses. Beyond introductions to malware detection methodologies–ranging from exact detection to [...]

  • Not even to my desk

    Updated: 2010-08-31 16:26:20
    Walking into work through the South Lobby this morning I passed three monitors that normally have traffic, weather and footage from a traffic camera.   The traffic monitor displays traffic information from WTOP normally, but today it showed cgidoctor.com.   This page advised the user on how to remove fake antivirus infections.   Links to remove fake antivirus [...]

  • Don't panic! The ragtime jazz virus hasn't infected Gmail

    Updated: 2010-08-31 14:14:12
    Gmail users who run Google Chrome are up in arms today following the launch of the new Gmail priority inbox service. Not because the feature doesn't work for internet users who've chosen the Chrome browser to access their email, but because Google appears to have promoted the service in a cack-handed way which has scared some [...]

  • Fake TweetDeck update preys on Twitter users

    Updated: 2010-08-31 12:19:43
    It was a Bank Holiday weekend here in the UK meaning that we had the pleasure of a longer break than normal, with Monday not being a normal working day. But it appears that at least one bunch of criminals weren't resting on their laurels as they spread links pointing to what they claimed was an [...]

  • Shocking hidden message on Coca-Cola logo, and other Facebook scams

    Updated: 2010-08-31 11:26:38
    Once the bad guys have tricked you into adding a rogue application to your Facebook account, don't be surprised if they use it to spread more of their scams. Here's an account which suddenly started advertising a scam page, even though its user hadn't logged in for some time. In other words, they hadn't been [...]

  • Authentium Command Antivirus False Positive

    Updated: 2010-08-31 01:03:59
    Authentium Command Antivirus on Friday detected a handful of Office documents  as MSWord/Dropper.B!camelot.   I ran a couple of the files through VirusTotal and found Authentium was the only company detecting the file as a virus.   In some cases that would be a sign of being on the cutting edge of detection, but in this case [...]

  • PCI data security song [VIDEO]

    Updated: 2010-08-30 12:58:03
    If your company handles customer credit card payments from the likes of Visa, Mastercard and American Express, then it's paramount that you keep that information securely. The Payment Card Industry (PCI) has created a data security standard, explaining how firms and organisations can remain compliant- but the topic can sometimes be.. how shall I phrase this?.. [...]

  • iPhone OS – Safe again?

    Updated: 2010-08-30 01:23:24
    Three weeks ago a ‘mysterious’ new jailbreak technique was posted to jailbreakme.com. Research to date indicates that this technique leverages two distinct vulnerabilities to gain access to devices. The first issue exploited is a FreeType CFF font handling issue, exploitable via MobileSafari. The second issue exploited is an IOSurface framework issue that allows for privilege [...]

  • iPad and iPhone 4 tester scams hit Facebook

    Updated: 2010-08-30 00:38:35
    Can you really get a free iPad 3G or iPhone 4 by signing up just to be a tester? It sounds too good to be true, doesn't it? And it is. But, like me, you may have seen users on Facebook who appear to be promoting special deals which offer just that. Here's an example [...]

  • Did Gmail make you look like a spammer this week?

    Updated: 2010-08-27 12:14:05
    How mortified would you feel if you found that you had been spamming someone through no fault of your own? Well, up to 4 million Gmail users found out this week. I'm not talking about your computer being taken over by remote hackers who use it as part of a botnet to spew spam (although [...]

  • Follow Cluley on the new Digg

    Updated: 2010-08-27 07:30:01
    If you follow the hot internet stories, you can't have missed that Digg received more than a fresh coat of paint yesterday - it was entirely overhauled! Some of the old guard are upset about the changes, but one of the interesting new features of the site is its increased social media emphasis, making it simple [...]

  • Newegg Password Reset Scam: a Harbinger of Threats to Come?

    Updated: 2010-08-26 01:28:38
    This blog was updated at 1.15 pm Pacific time on Aug. 26. McAfee Labs has detected a new strain of spam in the wild that is not only a sophisticated forgery of a Newegg purchase receipt, but there is also some indication that the botnet may be attempting to abuse Newegg’s password reset system to further [...]

  • Shockwave Security Update

    Updated: 2010-08-25 03:51:33
    Adobe has released a security bulletin for Shockwave.   Version 11.5.8.612 fixes multiple vulnerabilities that could be used for code execution.

  • Insecure Library Loading in OS and Applications

    Updated: 2010-08-25 01:58:57
    While reading Microsoft’s confirmation of the DLL preloading risks in arbitrary Windows applications vulnerability, somehow it reminded me of the wave of LD_PRELOAD vulnerabilities that were exploited many years back on multiple non-Windows-based systems. It’s not a new class of vulnerability; the recent LNK file zero-day was probably the last biggest flaw that allows untrusted [...]

  • Three Strikes to Latest Phishing Scam

    Updated: 2010-08-24 22:50:44
    We unceasingly monitor and combat old and emerging web threats, taking different approaches to best protect our customers. Cybercriminals continuously look for new ways to steal valuable information. A recent phishing scam we’ve seen impersonates three popular institutions: PayPal, Bank of America, and free offers to check your credit score. The recent attack on Bank of America [...]

  • P and NP

    Updated: 2010-08-24 11:25:44
    Recently, Vinay Deolalikar self-published a proof that P is not equal to NP. So what does that mean exactly? P is short for Polynomial, and NP is short for Non-deterministic Polynomial. To understand the exact difference requires you to understand Turing machines (usually a senior level CS class). P is the class of [...]

  • How Much Does My Identity Cost?

    Updated: 2010-08-23 19:02:45
    Phishing and identity theft involve not only the theft of funds. In addition to financial data, information collected by cybercriminals also can allow them to create and sell false legal documents. On top of selling malware, renting botnets, or launching denial-of-service attacks, supplying falsified documents is another well-paid online activity. I visited such a business just [...]

  • In your matrix. Stealing your dots.

    Updated: 2010-08-21 04:49:35
    Researchers have developed a method (pdf) by which they are able to record the sound of a dot matrix printer in operation and recreate the information that was printed based on the audio data. Data leakage from electronic devices isn’t new (TEMPEST comes to mind). However, it seems like the higher-profile methods tend to [...]

  • The Cat and Mouse Game of Cryptography

    Updated: 2010-08-19 21:52:45
    MD5 is a hashing algorithm created in 1991 and still used by many applications for certain features. But MD5 is no longer recommended for many cases due to weaknesses discovered in the last few years, opening up some scary possibilities. At the end of this year, NIST standards for cryptography used by the federal government [...]

  • Fraud Strikes U.S. Travel Authorization Agency

    Updated: 2010-08-17 22:42:26
    Last year, the U.S. government passed a law making mandatory online registration for travel for all citizens from countries eligible for the Visa Waiver Program. The Visa Waiver Program is available to citizens from the European Union, but also to citizens from other countries such as Switzerland, Japan, South Korea, and Singapore. The registration has to [...]

  • PDF Signature Vulnerability Found (Kind of)

    Updated: 2010-08-17 21:20:52
    According to an article published last week, it is apparently possible to construct a signed PDF that can have its underlying data changed such that the signature is still valid, but the presentation of the data is changed.  It’s a neat trick, but there are a few things that mitigate the risk inherent in the [...]

  • SSL Proxies

    Updated: 2010-08-17 18:25:34
    Because it is open outbound from the firewall, many applications send their traffic across port 80 to avoid firewall issues.   This has led to port 80 being called the Firewall Traversal Exploit.   Port 443 then is the Secure Firewall Traversal Exploit because it allows traffic out in an encrypted fashion. Because its encrypted users bypass protections [...]

  • But I’m trying Real Hard to be a Sullenberger

    Updated: 2010-08-16 01:09:05
    Since it’s not obvious, the blog title is an allusion to Jules’ big speech in Pulp Fiction. I read a couple interesting blog entries on Friday.  John Pescatore asks “Are Security Professionals Like Stephen Slater.”  In another blog, Foilball asks us to look in the mirror and see if we’re more Sullenberger or Slater. Slater is [...]

  • Good App for iPhone Update

    Updated: 2010-08-15 06:55:27
    Good released a minor update to their app for the iPhone.   Release notes are on their site. Companies that don’t want to use ActiveSync but still feel pressured into making the iPhone an option are looking to Good to do so.   From the release notes: • Complete landscape view – Including email list view, calendar, [...]

  • Patching week in review

    Updated: 2010-08-15 06:49:50
    This week saw a large number of Microsoft patches Additionally Adobe released updates for Flash and Adobe Air. Acrobat and Reader updates expected for this week will occur next week. Apple patched the iPhone and released an update for QuickTime.  iTunes users were not given the QuickTime update as of this post. To stay up [...]

  • New Wave of Zbot Trojan

    Updated: 2010-08-14 03:57:58
    McAfee Labs detected a new wave of the PWS-Zbot (a.k.a Zeus) spam campaign this week. Some common phrases used in the email subject headers: Subject: Sales Dept Subject: Another candidate brought to you Subject: Summary of payments These emails carried PWS-Zbot Trojan variants that are a part of the 2.x version of the Zeus botnet, and currently try to access [...]

  • Security threats in Android! ..or not.

    Updated: 2010-08-13 22:40:30
    So you've been hearing lately about how some Android applications are going rogue, and being used to steal user's data and infiltrate their phones, to sit idly by only to wreak havoc when the user least expects it (ok, so maybe I exaggerated a little there). But there has been a lot of buzz lately about certain apps not playing by the rules, or including certain calls to leach user information. A lot of this buzz has been spun as backlash against Google for allowing these types of applications to exist (instead of having some asininely draconian filtering process like some 'other' phone provider).

  • A FAIR Analysis of Risk

    Updated: 2010-08-12 19:55:28
    Risk assessment gets a bad rap these days, thanks in large part to a checkered past colored by qualitative analyses. Historically, risk assessments have been fuzzy, at best, and down-right inaccurate and misleading at worst. You know the ones I’m talking about: some hot shot consultant comes in, pokes around, maybe runs a couple scans, [...]

  • Bare Metal Versus Hosted Hypervisor Security

    Updated: 2010-08-10 01:22:41
    by George Wilson, IBM Linux Technology Center I was recently reading through the NIST “Draft Guide to Security for Full Virtualization Technologies” (SP 800-125 draft) [http://csrc.nist.gov/publications/drafts/800-125/Draft-SP800-125.pdf]. It discusses various considerations relating to hypervisor security. One section that particularly struck me was the comparison of bare metal vs hosted hypervisors. These are also known as Type [...]

Previous Months Items

Aug 2010 | Jul 2010 | Jun 2010 | May 2010 | Apr 2010 | Mar 2010