aXXo Torrents Exploited by Malware Peddlers

When someone becomes a success by earning the admiration of their peers, there will always be the ‘hangers on’ who want to share the spoils of success. For aXXo, the most popular DVD ripper on BitTorrent, it’s about people using his name to further their own, sinister aim: to install malware on as many file-sharers machines as possible.

Read the article HERE.

The Zfone Project

Zfone is a new secure VoIP phone software product which lets you make encrypted phone calls over the Internet. Its principal designer is Phil Zimmermann, the creator of PGP, the most widely used email encryption software in the world. Zfone uses a new protocol called ZRTP, which has a better architecture than the other approaches to secure VoIP.

Visit the website HERE.

Microsoft Launches New Security Portal beta

Welcome to the Microsoft Malware Protection Center Portal Preview. This portal will officially launch in early July and will have additional features such as malware sample submission.

Take a look HERE.

Mac OS X vs Windows Vista

What better way to end the age-old OS X vs Vista debate than to set the two up for a traditional Elizabethan duel? Prepare yourselves for one of the bloodiest battles your eyes hath e'er seen...

See more HERE.

Jeopardy in Web 2.0

This is a technical paper submitted by Dharmesh M Mehta at OWASP Paper Section.
The paper describes the security problems in Web 2.0 which is the Next Generation of Web.

Read the article HERE.

Many Defenses To Fight Zero-Day Hacks

To fend off zero-day vulnerabilities, companies should consider implementing a "default deny" capability at the perimeter of their networks, said Russ Cooper, senior information security analyst at Cybertrust. The idea behind that approach is to allow only specific traffic in and out of a network gateway while blocking everything else by default.

Read the article HERE.

Google Deletes Rogue Ads - Dangers Persist

Google has removed ads [+] that appear alongside Google search results that re-directed users to malicious sites. But, according to security experts, the fix is temporary and search engine users should not assume sponsored links are all trustworthy.

Read the article HERE.

Five Days of Project Honey Pot Announcements

Each day between April 23 and April 27 Project Honey Pot made a major announcement.

Read them HERE.

DoS extortion is no longer profitable

In the last six months of 2006 we saw a pretty sharp decline in the daily number of denial of service attacks. Although there are likely a number of factors at play here, I think there is one primary factor: denial of service extortion attacks are no longer profitable.

Read the article HERE.

Rutkowska Launches Own Startup

Exhibiting stealth that would do a hacker proud, renowned rootkit researcher Joanna Rutkowska has quietly started her own security consulting and research firm. Its public debut will be at Black Hat USA in July, where she and a fellow researcher will provide a training course on stealth malware - including new ways to bypass the Windows Vista kernel.

Read the article HERE.

Disgruntled employees may seek IT revenge

Of all the security vendors exhibiting at Infosecurity Europe 2007 here this week, none claim to be able to detect a major threat to enterprises: unhappiness. Security software doesn't do a good job of detecting employees who may have a grudge against their companies. And often, those unhappy individuals are motivated by deep-seated human emotions: jealously, greed or desire for power.

Read the article HERE.

Security Vendors And Eggs

Not a day goes by where some media outlet reports a security breach of some sort. Laptops get stolen, portable media get lost, humans get phished, and websites get penetrated and abused. What you don't hear about too often is security solution providers having breaches, or as I like to call it, "egg on their bytes". The worst part of it all is that a vendor-that-will-remain-nameless allowed security professionals' information to be viewed by anyone who noticed a particular flaw in their 'free security seminar' registration portal.

Read the article HERE.

Weekend Reading

New approaches to malware detection

The traditional signature-based method to detect viruses and other malware is increasingly seen as an insufficient defense given the rapid pace at which attackers are churning out virus and spyware variants. All of which raises the question: What’s next?

The three security vendors that dominate the antivirus market today, McAfee, Symantec and Trend Micro, say they have no intention of abandoning signature-based defense, which calls for identifying a specific malware sample to create a matching signature in order to detect and eradicate it.

Take a look HERE.

==================================================================
Google rises at Yahoo's expense

Contrast those divergent fortunes with two years ago: The companies were pulling in about the same amount of revenue; they looked primed to battle for Internet domination; and the jury was still out on whether Google's largely unproven management had the chops to take on a seasoned pro like Semel. So what happened? While a wide range of factors from personnel decisions to luck played a role, most pundits think it came down to this:

Take a look HERE.

==================================================================
Kevin Mitnick - The Art of Deception [ Full PDF]

The ultimate source on social engineering!

Download the 577-page, 5-meg PDF HERE.

==================================================================
LOpht in Transition

Most of the '90s hacking group have emerged in legitimate roles.
Was their work ultimately boon or bane for security?

Take a look HERE.

==================================================================
Vista betas will kill your data

Microsoft has let it be known that the behaviour of Windows Vista beta copies is about to change fairly substantially. From May 31, anybody using a beta copy of the OS will find that their machine reboots every two hours, and that intermediate access will be limited to base-level file retrieval. That means that you could lose data you're working on, and that your machine will be good only for reformatting.
This isn't as bad news as it seems. Users who had taken part in the Vista beta scheme - millions of people, in fact - were all given free copies of Vista Ultimate by the Vole as a 'thank you'.
We suspect that this is more likely to affect those individuals who were using copies of the Vista beta nicked from mates or from BitTorrent in a bid to avoid having to pay for the full thing. The quick phase out means that this is possibly the shortest post-release beta Windows has seen.
So, if you're running on a Vista beta, you'd better scramble and get your system running, or else face a hard time come June

Source : The Inquirer

==================================================================
Cost of Data Leaks

A McAfee-commissioned report by the research firm Datamonitor says that 60 percent of respondents experienced a data leak last year.

Read the article HERE.

DNS Changer trojan

Adam Thomas in our malware research labs took a video of a Trojan DNS Changer a while back. This is a piece of malware that uses rootkit technology and changes your Windows DNS settings. Its purpose is to redirect your search results in popular search engines.

Watch the video HERE.

Job Offers That Get You Trouble

The e-mails attempt to recruit members of the public to become money launderers, acting as middle-men and accepting payments for spammed goods and other dubious financial transactions, banking the money or converting it to foreign currencies, and then passing it on to the fraudster. In exchange for receiving a percentage of the funds being transferred, typically 5 percent to 10 percent, the “employee” becomes the fall guy for the fraudster and is at risk of charges of money laundering and other criminal charges.

Read the article HERE.

LH Top 10: USB thumb drive tricks

Developers and road warriors have come up with all sorts of innovative techniques for putting these tiny roomy disks to good use. Step into my office for a list of our top 10 favorite thumb drive tricks.

Read the article HERE.

Microsoft changes to ward off .ANI-type flaws

How did the super-critical animated cursor (.ani) vulnerability get past all the strict code review, fuzz testing and other defense-in-depth mitigations built into Windows Vista?

Michael Howard has the answer and he's sharing it with us in a candid explanation from Microsoft on the lessons learned from the recent zero-day attacks and some planned changes to fix some warts in the SDL (Security Development Lifecycle).

Read the article HERE.

Antispy vs. Antispy

This is actually pretty funny. Last week I blogged about how WebRoot was doing some really weird things to get customers, like scraping our website for names from case studies, showcase customers, etc., and then contacting these customers. We had sent them a legal letter back in March on this activity, where they were doing this and giving customers misleading information.

Read the article HERE.

Linux 2.6.21 released

LINUS TORVALDS has released another version of the Linux kernel. This includes virtualisation with VMI which is a paravirtualisation interface that will be used by VM Ware.

Read the article HERE.

McAfee VirusScan Plus - free for 12 months

The Royal Bank of Scotland plc is only making available the download of the McAfee software for promotional purposes. IT IS IMPORTANT THAT YOU READ THE CONTENTS OF THIS NOTICE CAREFULLY BEFORE ACCESSING THE MCAFEE SOFTWARE OFFER WEBSITE.

Take a look [ in the bottom left corner ] HERE.

0wning Vista from the boot

Federico Biancuzzi interviews Nitin and Vipin Kumar, authors of VBootkit, a rootkit that is able to load from Windows Vista boot-sectors. They discuss the "features" of their code, the support of the various versions of Vista, the possibility to place it inside the BIOS (it needs around 1,500 bytes), and the chance to use it to bypass Vista's product activation or avoid DRM.

Read the article HERE.

Exploit code released for Adobe Photoshop flaw

Exploit code that could take advantage of a "highly critical" security flaw in the most recent versions of Adobe Photoshop has been published, a security researcher reported. The security flaw affects Adobe Photoshop Creative Suite 3, as well as CS2, according to a security advisory issued by Secunia.

Read the article HERE.

PC buyers aim to cut the 'crapware'

When large businesses buy new PCs, they often wipe the hard drives clean and install a fresh copy of Windows, along with the other software they want workers to have. However, what works for businesses isn't always so easy for individuals.

Many computers don't actually come with a clean copy of the operating system. Instead, many ship with a "recovery partition" or a recovery disc that restores the system back to the way it shipped--with all that extra software.

Read the article HERE.

Schneier questions need for security industry

Outspoken author and security guru Bruce Schneier has questioned the very existence of the security industry, suggesting it merely indicates the willingness of other technology companies to ship insecure software and hardware.

Read the article HERE.

How to: Encrypt Your VoIP

As VoIP becomes ever more popular, the security of these systems becomes more of a concern. VoIP can be vulnerable to a number of attacks due to the nature of VoIP calls. In short, VoIP traffic flows across the Internet in unencrypted packets, which means anyone that has access to the network between sender and recipient can intercept these packets — essentially allowing them to create a recording of your conversation.

Read the article HERE.

Steganos launches new protection software

Steganos has launched software designed to protect travelling wifi-hotspot users from snoops. The outfit says the software suite encrypts internet access and stored data and Outlook messages and enables the secure destruction of obsolete data.

Read the article HERE.

Web threats to surpass e-mail pests

By next year, Internet users can expect more cyberattacks to originate from the Web than via e-mail, security firm Trend Micro predicts. E-mail has traditionally been the top means of attack, with messages laden with Trojan horses and other malicious programs hitting inboxes. But the balance is about to tip as cybercrooks increasingly turn to the Web to attack PCs.

Read the article HERE.

Optical link hacking unsheathed

Instead of breaking a fibre and installing a device (splicing), an approach that might easily be detected, off-the shelf equipment makes it possible to extract data from an optical link without breaking a connection.

Read the article HERE.

Seven Reasons Microsoft Loves Open Source

Next week I’m leading the “Open Source, the Web, Interoperability, and Microsoft” panel at Mix07 in Vegas, my first Microsoft conference. Naturally, I’ve been pondering the topic so I don’t end up on stage with my pants around my ankles. The more I think about it, the more I think Microsoft loves open source—and not just because they’re fools if they don’t.

Read the article HERE.

The Virtues of Monoculture

Why does Microsoft win the development environment war so often, when we all know it's a lifetime lock-in to Windows? Perhaps it's because the open source community offers too much choice.

Read the article HERE.

Malware will thrive with Vista

Despite all the anti-malware roadblocks built into Windows Vista, a senior Microsoft official is lowering the security expectations, warning that viruses, password-stealing Trojans and rootkits will continue to thrive as malware authors adapt to the new operating system.

Read the article HERE.

Mac flaw may also affect Windows

Firefox on Windows is considered at risk at this time.

Read the article HERE.

Identity systems all about making claims

The traditional concepts of authentication and authorization will eventually give way to an inclusive identity system where users will present claims that answer who they are or what they can do in order to access systems and content or complete transactions, according to Microsoft’s identity architect.

Read the article HERE.

Its time to retire the browser

The time when Internet Explorer, Safari, Netscape, and Firebox as your window to the internet is just about done for. What is going to replace it? Rich internet applications that use components of your desktop and your browser make a more complex security model.

Read the article HERE.

First wireless USB chips certified

Like early Bluetooth setups, you will initially see them sold in pairs, a dongle and a device, but as they become common in the marketplace and built into devices, you will see more and more sold apart.

Read the article HERE.

==============================================
Next-generation, high-performance processor unveiled

The prototype for a revolutionary new general-purpose computer processor, which has the potential of reaching trillions of calculations per second, has been designed and built by a team of computer scientists at The University of Texas at Austin.

Read the article HERE.

Cyber Security Bulletins

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT).

Read more HERE.

SMTP Authentication Update

It's about two and a half years since the standards bodies threw up their hands and left SMTP authentication to the industry. Implementation progress has been slow but positive. And there have been some surprises.

Read the article HERE.

Data Compressors

With data compression a necessary fact of computing life, enterprising programmers have developed several many data compression software. Since the DOS days, we have had ARJ, ZIP, LHA, RAR and a host of other data compressors. This guide will examine the performance of the more popular data compressors for the PC.

Read the article HERE.

==============================================
SecureZIP

PKWare has released a free version of SecureZIP - encryption software designed for use on PCs, portable devices and laptops. SecureZIP Standard Version 11 aims to secure the body of e-mails, e-mail attachments and information stored on hard drives.

Visit the website HERE.

Program names govern admin rights in Vista

Developers have discovered that the name given to a Vista executable affects whether or not it will require admin rights to run. Security experts said the feature might seem odd, but helps to catch out spyware.

Read the article HERE.

Sweetening the Honeypot

New free tools and services aimed at making honeynets more manageable are now becoming available: The Honeynet Project next month will roll out its new Global Distributed Honeynet as well as new honeynet tools,.

Read the article HERE.

This Software Poses as the Bad Guys

For all our dependence on computer software, the truth is, it isn’t very safe. Recent data breaches involving tens of millions of confidential company files have made this all too clear.

Why is software potentially so dangerous to the health of a business? There are scores of reasons. The big one is that software systems are so complex that it is next to impossible to find all the holes.

Read the article HERE.

Ubuntu

Ubuntu 'Feisty Fawn' released

Canonical on Thursday released version 7.04 of Ubuntu Linux, nicknamed Feisty Fawn, but the company's Web site was unable to keep up with the demand for the software.

Ubuntu got an unsolicited endorsement from Michael Dell, chairman and CEO of Dell, a computer maker that's been wrestling with how to meet demand for desktop Linux. On Wednesday, the company announced on its Direct2Dell blog that Michael Dell got a new notebook with Feisty Fawn installed.

Take a look HERE.

==================================================================
Ubunto takes on XP in OS showdown

Dual booting Ubunto and Windows XP over six weeks gives a great insight into the strength's and weaknesses of the two operating systems.

So far most of the "is Linux ready for the desktop" reviews I have done have focused on the problems of installing the beast. However once it is installed and configured it is easy to see how much ground Ubunto has cut from under XP.

Take a look HERE.

==================================================================
Ubuntu's 'feisty' spin on virtualization

The Ubuntu version of Linux is getting more virtualization-friendly, but in a different way than its top rivals.

Canonical on Thursday is releasing Ubuntu 7.04, also known as Feisty Fawn, sporting two newer virtualization technologies. First is paravirt-ops, a layer that lets Linux get along better with the dominant virtualization software today, VMware. Second is KVM, which lets Linux run other operating systems as guests.

Read the article HERE.

Online Impersonations: No Validation Required

Back when I lived in the Silicon Valley, there was an ongoing employment scam. Prospective employees would show up with perfect resumes and immediately get hired. It would not take long before it was clear that these people did not have the experience stated on their resumes. Within six months they would be fired. However, now they had six months of legitimate experience with real companies that they could reference. Their next jobs might not be as good or glamorous, but it would be much better than if they started with their real resumes.

Read the article HERE.

Bugged Computer Mouse

Inside this specially bugged PS/2 mouse is hidden a tiny UHF transmitter capable of picking up sounds within a 5 metre radius. The mouse is plugged into the computer, and so the bug is powered by the computer too. However, as usual, Spy Catcher is very very expensive, and they are charging nearly £600 for this little gadget.

Read the article HERE.

Seeing through walls

Have you considered that someone could be reading what's on your monitor from a few rooms away? It's unlikely, but possible, as work by Cambridge University computer security researcher Markus Kuhn shows.

A radio antenna and radio receiver - equipment totalling less than £1000 - is all you need. Kuhn managed to grab the image to the left through two intermediate offices and three plasterboard walls.

Read the article HERE.

U.S. database exposes Social Security numbers

The Social Security numbers of tens of thousands of people who received loans or other financial assistance from two Agriculture Department programs were disclosed for years in a publicly available database, raising concerns about identity theft and other privacy violations.

Officials at the Agriculture Department and the Census Bureau, which maintains the database, were evidently unaware that the Social Security numbers were accessible in the database until they were notified last week by a farmer from Illinois, who stumbled across the database on the Internet.

Read the article HERE.

MacBook hacked in contest

Macaulay, a software engineer, was able to hack into a MacBook through a zero-day security hole in Apple's Safari browser. The successful attack on the second and final day of the contest required a conference organizer to surf to a malicious Web site using Safari on the MacBook--a type of attack familiar to Windows users.

Read the article HERE.

This is your life - according to Google

Google's new Web History feature provides a fascinating look at your web surfing habits, but to take advantage you'll need to give Google the permission to keep tabs on you.

Read the article HERE.

Cell phone becomes new town crier

Universities and some cities are starting to recognize cell phones as efficient tools for protecting and connecting students and citizens. But text message alerts are only one cell phone application that universities and communities can exploit to keep students and residents informed. Rave Wireless also sells a comprehensive solution called Rave Guardian that combines, text message alerts and GPS tracking services to help turn students' cell phones into personal alarm devices that can be used in a crisis.

Read the article HERE.

Ranking Bugs, Saving Pigs

His first hack may have been his most fortuitous: Rohit Dhamankar and his classmates in India had to hack into and use their engineering professors' email so they could apply to graduate schools in the U.S. "We didn't have email back then," he says of he and the other students at the Indian Institute of Technology in Kanpur who switched their names onto the accounts.

Read the article HERE.

Firefox gaining ground on IE

With the greatest increase in points (+1.4 points), Firefox in Oceania achieved a use rate of 24.8% for the week of March 5 to 11, 2007 and passes in front of Europe with 24.1%. Firefox gained ground on the other continents (North America, Africa and South America), except in Asia, where its rate remains stable and thus joins up with South America.

Read the article HERE.

Social network for the hacking community

Whitedust.net, has launched the web's first and only social networking site dedicated to the underground hacking community. After six long months in beta testing, the Hakspace.net social network has been launched. Free from the constraints and expectations of the mainstream, Hakspace.net is a place for like minded hackers, crackers and whitehats to communicate in an open, independent and anonymous manner. A place for security enthusiasts to assert their creations, agendas and theories.

Read the press release HERE.

Antivirus Testing and why it is futile

The professionals still do a decent enough job, but they will probably never make everybody happy. There will always be questions about how they do their job and if it is good enough. Purists will always say they do a bad job. The reality is that it is a very difficult job that has become virtually impossible to do, and these guys are doing their best within the limitations of practicality and available resources.

Read the article HERE.

Weekend Reading

101 Essential Freelancing Resources

The web is such a big and wonderful place, packed with tools and resources which you all too often don’t know about. So to help all you freelancers out there we have compiled a gigantic list of resources, categorized up for your benefit.

Read the article HERE.

==================================================================
Chocolate the key to uncovering PC passwords

Three years since the last time they pulled this stunt, cheeky researchers can still wangle IT passwords with free chocolate and flirting.

A train station survey of 300 office workers carried out by Infosecurity Europe researchers in London revealed the disturbing statistic that 64 per cent would hand over their office computer passwords for a bar of chocolate "and a smile".

The latest survey, however, also revealed what everyone knows but no one admits: 29 per cent of office workers know their colleagues' logins, and someone always has the boss's password.

Take a look HERE.

==================================================================
Lenders Misusing Student Database

Some lending companies with access to a national database that contains confidential information on tens of millions of student borrowers have repeatedly searched it in ways that violate federal rules, raising alarms about data mining and abuse of privacy, government and university officials said.

Take a look HERE.

==================================================================
The Virtual World of Computing

I’m wondering how many virtual applications are there that users enjoy using. I don’t have much but I’m using so far the following Virtual software/services or software that takes advantage of Virtual technology:

Take a look HERE.

==================================================================
Nutter puts Xbox in laptop

If you think you've seen it all when it comes to console hacking, think again. Legendary hardware hacker Ben Heckendorn has managed to squeeze an Xbox 360 into a laptop-sized unit, complete with USB keyboard and 17-inch HD display.

This isn't the first time the man has tried such a thing. His last X360 laptop was rather chunkier and clearly not as sexy, but we've also seen funky Wii mods from the man, too. Who's betting he can fit a PS3 in somewhere, too?

The machine really is a work of art, and his fabrication skills are second to none.

Source : The Inquirer

Take a look HERE.

==================================================================
Interested in beta testing Windows Media Center?

If you are selected to participate in the beta program, you will be asked to install the product and report your testing experiences to Microsoft. Reporting will include installation surveys, bug reports, and other means as required by Microsoft. If chosen, you will be contacting via e-mail by May 31, 2007.

Take a look and sign up HERE.

==================================================================
Rootkits becoming increasingly complex

Complexity in rootkits is growing at a phenomenal rate, allowing malicious software to burrow deep and potentially go undetected inside Microsoft's Windows platform, according to a security report released Wednesday by McAfee.

Read the article HERE.

Operation Ore flawed by fraud

The high-profile crackdown on internet child porn has claimed lives and destroyed reputations. But fresh evidence says the police got it wrong. Operation Ore has become embedded in public consciousness as the landmark police operation that tracked down people - almost always men - who allegedly paid to access child pornography via computer.

Thousands of cases under Operation Ore have been built on the shakiest of foundations - the use of credit card details to sign up for pornography websites. In many cases, the card details were stolen; the sites contained nothing or legal material only; and the people who allegedly signed up to visit the sites never went there.

The police experts couldn't have failed to notice it if they were competent, but they claimed they saw nothing. One Operation Ore police investigator said that he had never heard of Internet credit card fraud.

Read the article HERE.

Popular sites highly vulnerable to attack

Eight out of ten websites contain flaws that can allow attackers to steal customer data, create phishing exploits, or craft a variety of other attacks, a security company said. Two out of three scanned sites have one or more cross-site scripting (XSS) flaws, which take advantage of problems with sites' programming and are increasingly used in phishing attacks.

Read the article HERE.

Satnav hacking made simple

A pair of hackers have demonstrated a way to spoof travel information messages displayed on satellite navigation systems used by Italian drivers to bypass accidents, traffic jams and plot the most efficient routes from one point to another. The hack is so simple it's hard to believe no one has shown it off before.

Read the article HERE.

Russians crack OpenOffice security

OpenOffice users who've locked their files and forgotten the password - or who have a document but not the password for it - can now crack their way in, thanks to a toolkit from a Russian developer specialising in password recovery.

Unsurprisingly called OpenOffice Password Recovery, its developer Intelore claims it can even allow for typing errors, so you can get back a document after mistyping the password - whatever the password length. The program can also remove read-only and revision locks from documents.

Read the article HERE.

Rogue Networks Stir Trouble

It is disconcerting to hear that a recent audit of the [US] Internal Revenue Service's computer security posture revealed that some field offices were operating wireless networks accessible to anyone lurking nearby with a laptop.

The IRS inspector general's office scanned 20 IRS buildings in 10 cities. It found unauthorized wireless networks in at least four instances. The audit noted that one of the networks required no authentication at all, potentially exposing the IRS's internal network and taxpayer data to unauthorized access.

Read the article HERE.

Hacking wireless pointers, mice and keyboards

If your slides inexplicably fast-forward during your next presentation, it may be because Luis Miras is in the room. Miras, a vulnerability researcher and reverse-engineering specialist, has been studying wireless presenting tools, mice and keyboards to see if it's possible to sniff traffic and insert data. So far he has been successful with the clickers used in PowerPoint presentations.

Read the article HERE.

Apple Issues Patches for 25 Security Holes

All told, today's batch fixes some 25 distinct security vulnerabilities, including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4.

Read the article HERE.

Bug hunter targets routers

Software that runs home routers, cell phones and personal digital assistants is rife with security bugs, an expert said Thursday. Barnaby Jack, a Juniper Networks security researcher, gave a tutorial at the CanSecWest conference here on how bug hunters can find exploitable vulnerabilities in such devices and demonstrated an attack on a D-Link router using a yet-to-be-patched hole.

Read the article HERE.

Bank's two-factor authentication compromised

A two-factor authentication system operated by Dutch bank ABN Amro has been compromised and money stolen from the online accounts of customers who fell for a phishing scam. Two-factor authentication for online banking usually involves passwords and tokens which provide synchronised, constantly changing numbers to use as additional evidence of identity.

"There are a whole bunch of things that can go wrong with two-factor authentication," Ross Anderson, a professor of security engineering at Cambridge University, told the same conference. "Banks are resisting because their technical staff know that it will be expensive to introduce and will not be effective. Some banks will introduce it, it will be quickly broken and then quickly forgotten."

Read the article HERE.

Half-Life hacker holds Valve to ransom

A disgruntled Half-Life gamer claims to have hacked Valve's Steam servers and is holding the company to ransom. To prove his point, the hacker has released screenshots onto the web of Valve's internal admin system. The screenshots do seem to be legitimate, including listings of CyberCafe accounts, error logs and a small amount of credit card data with the numbers blanked out.

Read the article HERE.

Tools Will Help Personalize ID Theft by 2010

Hackers with scrounged-up data ask the same question as dogs who've caught the school bus: What do we do with it now? Roelof Temmingh has the answer, at least for rogue hackers, in the form of a framework that makes identity theft a much easier proposition. The framework, which is in the early stages of development, is called Evolution. Temmingh, a security expert who's authored well-known security testing applications such as Wikto and CrowBar, demonstrated Evolution during his opening presentation here at the CanSecWest security conference on April 18.

Read the article HERE.

Security Companies Sucker Us With Lemons

More than a year ago, I wrote about the increasing risks of data loss because more and more data fits in smaller and smaller packages. Today I use a 4-GB USB memory stick for backup while I am traveling. I like the convenience, but if I lose the tiny thing I risk all my data.

Encryption is the obvious solution for this problem -- I use PGPdisk -- but Secustick sounds even better: It automatically erases itself after a set number of bad password attempts. The company makes a bunch of other impressive claims: The product was commissioned, and eventually approved, by the French intelligence service; it is used by many militaries and banks; its technology is revolutionary.

Read the article HERE.

State Department - got mail [and hackers]

A break-in targeting State Department computers worldwide last summer occurred after a department employee in Asia opened a mysterious e-mail that quietly allowed hackers inside the U.S. government's network.

In the first public account revealing details about the intrusion and the government's hurried behind-the-scenes response, a senior State Department official described an elaborate ploy by sophisticated international hackers. They used a secret break-in technique that exploited a design flaw in Microsoft software.

Read the article HERE.

Kaspersky the Best Anti-Virus for Windows Vista

Kaspersky has taken the necessary steps to dispel all remaining doubt as to who delivers the best security solution for Windows Vista. In this context, the Russian security developer has applauded three “trophies” attributed to its products from three different sources.

Read the article HERE.

Targeted Attacks on the Rise

It's the other end of the threat spectrum: Instead of a massive attack on hundreds of your users, it's one message, sent to a single user, containing a backdoor Trojan - or worse. Such narrowly-targeted attacks are becoming more popular than ever, according to a new report issued today by MessageLabs. The messaging security company says it identified 716 emails in 249 targeted attacks last month. The attacks targeted 263 different domains, belonging to 216 different customers.

Read the article HERE.

PC makers walk fine line with 'crapware'

For years, computer makers have managed to wring a few extra bucks of profit out of each PC sale by bundling all sorts of third-party software. While adding software, setting default search engines and including toolbars can all put money in PC makers' pockets, the practice has also alienated some consumers who say all such "crapware" is clogging their hard drives and bogging down their systems.

Read the article HERE.

Privacy concerns dog Google-DoubleClick deal

There is growing unease among consumer privacy advocates over Google's proposed $3.1 billion acquisition of DoubleClick. How will the search-advertising powerhouse treat the massive amounts of data it already stores on people's search histories once it also has at its disposal a storehouse of data on people's surfing habits from DoubleClick, the No. 1 digital ad-serving company?

Read the article HERE.

Thunderbird 2 released

Thunderbird 2 features many new enhancements to help you better manage your unruly inbox, and stay informed. Thunderbird 2 scales to the most sophisticated organizational needs while making it easy to find what you need.

Visit the website HERE.

Botnets getting harder to kill

In their current form, botnets are bad enough, but they are quickly evolving into a much tougher species to kill, according to security researchers. At a conference last week called HotBots, in Cambridge, Massachusetts - the first Usenix conference devoted to botnets - researchers from three US institutions last week presented a paper highlighting the recent evolution of peer-to-peer botnets.

Read the article HERE.

DNS Attacks Could Go Deeper

Botnet operators are already exploiting the Microsoft DNS server bug now as predicted, but that should be the least of your worries. The real danger lies in an attacker using the flaw to take over an enterprise's internal DNS server.

Read the article HERE.

Security Remains Challenge for Browser Developers

Some of the leading names in the browser market took to the stage at the Web 2.0 conference here on April 16 to give an update on the state of that technology, and all agreed that security was one of the biggest challenges facing the industry.

Read the article HERE.

Consumers 'shun' hacked stores

Customers of companies which lose credit card data to hackers are voting with their wallets and taking their business elsewhere, suggests a survey. A majority of those questioned said they would stop spending in shops and on websites hit by criminal hackers.

Read the article HERE.

Microsoft’s advisories giving clues to hackers

How's this for a new twist on the old responsible disclosure debate: Hackers are taking advantage of information released in Microsoft's pre-patch security advisories to create exploits for zero-day vulnerabilities. The latest zero-day flaw in the Windows DNS Server RPC interface implementation is a perfect example of the tug-o-war within the MSRC (Microsoft Security Response Center) about how much information should be included in the pre-patch advisory.

Using clues in the workarounds section of the advisory, Errata Security researcher David Maynor said he was able to pinpoint the source of the vulnerability without much trouble.

Read the article HERE.

How quickly did you type that password?

The speed at which you type may now be used to determine whether you are allowed to view your bank account details or use other online services. A US company is aiming to reduce the risk of identity theft by introducing ‘bio-security’ to passwords, meaning that users would have to type their user name and password with consistent speed in order to be logged in.

Read the article HERE.

New IM worm targets Skype users

A new instant-messaging pest that spreads using the chat feature in Skype has surfaced. The worm, dubbed Pykse.A, is similar to threats that affect instant-messaging applications. A targeted Skype user will receive a chat message with text and a Web link that looks like it goes to a JPEG file on a Web site, F-Secure said on its Web site.

Read the article HERE.

BackTrack v.2.0

BackTrack v.2.0 is finally released, it’s been a long wait that’s for sure, it does look good though so perhaps it was worth waiting.

You can find some screenshots and read more HERE.

Open Source - is it any better?

It's "common knowledge" in some circles that open source software is "better" - but is it true? Does software really want to be free? Is software created by committee really more secure? Do those who push open source (or at least some of them) have something besides software to sell?

I hear it all the time: open source is supposedly more inherently secure than proprietary commercial software, because it's "peer reviewed." That's the magic that the open sourcerers invoke, but they've never really explained to my satisfaction how opening up the kernel to any and everybody can make a program more secure. I can see how it could make for more features, but I can't see how it makes for more security.

Read the article HERE.

Zombies infiltrate US military networks

Security researchers have traced spam-sending botnet clients back to networks run by the US military. Support Intelligence, the firm whose research on honeynets revealed that the networks of at least 28 Fortune 1000 companies contained malware-infected spam-spewing PCs, has found evidence of bots running behind military networks.

Read the article HERE.

Stalkers Go High Tech to Intimidate Victims

The case had the makings of an eerie cyber-mystery: A young Alexandria woman told local police she suspected that her ex-boyfriend was tapping into her e-mail inbox from thousands of miles away, reading messages before she could and harassing the senders.

She was right to be suspicious. Her ex had hacked into her e-mail account, either guessing her password or using spyware -- software that can secretly read e-mails and survey cyber-traffic, law enforcement officials said. For months, apparently, he had followed her every online move, part of a pattern of abuse city police are still investigating.

Read the article HERE.

Microsoft sheds light on Flash rival

Microsoft's answer to Adobe Systems' Flash Player has an official name--Silverlight--and a coveted target audience: media and entertainment companies bringing video to the Web.

On Monday at the National Association of Broadcasters (NAB) Show in Las Vegas, Microsoft is expected to launch Silverlight, a Web browser plug-in for playing media files and displaying interactive Web applications.

Read the article HERE.

Top 7 hackers ever

Why are they the best? What did they manage to do?

Read the article HERE.

Blackout threat for music thieves

People who illegally download music would have their telephone and internet services cut off under a radical new plan proposed by the music industry. Fed up with falling sales, the industry - which claims Australians download more than one billion songs illegally each year - has been discussing tough new guidelines with internet service providers (ISPs) since late last year.

Read the article HERE.

First Monday April 2007

Volume 12, Number 4 — April 2007

Read the articles HERE.

AVG Anti-Rootkit Free - The Verdict

Grisoft has released AVG Anti-Rootkit Free to the general public for download - for Windows 2000 and XP only. The company well known for leading the way in free Anti Virus and Spyware software has had a beta available for a few months and it looks like they have it ready for general release. The verdict is not great, but first lets have a look at the program and look at what it failed at later.

Read the article HERE.

DHS can not protect Internet

Amid the outcry over allegations that the Department of Homeland Security (DHS) wants the security keys to the DNSSEC encryption technology slowly – very slowly – being adopted by internet overlord ICANN, one ICANN board member, the refreshingly candid Susan Crawford, has recently taken her own swipe at security standards in place at the DHS.

According to Crawford, the DHS is woefully unprepared for what lies ahead. She noted at a recent conference that ICANN’s major security concern after the Distributed Denial of Service (DDoS) attack on six of the internet’s root servers in February has been a repeat of the incident powerful enough to cause a is a massive virtual blackout.

"From the outside, it looks as if [DHS] doesn't really know what it's doing," she said.

Read the article HERE.

Attack of the Facebook Snatchers

Facebook is quickly becoming one of the most popular social networking sites for the 20-something crowd. It was initially focused on college students, but has since opened up to the wider public. Recent statistics place Facebook among the most popular social networking sites on the Internet.

Read the article HERE.

Lifehacker's Top 10 Free System Recovery Tools

Your data's trapped on a dead computer. You lost your login password. You never wrote down the product key on a non-working Windows installation. Which one of these tools is right for you depends on your skill level, operating system and particular problem. Do yourself a favor and burn yourself a disc with a couple of these before the terrible day when you need 'em happens.

Read the article HERE.

Top 10 Firefox extensions to avoid

Popularity shouldn't be the acid test to determine if you should install an extension. The important question is whether it enhances your browsing experience without any nasty side effects. The good news is that the extension community is actually pretty adept at self-policing. Most extensions that are truly "broken" (for instance, they crash your browser or suck up all your CPU power) either get fixed quickly or simply vanish.

But some extensions are "bad" in unapparent ways, or just don't provide enough benefits to be worth running. So, in no particular order, let's look at 10 to avoid.

Read the article HERE.

Weekend Reading

Who's behind the criminal botnet networks ?

They have infected perhaps 100 million computers with viruses, turning the PCs around the world into an army of willing criminal assistants known as “bots.” They are using those PCs to send out billions of spam e-mails and make millions of dollars by attacking Web sites and extorting their owners. They have even attacked the core computers that keep the Internet running smoothly. Who are they?

Take a look HERE.
==================================================================
Windows XP OS is really quite a crock

It's amazing that Microsoft built-in a disk defragger into Windows XP, but it didn't get around to building an operating system defragger.

After a while, XP starts to get slow as programs accumulate and finally you're left wondering why it takes a couple of minutes to boot up, with other times watching the hard disk start thrashing around as it swaps between processes.

Take a look HERE.

==================================================================
Harvesting Teenagers

Tagged is one in a flood of new social networking sites targeting teenagers. They're all MySpace wannabees, and perhaps some of them are harmless, but I'm going to focus on Tagged. It first got my attention several weeks ago when I got about six e-mails in rapid succession from her. They were obviously auto-generated invites to join a site and said :

Take a look HERE.

==================================================================
Is the 'Web OS' just a geek's dream?

A decade-old concept of moving a desktop computer's everyday tasks onto the Web is gaining steam. The idea of treating the Web like an operating system--and loosening dependence on Windows desktop applications--dates back to the Netscape browser's debut in the mid-1990s.

Take a look HERE.

==================================================================
Better, More Accurate Image Search

By modifying a common type of machine-learning technique, researchers have found a better way to identify pictures. Researchers at the University of California, San Diego (UCSD), have developed a new image-search method that they claim outperforms existing approaches "by a significant margin" in terms of accuracy and efficiency.

Take a look HERE.

==================================================================
Why Microsoft is under assault

Why is it that very few large IT players are immune from antitrust attack? Are they simply unable to comport themselves with the law? Or is this regulatory trend indicative of governmental lack of faith in the very engine that has created sustained economic growth and innovation in the IT sector: the free market?

Take a look HERE.

==================================================================
Underground Hacking in Australia

This subject is both near and dear to my heart. I just finished reading this online book about the Hacking community in Australia and around the world. It mostly covers Australia but also America and England.

Take a look HERE.

==================================================================
Critical WiFi Bug Found on Linux

A researcher from France Telecom has discovered the first remotely exploitable 802.11 WiFi bug on a Linux machine. The kernel stack-overflow bug, which is in the open-source MadWiFi Linux kernel device driver, lets an attacker run their malicious code remotely on an infected machine -- and the infected machine doesn't even have to be on a WiFi network to get "owned."

Take a look HERE.

==================================================================
The future of high end PC cooling revealed

Many younger readers might not be aware that, once upon a time, there was such a great, environment-friendly age when even the fastest PC CPUs didn't have any fans. Not even heat sinks even when running full blast. Well, that golden or rather green age ended with Intel's 486DX2.

Take a look HERE.

==================================================================
The Myth of Apple's Insecurities

If an OS is built on shaky ground, everything layered on top will suffer. This is the position that Microsoft is in now. Apple was in this very position at the end of the last century. They decided to start over, providing a clear upgrade path and supporting legacy applications on the new platform.

Take a look HERE.

Microsoft Investigates DNS Attacks

Microsoft is investigating attacks exploiting a vulnerability in the Windows Server Domain Name System Service, as well as two types of hacks targeting Vista's OEM BIOS activation feature.
A company spokesperson said a very limited number of attacks exploiting the flaw in the Windows Server DNS Service have been seen in the wild.

Read the article at eWeek HERE.

‘Storm Worm’ surge exposes AV deficiencies

The crime ring behind the latest Storm Worm-related malware attack (Techmeme discussion) is using new tactics to slip malicious executables past anti-virus defenses, serving up another black eye to an industry that already uses questionable tactics to find new customers.

Read the article HERE.

Word 2007 crashes not bug - they are a feature

The Word 2007 bugs pegged as security vulnerabilities by an Israeli researcher are nothing of the sort, Microsoft Corp. said today. Instead, the application crashes reported as flaws are actually by design. The researcher who posted details earlier this week of the bugs reacted by offering screenshots of the Word crashes and wondering why Microsoft disputed his findings.

Read the article HERE.

Bug hunters face online-apps dilemma

Security holes in online applications may go unfixed because well-intended hackers are afraid to report bugs. Web applications pose a dilemma for bug hunters: how to test the security without going to jail? If hackers probe traditional software such as Windows or Word, they can do so on their own PCs. That isn't true for Web applications, which run on servers operated by others. Testing the security there is likely illegal and could lead to prosecution.

Read the article HERE.

Forensic Felons: Next Generation of Cyber Thieves

For years, retailers have been told that if they merely abide by common sense security procedures—don't permit obvious passwords, check audit logs regularly and patch software immediately—they'd be in good security shape.

Although there is no doubt that is still sound counsel, security consultants are describing a new breed of professional cyber thieves out there, crooks who know as much about sophisticated forensic investigations as the good guys do.

Read the article HERE.

Vista Forensics - Part Two

In part one of this series we looked at the different editions of Vista available and discussed the various encryption and backup features which might be of interest to forensic examiners. In this article we will look at the user and system features of Vista which may (or may not) present new challenges for investigators and discuss the use of Vista itself as a platform for forensic analysis.

Read the article HERE.

Word 2007 Not Bitten by Bugs

Microsoft says a preliminary investigation into reports of vulnerabilities in its Office 2007 suite has produced no evidence of a threat to users.

Reports of new security holes in MS Office have been made public on known exploit sites, including information about four bugs posted on one site. Microsoft has not released specific information about the vulnerabilities, citing potential risk to users.

Our investigation into the possible impact of these claims on other versions of Microsoft Office is continuing.

Read the article HERE.

Opera releases 9.2 browser

Opera has released the latest update to its free desktop web browser, version 9.2. The new version adds a number of new features, but the most interesting one is what Opera calls "Speed Dial."

Read the article HERE.

Man In The Middle Attack

We present this demonstration of a "deceit-augmented man in the middle attack" against the SiteKey ® service used by Bank of America (the underlying technology is also used by other companies). This, or a similar attack, could be used by a phisher to deceive users into entering their login details to a fraudulent website.

We are putting this demonstration online to help warn the public of this risk. Just because you see your Sitekey/Passmark image, or Yahoo personalized sign-in seal, you should still be careful. Those security schemes, alone, are not enough to protect your security online.

Read the article HERE.

The Vista Backups That You Can't Have

In Vista Home Basic and Vista Home Premium, Microsoft left out the feature called Previous Versions. It saves older versions of documents and files, so for example you can rescue yesterday's copy of a budget spreadsheet if you clobbered and saved it today. In Vista Business, Enterprise, or Ultimate, you access Previous Versions by right-clicking on a file or folder and selecting Properties. If any backups are available, one of the tabs shown will be Previous Versions and you can retrieve those older versions.

Read the article HERE.

==============================================
Review: Top four external drives

We put four of the leading external hard drives to the test. Our criteria were simple: The drives had to have multiple connection technologies (USB 2.0 plus FireWire 400 or FireWire 800 or both), include backup software and have a capacity of at least 500GB. We ran four performance tests using four different PCs running Windows XP SP2.

The story reveals some big flaws in the external drives, like malfunctioning one-touch backup buttons, USB 2.0 ports that don't recognize the drives, and drives coming out of the boxes unformatted.

Read the article HERE.

Windows XP execution date set

Computer makers have been told they'll no longer be able to get Windows XP OEM by the end of this year, despite consumer resistance to Vista and its compatibility problems.

Read the article HERE.

Magical Jelly Bean Keyfinder v2.0 Beta 2

The Magical Jelly Bean Keyfinder is a freeware utility that retrieves your Product Key (cd key) used to install windows from your registry. It has the options to copy the key to clipboard, save it to a text file, or print it for safekeeping. It works on Windows 95, 98, ME, 2000, XP, Server 2003, Windows Vista, Office XP, Office 2003, and Office 2007.

Visit the website HERE.

Reported Vista BIOS Hack

Microsoft has no immediate plans to tackle a reported hack to Windows Vista product activation that could allow illegal copies of Windows to be widely installed.

Alex Kochis, a Microsoft senior product manager, blogged: "Because Windows Vista can't be pirated as easily as Windows XP, it's possible that the increased pressure will result in more interest in efforts to hack the OEM Activation 2.0 implementation."

Read the article HERE.

The Myth of the Superuser

Professor Paul Ohm [University of Colorado Law School], is a specialist in computer criminal law, criminal procedure, intellectual property and information privacy. He describes the excessive paranoia about the Superhacker [described as a Superuser in this article], who steals identities and creates chaos with viruses.

Read the article HERE.

My RFID has a virus

Spyware - malicious programs that covertly track surfing habits or steal confidential data - are likely to migrate onto new platforms, including mobile phones and RFID chips. The scenario is sketched out in the second issue of McAfee's twice annual Global Threat Report.

Read the article HERE.

Interview with an anonymous hacker

We live next door to hackers and we know their habits well. So we did some research amongst the local hackers’ community and managed to set up an interview with a former cyber gangster, who claims to have now joined the “white hats” and was prepared to share his experience anonymously.

Read the article HERE.

XP Analysis Diagnostic Tool

If you want to track changes made to certain parts of the operating system, you can download the Change Analysis Diagnostic Tool, which scans the computer and displays recent changes to software programs, hotfixes and downloads from Windows Update, Browser Helper Objects, drivers, ActiveX controls and changes to loaded applications and startup objects.

More information and a download link HERE.

Office zero-day bugs spoil Patch Tuesday

A trio of what appear to be new, yet-to-be-patched flaws in Microsoft Office has surfaced, according to security researchers at McAfee. The vulnerabilities were reported in online security forums on Monday, according to a posting on the McAfee Avert Labs blog on Tuesday. All but one of the flaws results in denial of service, meaning the application would crash, according to the blog post.

Read the article HERE.

Georgia - it's your turn

A CD containing personal information on Georgia residents has gone missing, according to the Georgia Department of Community The CD was lost by Affiliated Computer Services, a Dallas company handling claims for the health care programs, the statement said. The disc holds information on 2.9 million Georgia residents, said Lisa Marie Shekell, a Department of Community Health representative.

Read the article HERE.

Patch Tuesday Lineup

Eric Schultze, chief security architect for Minneapolis based patch management company Shavlik Technologies, said the vulnerability that affects Vista is due to computer code carried over from Windows NT 4.0, a legacy version of Windows that predates even Windows 98.

"Microsoft has patched this particular component multiple times before," Schultze said. Given that Microsoft did not have time to do a wholesale re-write of Windows with Vista, "we're bound to see 10-15 more of these legacy vulnerabilities in Vista in this year alone," he said.

Read the article HERE.

Weakness in Anti-Phishing Technology

Security experts have warned for some time now that certain anti-online-fraud technology deployed by many major financial institutions may be lulling online banking users into a false sense of protection. Today, two university researchers released a demo in an attempt to prove that point.

Read the article HERE.

F-Secure calls for safer online banking

If ICANN introduced a .safe domain (or .sure or .bank), which could only be used by registered financial institutions, it would allow security providers to create better software to protect the public, according to F-Secure.

Read the article HERE.

Responsible disclosure - the Microsoft way

A few weeks ago, I wrote about a Windows kernel vulnerability that was reported to Microsoft on October 22, 2004 and remained unpatched for more than two years.

This is a bug I’ve been following closely since last November when Cesar Cerrudo, the hacker who found it, got tired of waiting for a fix from Microsoft and published details during the MoKB (Month of Kernel Bugs) project.

Read the article HERE.

Two worm "families" make up most botnets

The Sdbot and Gaobot families are responsible for most botnets worldwide. These two families were responsible for 80 percent of detections related to bots during the first quarter of 2007. Other culprits, although on a much lesser scale, included Oscarbot, IRCbot or RXbot.

Read the article HERE.

A Double Espresso and Your Password

One of the perennial questions I get from readers is whether it is safe to log into personal e-mail accounts at the local coffeehouse or even via a neighbor's wireless network.

My answer remains the same: If you do not control the network, it is difficult to be sure that no one is eavesdropping on your Web surfing or e-mail reading.

Read the article HERE.

Laptop thefts expose 40,000

A thief walked into the headquarters of Chicage Public Schools (CPS) on Friday, April 6 and grabbed two laptops containing the names and social security numbers of 40,000 teachers. The CPS has released an image of the suspect captured by CCTV and is offering a $10,000 reward for information leading to the arrest of the thief or recovery of the data.

The laptops belonged to an accountancy firm and its subcontractor, who were auditing pension contributions made by teachers between 2003 and 2006. The data does not include date of birth or addresses, which is something, we suppose.

In a press statement today, the CPS apologized for this "breach of security, and we are working around the clock to get the information back in safe hands as quickly as possible". It is offering to pay for one year of credit protection for any employee or former employee affected by the theft.

Source : The Register

Hackers Using Middle East Fears

A new spam campaign is trying to trick people into opening malicious attachments by using subject lines about the United States, Israel, and Iran starting a new war in the Middle East.

Read the article HERE.

Thunderbird 2 RC1 released

Mozilla has released their email client, Thunderbird, Released candidate 1 with many new features :

Read the release notes HERE.

Malware Exploits Microsoft “Feature”

Most of the malicious code we see on an hourly basis is obfuscated in one way or another. PE (portable executable format) files are packed (compressed and/or encrypted), scripts are encoded and/or encrypted, etc. Obfuscation is one of the biggest challenges for content scanners today, both on the host and on the wire.

Read the article HERE.

Can you spot a scam ???

ASIC has launched a fake April Fools investment website to remind people how easy it is to be scammed. The ElectroHarvest website mirrors the tactics of stock market con artists, touting an investment opportunity offering ‘exceptional risk-free returns', with fake testimonials and biographies of people who don’t exist.

See whether you'd be tempted: HERE

Find out more about how we created the "fake scam"

The website, called FIDO, brings you investment and consumer tips about financial products and services from the Australian Securities & Investments Commission.

Virus Top Twenty for March 2007

The virus world remains in a state of flux. In the first three months of 2007, we’ve seen three different malicious programs topping the ratings. Each month there are more and more new malicious programs, wave following on wave, and taking up their places in our Top Twenties. What’s more, it’s clear that many of these programs are competing with each other for supremacy.

Read the article HERE.

Blink Personal Edition

eEye Digital Security is offering Blink Personal Internet security with Antivirus for free as a 1-year subscription for personal and home office use in North America.

Visit the website HERE.

The rest of us will have to make do with Comodo.

Web Attack

Nastiness online can erupt and go global overnight, and "no comment" doesn't cut it anymore. Here's how to cope.

Read the article HERE.

Google News

Yahoo takes on Google with new search interface

Yahoo! is currently beta testing a new search engine interface that it calls Alpha, which promises to bring advanced customization features to Internet searching. Version 1.0 of the product is scheduled for a public release soon, which will remove the amusing "Alpha (beta)" moniker from the site's main page.

Read the article HERE.

==============================================
Google Maps

In an effort to add more social sharing to Google Maps, Google announced today the availability of My Maps, an extension of its web-based mapping tool. My Maps allows any user to create a personalized map—tied to his or her Gmail login—that can contain a variety of information, such as a path mapped out of a walk around a city or a road trip across the country, a photo montage of a trip, text describing what happened at particular locations, or even embedded video of various landmarks.

Read the article HERE.

==============================================
MacGoogle

Google has released its Google Desktop utility for Mac OS X users. The utility is easily reachable by a simple keyboard shortcut (press command and command), and it brings full integration with Google.com, indexing Gmail and web-history, finds content in past file revisions and deleted items, but also has some new features. The app will handle multiple users and is able to support FileVault.

Read the article HERE.

ShmooCon 3

ShmooCon 3 is over.

If you missed something, see the list of videos HERE.

OS X Portable Applications

There is no shortage of portable [USB] apps for Windows users.
What about Mac users?

Take a look HERE.

Weekend Reading

Virus Gang Warfare Spills Onto The Net

There might be a gang fight raging in your bedroom or study right now. There's no gunfire, no blood, and you won’t smell any smoke. But there is a battle. The fight is over your bandwidth and your PC processing power.

The bot network industry has become so profitable, and hijacked computers so valuable, that rival gangs are now fighting over them. This digital gang warfare is not physically violent, but it certainly is no game. Bot herders steal each other's infected computers, fight off such raids, and often try to knock each other’s computers off-line. They are cutthroat and competitive. They are in it to make a lot of money.... These guys are ruthless to begin with and don’t care who they hurt, as long as they get their dollars.

Take a look HERE.

==================================================================
Week of Vista bugs is a hoax

Month (or weeks/days/...) of bugs: We try to give them as little publicity as possible in order to discourage the behavior and encourage a bit more responsibility than to disclose vulnerability details in a blog.

Now with April 1st just behind us we were ready for a good laugh with people falling for a hoax or two, but once it's April 2nd, you expect people to resume normal behavior.

Take a look HERE.

==================================================================
Free Web hosters profit from phishing sites

Here's a tell-all tale about how free Web hosting providers profit handsomely from phishing sites - even those they eventually shut down - and why this one hoster, in particular, has all but weaned himself off the juice.

Take a look HERE.

==================================================================
Malware & Attacker - Exposed

Smart attackers are always looking for ways to disguise their malware so it can do its dirty work undetected, and JavaScript is becoming a popular tool for slipping malware into the browser.

This increasingly popular form of malware obfuscation can be frustrating to the naked eye. But researcher Jose Nazario, senior software and security engineer for Arbor Networks, says the good news is: For every JavaScript-endcoded payload there's a corresponding decoder to unravel it. Nazario will discuss his research on reverse-engineering JavaScript later this month at the CanSecWest conference.

Take a look HERE.

==================================================================
Web 2.0 Inherently Insecure?

When I first heard a number of claims that AJAX applications were inherently more insecure than standard web applications, I thought that was ridiculous. After all, as long as you don't do anything stupid like do validation of user input only on the client, what would you have to worry about?

Take a look HERE.

IRS lost 490 laptops

Every large organization loses laptops, but when those laptops contain the personal tax information of millions of Americans, it's a big deal. Big enough that the Treasury Department's Inspector General for Tax Administration looked into the problem, and released a report on the Internal Revenue Service's penchant for losing machines filled with unencrypted tax data.

Read the article HERE.

Tony Soprano's laptop

Our columnist explores options for keeping a connected guy connected. So how would you build a computer for the boss? Obfuscation -- just hiding things through complexity -- won't work, because interested parties have a lot of time when it comes to a high-value target like Tony. Obvious encryption probably won’t work either, because knowing that passwords and keys exist is half the fight, after which one can debate the finer points of brute force versus rubber hose methods of deriving them. It's just as important to keep things simple as it is to use the right tools for the job.

Read the article HERE.

Windows .ANI Problem Two Years Old

The Windows .ANI bug that has plagued users for the past week is nearly the exact same problem Microsoft had to patch two years ago, security experts say.

Security researchers say the Windows .ANI bug that has been plaguing users for the past week first surfaced -- and was patched -- in early 2005. Microsoft, however, says the .ANI vulnerability found this year is different from the one found years ago. But some security experts say it's the same mistake in the same process, and they're questioning how Microsoft could have missed it.

Read the article HERE.

Spreadsheet security? What spreadsheet security!

I have written before, and will say again, that Microsoft Excel does not have security. It does actually have some security features but most users don't know about them and, if they do, they are frequently not implemented.

In any case, as Microsoft has explicitly stated, the security features in Excel are not actually there to provide security but to make life simpler for users. For example, you can hide worksheets from users so as not to confuse them and you can apply what locking is available for the same reason: so that users just focus on what they need to do and not on other stuff.

Read the article HERE.

Yahoo Patches IM Vulnerability

Yahoo has patched a buffer overflow vulnerability in its instant-messaging tool that would have enabled attackers to potentially execute code on a compromised machine.

The flaw exists in an ActiveX control that is part of the Yahoo Messenger audio conference control. If exploited, a buffer overflow could cause a user to be involuntarily logged out of a chat or instant messaging session, the crash of an application such as Internet Explorer or the execution of code.

Read the article HERE.

Kaspersky Products Multiple Vulnerabilities

Highly critical : Some vulnerabilities have been reported in various Kaspersky products, which can be exploited by malicious, local users to gain escalated privileges and by malicious people to gain knowledge of sensitive information, cause a DoS (Denial of Service), and potentially compromise a user's system.

Read the Secunia advisory HERE.