News Security

Microsoft Changes Windows 7 UAC

Microsoft has agreed that Windows 7 will generate a prompt if there is an attempt to change the user account control settings – in response to pressure from bloggers who claimed the planned OS was vulnerable.

Where Does Malware Come From?

Anti-virus vendors are getting more than 50,000 submissions of new malware per day now. How can the malware business be so productive? It turns out the numbers aren’t really as big as all that.

Google Privacy Exec Facing Criminal Charges

Italian officials charge Google Global Privacy Counsel Peter Fleischer with criminal charges of defamation and failure to exercise control over personal data two years after Google posted a video depicting fellow students harassing a student with Down syndrome. Unlike Italian Internet service providers, who are not responsible for posted content, content providers like Google can be held liable for delivered materials. According to the International Association of Privacy Professionals, the charges are thought to be the first criminal sanction ever pursued against a privacy professional for his company’s actions.

New ‘Hacktivism’ Highlights Growing Problem

We all saw what the concentrated efforts of a group of politically minded hackers could accomplish in 2007 when Russian attackers took a wide swath of Estonian Web sites offline in response to perceived affronts against the Russian national image by its smaller neighbour.

Google Search Engine Sends False Security Warnings

A human error caused Google users to received bogus security warning messages for many of the searches the performed for nearly an hour the morning of the 31st January. During that period users received erroneous warnings that their search results were directing them to web sites that “may harm your computer.”

From IE 8 to Google Chrome, Keep an Eye on Clickjacking

First Microsoft touts clickjacking protections in Internet Explorer 8, then a security researcher releases a proof of concept for a clickjacking attack targeting the Google Chrome Web browser. Clickjacking, some say, remains an issue that will require cooperation in the security community.

Retailer Wireless Devices Largely Unprotected

A new survey shows 44 percent of the wireless devices used by retailers are vulnerable to attacks by data thieves. And that’s the good news. A year ago, the same Motorola survey showed 85 percent of retailers were sitting targets for drive-by data attacks. New PCI standards phasing out Wireless Equivalent Protocol–the weakest form of encryption this side of no encryption at all–may hold the key to improved retailer wireless security.

Websense Buys Spam Protection for Social Web Sites

Websense has acquired Defensio, a spam filtering service designed to protect blogs, social networks and other Web 2.0 sites. According to Websense, the move is in response to the growing amount of spam and malicious content on social Web sites.

Microsoft Goes After Clickjacking in IE8

Microsoft has introduced a release client version of its latest browser, Internet Explorer 8 (IE8), and the new iteration of the application includes several security improvements, including a noteworthy attempt to address the emerging problem of clickjacking attacks.

Conficker USB Worm Spreading Quickly

Security researchers are reporting that the Conficker worm virus, which preys on a recently reported vulnerability (MS08-067) in the Microsoft Windows server service, is spreading rapidly even as we speak.

Apple Plugs Security Holes in QuickTime

Apple updates QuickTime, fixing a number of remote code execution flaws. One security researcher expects malware writers to launch exploits via drive-by attacks.

Firefox Plug-in Lets Users Import Google Notebook to Zoho

Messaging and collaboration SAAS company Zoho updates its Firefox plug-in for Zoho Notebook to make it easy to import a Google Notebook to Zoho’s cloud computing environment. The move is a shrewd one on the part of Zoho, which is looking to find favor with peeved Google users put off by Google Notebook’s newly halted application development. Any content added to the new Zoho plug-in will be automatically synchronized with the online version of Zoho Notebook.

Whois Abuse Still Out of Control

It’s still easy to try to steal an identity with false whois information. There are rules against it and ICANN pretends to enforce them, but I personally know that it doesn’t really happen.

Millions Hit with Windows Worm as Infection Spreads

A new variant of a worm that exploits a vulnerability patched by Microsoft in October has infected millions of users, security researchers say. According to experts, the Conficker worm is using multiple mechanisms to spread.

ContentWatch Security Appliance Offers Filtering, Anti-malware

ContentWatch’s CP 300 security appliance offers very good content filtering, traffic shaping and anti-malware capabilities, as well as excellent reporting. It also integrates with directory services such as LDAP to let businesses enforce Internet usage policy per person.

Testing Microsoft’s Windows Application Whitelisting Tool

The SRP feature in Microsoft Windows doesn’t offer the same granularity of control or change management capabilities as whitelisting options from third-party suppliers, but there also are no extra licensing costs and it works well with Windows clients and servers.

How to Protect Data During a Virtual Migration

Server virtualization has become a popular trend in enterprise IT. When migrating from a physical to a virtual environment, IT professionals need to ensure that their company’s data is protected, current and readily available.

SSL Crack Shows You Must Advance Your Security

The successful creation of a rogue certificate authority by security researchers using a colliding certificates attack demonstrates that if you’re not moving forward with your security-related standards then you’re moving backward. Everything gets cracked over time, so you have to keep improving your defenses.

Vendors Tie Database Monitoring, Security Event Management

Security vendors such as Imperva and Guardium are increasingly tying security information management to database activity monitoring. The latest example of this trend is NitroSecurity, which has integrated its NitroView DBM and NitroView ESM products.

#TrustOpen Red Hat