vulnerability iss internet security Information and Resources

Apple's iPhone vulnerable to hackers: report
The iPhone may be vulnerable to hackers due to a flaw that allows them to take control of the device.

Feds scramble to meet data breach deadline
Deadline for federal agencies' policies for dealing with data breaches approaches and it's not yet clear whether everyone will be done in time.

FBI remotely installs spyware to trace bomb threat
The FBI used a novel type of remotely installed spyware last month to investigate who was e-mailing bomb threats to a high school near Olympia, Wash.

Hackers steal government, corporate data
Phony job listings on ads and in e-mail are sent in limited numbers to avoid detection; targeted employees are tricked into responding.

Security firms on police spyware, in their own words
Will companies that make antispyware software detect key loggers implanted by federal agents? We survey 13 companies and include their answers verbatim.

Will security firms detect police spyware?
A recent court case dealing with key loggers installed by the feds invites the question: will security companies put the interests of their customers first?
Security firms on police spyware, in their own words

Sun says Java flaw has been patched
A Java security threat, the subject of an earlier Australian report, has been addressed and fixed, Sun Microsystems says.

Interpol chief wants databases to track criminals
Interpol's secretary general tells CNET News.com that his agency should be a central hub for tracking international travelers and compiling fingerprints from criminal suspects.

U.K. commissioner blames CEOs for data breaches
"How can laptops holding details of customer accounts be used away from the office without strong encryption?" Richard Thomas scolds.

Don't be so quick to click that Web page
If you thought e-mail threats were a pain, that's nothing. Trend Micro's Raimund Genes talks about the latest Net-borne danger to the computing world.

Zango, the FTC, MySpace and You Tube
This past Friday, the FTC announced a million dollar settlement with Zango, formerly named 180solutions, in a lawsuit charging Zango with unfair and deceptive business practices, among other things. See ZDNet story here with more details. FTC announcement here.  Case documents can be downloaded here.As usual Zango refuses to take responsibility for anything, again blaming [...]

Halloween sites tricking users with malware
Update October 27:  This morning I contacted the owner of the listed sites.  The sites were indeed hacked, and the owner has since removed the malicious code from the web pages. This is a nasty trick!  There are a few Halloween sites being used to distribute malware, right at the time when unsuspecting web users might be searching [...]

Scary malware tricks part 1
In keeping with the Halloween season, I'm starting a series on scary malware tricks, similar to last year's series on spyware tricks. Perhaps my personal focus has changed, but it seems to me spyware tricks are becoming far more devious and destructive.  Last year I was testing mostly adware, whereas this year I'm testing more [...]

Edelman on ‘Deceptive Door Openers’ and Ask toolbars
In a new article posted this morning, Ben Edelman continues his investigation of high-profile companies clogging users' computers with junk.  Today's target: InterActiveCorp's Ask.com, known for its widespread "smiley" toolbars.Last year I blogged about Ask's various toolbars and the trinkets Ask uses to get users to install them.  But Ben thinks there's a bigger problem here.  [...]

Is Zango stealing affiliate commissions from adult webmasters?
It seems that Zango, formerly known as 180solutions, the company we all love to hate, has royally ticked off a bunch of adult webmasters. Paperghost, aka Chris Boyd, has the story, complete with links to forums where the adult webmasters discuss Zango allegedly stealing affiliate commissions.  True?  I don't know, but considering some of Zango/180solutions' past questionable business practices, [...]

So what about user education on security?
CNET's Joris Evers writes about one security expert who says education users on computer security in the enterprise setting is "pointless".  Doctoral candidate Stefan Gorling, speaking at the Virus Bulletin Conference, said:"I don't believe user education will solve problems with security because security will always be a secondary goal for users," Gorling said. "In order [...]

Malware being spammed as PDF from retail stores
Reports surfaced today of spam purporting to be from Dell, Walmart, Circuit City or Sony confirming an order for a Sony Vaio computer with a PDF attachment, but the attachment is, in fact, a very nasty piece of malware named Haxdoor. Text of email:Subject: Order ID : 37679041Dear Customer,Thank you for ordering from our internet shop. If [...]

MVP awards, Messenger Plus! and adware — a good combination?
A controversy has been raging in certain circles the last few days over a MVP award, which has now been rescinded, to an adware pusher known as Patchou, Cyril Paciullo, the author of Messenger Plus!. There's a lot of nonsense going around and I'd like to clear some of that up.

Spyware pushers cash in big on zero day exploit
Nearly 50 malware threats being installed though the VML zero day exploit, including familiar names like Virtumonde, BookedSpace, webHancer, SurfSideKick, Qoologic (also known as Qoolaid), Zenotecnico, TagAsaurus, with some trojan downloaders and a backdoor thrown in the mix. Many of these use affiliate programs where the affiliate gets paid per install, so somewhere affiliates of these adware/spyware companies are making a killing off this zero day exploit, trashing computers with their crapware.