USA court banned keylogger spyware sales

18 November 2008  |  Details

A U.S. District Court has temporarily halted the sale of RemoteSpy keylogger spyware at the request of the Federal Trade Commission, which claims the software violates the FTC Act. The FTC filed a complaint (PDF) against Florida-based CyberSpy Software on November 5, alleging the company has violated the FTC Act by selling software that can be deployed remotely by someone other than the owner or authorized user of a computer, can be installed without the owner's knowledge, and can used to surreptitiously collect and disclose personal information.

UK tells about vulnerabilities in SSH specification

18 November 2008  |  Details

According to the UK-based Centre for the Protection of National Infrastructure (CPNI), an error in the secure shell protocol (SSH) specification can in rare cases be exploited to reconstruct part of the plain text. According to their description of the error, the standard OpenSSH configuration allows 32 bits of plain text to be recovered from arbitrary points within the cipher text.

Microsoft sees value in exploitability index

18 November 2008  |  Details

Microsoft announced its exploitability index at the Black Hat Briefings security conference in Las Vegas in August. It announced early results last week of its attempt to focus customers on the most pernicious vulnerabilities through its exploitability index, a three-grade measure of the likelihood of a vulnerability being exploited.

DDoS attacks treats

17 November 2008  |  Details

Internet service providers now spend most of their IT security resources detecting and mitigating distributed denial-of-service attacks, concludes a report from Arbor Networks. The fourth edition of the Worldwide Infrastructure Security Report, released Tuesday, was based on how 70 lead security engineers responded to 90 questions. As in the previous three reports, ISPs reported attacks where their networks were overloaded with packets, what's called a distributed denial-of-service (DDoS) attack.

Sysadmin faces court for hacking and drug dealing

14 November 2008  |  Details

A former sysadmin faces six-to-12 years behind bars after admitting using his IT skills to conduct a series of burglaries, computer intrusions, and identity thefts in San Jose, California.

FBI searching for blackmailers

14 November 2008  |  Details

Drug-benefits provider Express Scripts announced on Tuesday that it had established a large fund to reward people who provide information leading to the capture and prosecution of the online attackers that stole sensitive data from its servers and then attempted to extort money from the company and its customers.

Microsoft patches on Tuesday

13 November 2008  |  Details

Microsoft published two patches on Tuesday to fix four flaws in its Windows operating system, closing holes in the core library that handles extensible markup language (XML) and in the code that handles internal-network data. Eric Schultze, chief technology officer of Shavlik Technologies, said the SMB vulnerability was more interesting and, in fact, had been discovered nearly seven years ago.

What sould we expect from testing groups

12 November 2008  |  Details

A coalition of security-software companies, testing firms and information-technology publications issued on Monday two documents setting out guidelines for testing antivirus scanners and malware defenses.

New Massive Wave of Web Hacks

11 November 2008  |  Details

Security vendor Kaspersky Labs warns that between 2,000 and 10,000 American and Western European web pages have been hacked in a two-day interval. The cybercriminals responsible for the attack have not been identified yet, but the details of the incident are highly similar to an attack that took place last spring and eventually resulted in over 1.5 million pages being compromised.

Something on wireless network insecurity

9 November 2008  |  Details

Wireless networks that use a popular form of security known as Wi-Fi Protected Access (WPA) are vulnerable to an attack that could compromise certain communications in less than 15 minutes, two researchers plan to tell attendees next week at the PacSec 2008 conference in Tokyo.