Attackers Hit New Adobe Reader, Acrobat Flaw
Malicious hackers are targeting a previously unknown security hole in Adobe Reader and Acrobat to compromise Microsoft Windows machines, Adobe warned today.
Category Archives: Latest Warnings
Download.com Bundling Toolbars, Trojans?
It wasn’t long ago that I felt comfortable recommending CNET’s download.com as a reputable and trustworthy place to download software. I’m going to have to take back that advice: Unfortunately, CNET now is bundling invasive and annoying toolbars with much of the software on its site, even some open-source software whose distribution license prohibits such activity.
I first became aware of this after reading mailing list posting by Gordon “Fyodor” Lyon, the software developer behind the ever useful Nmap network security scanner. Lyon is upset because download.com, which has long hosted his free software for download, recently began distributing Nmap and many other titles with a “download installer,” that bundles titles with browser toolbars like the Babylon toolbar.
Public Java Exploit Amps Up Threat Level
An exploit for a recently disclosed Java vulnerability that was previously only available for purchase in the criminal underground has now been rolled into the open source Metasploit exploit framework. Metasploit researchers say the Java attack tool has been tested… Read More »
DDoS Attacks Spell ‘Gameover’ for Banks, Victims in Cyber Heists
The FBI is warning that computer crooks have begun launching debilitating cyber attacks against banks and their customers as part of a smoke screen to detract attention away from simultaneous high-dollar cyber heists.
The bureau says the attacks coincide with corporate account takeovers perpetrated by thieves who are using a modified version of the ZeuS Trojan that’s being called “Gameover.” The thefts come after a series of heavy spam campaigns aimed at deploying the malware, which arrives disguised as an email from the National Automated Clearing House Association (NACHA), a not-for-profit group that develops operating rules for organizations that handle electronic payments. The ZeuS variant steals passwords and gives attackers direct access to the victim’s PC and network.
New Java Attack Rolled Into Exploit Kits
A new exploit that takes advantage of a recently-patched critical security flaw in Java is making the rounds in the criminal underground. The exploit, which appears to works against all but the latest versions of Java, is being slowly folded into automated attack tools.
Apple Took 3+ Years to Fix FinFisher Trojan Hole
The Wall Street Journal this week ran an excellent series on government surveillance tools in the digital age. One story looked at FinFisher, a remote spying Trojan that was marketed to the governments of Egypt, Germany and other nations to permit surreptitious surveillance for law enforcement officials. The piece noted that FinFisher’s creators advertised the ability to deploy the Trojan disguised as an update for Apple’s iTunes media player, and that Apple last month fixed the vulnerability that the Trojan leveraged.
But the WSJ series and other media coverage of the story have overlooked one small but crucial detail: A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet the company waited more than 1,200 days to fix the flaw.
Cyber Intrusion Blamed for Hardware Failure at Water Utility
A recent cyber attack on a city water utility in Illinois may have destroyed a pump and appears to be part of a larger intrusion at a U.S. software provider, new information suggests. The incident is the latest to raise… Read More »
Critical Flash Update Plugs 12 Security Holes
Adobe has issued a critical software update for its Flash Player software that fixes at least a dozen security vulnerabilities in the widely-used program. Updates are available for Windows, Mac, Linux, Solaris and Android versions of Flash and Adobe Air.
Adobe, Apple, Microsoft & Mozilla Issue Critical Patches
Adobe, Apple, Microsoft and Mozilla all released updates on Tuesday to fix critical security flaws in their products. Adobe issued a patch that corrects four vulnerabilities in Shockwave Player, while Redmond pushed out updates to address four Windows flaws. Apple slipped out an update for its version of Java that mends at least 17 security holes, and Mozilla issued yet another major Firefox release, Firefox 8.
Microsoft Issues Stopgap Fix for ‘Duqu’ Flaw
Microsoft has released an advisory and a stopgap fix for the zero-day vulnerability exploited by the “Duqu” Trojan, a highly targeted malware strain that some security experts say could be the most important cyber espionage threat since Stuxnet. According to… Read More »
