Google: Epic FAIL

"It looks like Google is marking all of its search results with the warning `This site may harm your computer.`

"If you click on a Google result link in spite of the warning, you get an interstitial page with an additional warning: `Warning - visiting this web site may harm your computer!`

"Clicking the warning itself will take you to this page, which explains that `This warning message appears with search results we've identified as sites that may install malicious software on your computer.`

"The server(s) that hosts that page seems to be getting hammered right now. No surprise. So is StopBadware.org, a site Google refers its users to for more information."

From CNET...

Hackers Target K-12 For Pr0n

"Porn hackers have outraged teachers and parents after creating several spoof primary school websites full of indecent images.

"Up to 20 schools may have been targeted by the scam, in which a security hole in a virtual learning service called Moodle was exploited.

"Hackers created bogus sites that could be inadvertently accessed by pupils who searched for their school websites while at home..."

From Sky News

H(1B) Bomb Defused at Fannie Mae

"A logic bomb allegedly planted by a former engineer at mortgage finance company Fannie Mae last fall would have decimated all 4,000 servers at the company, causing millions of dollars in damage and shutting down Fannie Mae for a least a week, prosecutors say.

"Unix engineer Rajendrasinh Babubha Makwana, 35, was indicted Tuesday in federal court in Maryland on a single count of computer sabotage for allegedly writing and planting the malicious code on Oct. 24, the day he was fired from his job. The malware had been set to detonate at 9:00 a.m. on Jan. 31, but was instead discovered by another engineer five days after it was planted, according to court records.

"Makwana, an Indian national, was an employee of technology consulting firm OmniTech, but he worked full time on-site at Fannie Mae's massive data center in Urbana, Maryland, for three years."

More at Wired...

IBM Swings The Big Blue Axe

"According to a recent article on the Associated Press, IBM is said to have cut thousands of jobs, without the company officially announcing any specific and official details. The layoffs are reported to be part of the company's ongoing plan to save costs amid the current low global economy.

"IBM is said to have cut approximately 4000 jobs (according to some reports) over the past week. The company's sales, software and hardware divisions are reported to have suffered from personnel reductions. The Armonk, N.Y-based company claims that the job cuts are just part of its ongoing efforts to monitor costs. However, it won't release any specific numbers, as it doesn't have to reveal the number of jobs it is cutting, according to the Securities and Exchange Commission regulations, which requires companies to disclose only “material” events. Even so, layoffs are reported at several of the company's locations, including Tucson, Ariz., San Jose, Calif., Rochester, Minn., Research Triangle Park, N.C., East Fishkill, N.Y., Austin, Texas, and Burlington, Vt..."

Source: Softpedia...

Bush Era Logic Bomb Takes Out White House Email Server

"It's more than five hours and counting now since the entire White House e-mail system went down.

"Press Secretary Robert Gibbs announced the technical snafu at his 1:30 p.m. briefing, apologizing to the media for the e-mail silence this afternoon.

"The result is maddening for the new White House team, which already has been frustrated with the archaic communications gear they discovered when they arrived at their offices.

"White House aides had just switched over from their transition e-mails this weekend, finally handing out their new, government e-mail addresses when the outage hit.

"Both outgoing and incoming mail are out, the result, an aide explained, of an outage with the Outlook server. The aide said the outage goes beyond the press shop. The first lady's office is also without e-mail, as are other offices."

From The Washington Post...

Peek-A-Boo Bot Snarfs Screenshots

"Bot masters are now watching their prey more intently.

"While malicious programs typically monitor what the victims does on their computer, a bot program, known as Ozdok, snaps screenshots of what's on its host's screen and sends it back to a server on the Internet, security firm SecureWorks stated in a research note last week...

"Ozdok has become the largest spambot, according to data recently released by MessageLabs. Spam has again risen to levels not seen since the takedown of Internet hosting provider McColo, which resulted in a massive drop in junk e-mail. The largest botnet, however, is likely the one created by the Downadup worm, which has infected 10 million computers, by some estimates. The United States and China lead the world in computers compromised by botnets, according to data previously released by SecureWorks."

From SecurityFocus...

Road Signs Possible Source of Lulz

"We see them everywhere these days, digital signs by the side of the road telling us about road conditions or that we should prepare to stop or that our local bridge might be closed next Tuesday from noon to midnight. And if you're like me, you've always just assumed that the message on the signs is legitimate and properly authorized.

"But what if the sign, instead of reading something like `Ice Ahead` was flashing the message, `Zombies Ahead`?

"It's true that in San Francisco or a few other cities, such a sign could be put up by local transportation officials to warn people of an impending zombie march, but even in those places, the more likely explanation would be that the sign was hacked.

"And if you're in the Boston area and saw signs hacked in this way, there's always a decent chance it was done by students from MIT..."

More at CNET...

CC Processor May Be Source of Bank Hacks

"Credit-card processor Heartland Payment Systems said today that global hackers penetrated its system and compromised data, but added that it has contained the threat.

"The Mercer County-based company provides credit, debit and prepaid card processing; payroll; check management; and payments services to more than 250,000 business locations nationwide.

"`We found evidence of an intrusion last week and immediately notified federal law enforcement officials, as well as the card brands,` said Robert H.B. Baldwin Jr., Heartland chief financial officer. `We understand that this incident may be the result of a widespread global cyberfraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice.`

"Heartland discovered the breach after Visa and MasterCard advised the company of suspicious activity surrounding processed credit card transactions...

"Heartland also set up a Web site, www.2008breach.com, to provide information about the incident."

From NJBIZ...

Hackers Hit KY Bank Debit Cards

"Thousands of Forcht Bank customers had their debit cards disabled, after hackers posed a threat to their accounts.

"Officials at the bank say they deactivate-activated 8,5000 of their customers' cards as a precaution after officials say a retail merchant's computer system was hacked into.

"Forcht bank officials say none of their customers reported having any fraudulent transactions with their accounts. But say they deactivate-activated their debit cards as a precautionary measures.

"... those customers will receive new debit cards between 7 to 10 days.

"The debit card processor, a company called STAR, says they are not quite sure which retail company it was that hackers hit."

From WKYT...

Seagate Drives: Epic FAIL

"A chronic firmware problem is triggering failures in Seagate's current-generation Barracuda 7200.11 hard drives, according to owners in the company's forums, NewEgg buyers and elsewhere. The disk series, particularly the 1TB model, reportedly suffers from a bug triggered on boot that incorrectly locks up the drive as a protective measure and prevents the system from recognizing the storage from then onwards. The problem appears tied to firmware from drives issued in Thailand but isn't exclusive to models from those factories.

"The issues are common enough that data recovery firms have reported significantly higher failure rates on 7200.11 drives than on other Seagate models or storage from other vendors."

From Electronista...

Freepers Targeted in Latest Malware Scam

"Sites claiming President-Elect Barack Obama will refuse to take the oath of office Tuesday are serving up attack code believed to be programmed by the same hackers responsible for the notorious Storm bot Trojan, researchers said this weekend.

"According to researchers at several security companies, including F-Secure Corp., MX Logic Inc. and Trend Micro Inc., spam campaigns are in gear that try to trick users into visiting malicious Web sites hosting variations of `Waledec,` the Trojan horse thought to be the successor to Storm."

More at ComputerWorld...

Worm Invades Windowsland

"More than a million Windows PCs have been infected in the past 24 hours by the computer worm that exploits a months-old Windows bug, a security company has warned.

"Finnish security firm F-Secure estimated on Wednesday that 3.5 million PCs have been compromised by the "Downadup" worm, an increase of more than 1.1 million since Tuesday."

More at TechWorld...

UT LIVES!

"Anybody who's played Epic MegaGames Unreal Tournament will recognise it as one of the best the software industry has been produced. Tie the stunning visuals in with a fairly simple plot line - blast your enemies or die - and it was easy to see why gamers liked it.

"The worlds created in the game itself are still stunning, even though the last version of Unreal Tournament saw the light of day in 2004, and gamers are champing at the bit waiting for the next version of Unreal to hit the shops.

"The recent news that Nortel has announced a deal to license Epic's Unreal computer engine to emblazon its online virtual e-commerce world - called web.alive - raises some interesting possibilities."

More at vnunet.com...

Paris Hilton Hacked

"Paris Hilton is again the victim of a malicious hack. This time, hackers aimed right for her Web site, Parishilton.com, infusing it with malicious code that lures visitors into unknowingly downloading malware onto their computers.

"Once a user visits the ParisHilton.com Web site, they are immediately prompted to `update` their system. When the pop up box appears, users have the option to click `Cancel` or `Ok.` In the end, either icon that they choose will trigger the download of an executable designed to steal personal and financial information on users' machines."

More at ChannelWeb...

The Register Ass-Rapes Twitter Hacker

"...The hero of our story, an anonymous leet haxor, figured out that you could use curl and a text file of words to launch a dictionary attack against a web login form. This technique is far less advanced than the methods of yore: finding improper usage of strcpy and the like, coming up with executable shellcode, and figuring out the function return address memory offset. Back in the day, that shit was hard, so good hacks were generally reserved for people who really knew what they were doing...

"What happened to the next iteration of hackers? I blame generational pussification - things like the everybody-is-a-winner attitude and Coldplay are making our children soft. As the Twitter invader proves, it doesn't take much to be a `hacker` these days. Great fuckin' job, Mitnick..."

More lulz at The Register...

Top Programmer Haxx EXPOSED!

"Most IT security woes, from software patching to cyberespionage and cybercrime, can be traced to the devastating effects wrought by the Top 25 programming errors made in software, according to a broad consensus of government and security firms.

"These programming errors include improper input validation, improper encoding or escaping of output, failure to preserve SQL query structure (SQL injection), and failure to preserve Web page structure (cross-site scripting). These are among the worst of the worst in the list of the Top 25, published Monday by MITRE Corp. and The SANS Institute, participants in what's called the Common Weakness Enumeration (CWE) project organized by the U.S. Department of Homeland Security's National Cybersecurity Division."

Big list of lulz at NetworkWorld...

PC Makers: Sux 2 B Us

"Shrinking demand has taken a heavy toll on pc makers globally. The outlook for 2009 seems gloomier as US companies prepare for further tightening of IT budget amid deepening recession.

"Recently, Acer, the world's third largest PC maker, warned that its sales will decline in the fourth quarter, after previously forecasting a robust holiday season. The company expects fourth quarter revenue to slip 5% to 10% compared to the same period a year ago, due to `overall market situation.` The company said that motherboard shipments in fourth quarter plunged 20%, much worse than its own estimate of 10%."

More doom, gloom at iStockAnalyst...

County Clerk Promotes Identity Theft

"Thousands of Oklahomans' Social Security numbers may be listed online for anyone to see and they don't even know it.

"Pottawatomie County posts home sale and mortgage information on its Web site, but some home owners said the county is getting too personal about open records.

"`What the public needs to realize is, for years, Social Security numbers have been used,` said Pottawatomie County Clerk Nancy Bryce.

"She said the numbers have been available on the Web site for years and she can't black out the numbers to protect residents from identity theft.

"`Once it's on file in my office, it is public information,` Bryce said.

"Some Pottawatomie County residents said they're concerned about the situation.

"`Everybody can get into it and the next thing you know, there goes your credit and your identity,` one resident [said].

"Legal experts said the exposed information could be used by anyone who knows how to get credit or cash advances over the Internet.

"Bryce said the records have been online for six years and no one has reported any problems.

"`I don't think that's going to happen,` she said.

"Bryce also said anyone looking to mine Social Security numbers can also go into her office and look at hard copies of the documents."

This unbelievable insanity comes to you from KOCO.com...

The Pot Calls The Kettle Black

Google Warns of Privacy Issues on the Social Web

"In a recent paper about social privacy Google researchers caution that the expansion of the social Web and our growing involvement with it is compromising our privacy while offering the false sense of security that we act in the privacy of our own social circle.

"Specifically, the paper suggests three areas where the social Web compromises user privacy.

"1. Lack of control over activity streams

"According to the paper, there are two primary ways in which lack of control over activity streams may compromise our privacy; the lack of control we have over events going into our activity streams (examples given are Facebook Beacon and coComment), and the lack of control we have when it comes to who can see our activity stream as is possible with Google Reader.

"2. Unwelcome linkage

"The authors define unwelcome linkage as occurring when links on the Internet reveal information about you that you had not intended to reveal, for instance trackbacks and accidental linkage.

"3. De-anonymization through merging of social graphs

"Given social networking sites extract a fair amount of personally identifiable information; the authors suggest it may be possible to uncover personal information by comparing data across social networking sites."

More at ReadWriteWeb...


Full PDF of the Google research here.

Trolls on FaceBook?

"Social networking Web sites have become a popular way to find old classmates, stay connected with friends, or make new friends.

"Unfortunately, hackers have learned how to use Web sites like Facebook to disseminate viruses or steal identities.

"The Better Business Bureau is offering advice on how consumers can protect themselves against hackers, scammers and ID thieves on these social networking sites.

"`Social networking is extremely popular because it allows us to connect and reconnect with people we know and trust,` said Kathleen Calligan, BBB president/CEO, in a news release.

"`Scammers know that they can take advantage of that trust by masquerading as friends, families and coworkers in order to easily disseminate viruses or steal personal information such as bank or credit card numbers,` Calligan said."

More at TheLeafChronical...

Canadian Hackers are Pussies

"Steve hesitates when a reporter asks him about the ins and outs of computer hacking.

"Like most 18-year-olds, Steve would know his way around a keyboard blindfolded, but that doesn't mean he's comfortable talking about it.

"Most of the teenagers he knows in Metro Moncton are aware of hacking and cracking codes in order to get information about others online, but none are doing it with any criminal intent.

"There was a 17-year-old boy in Massachusetts who hacked into several corporate computers and faced several charges of committing damaging activities.

"He stole information, took control of thousands of computers which resulted in hoax 911 calls, phony bomb threats and SWAT team responses and he also purchased goods using stolen credit card numbers.

"He wound up serving an 11-month sentence in a juvenile detention facility with no access to a computer.

"Steve shyly and reluctantly discussed the activities of Metro Moncton's teenager hackers and crackers and none of them were involved in such elaborate schemes.

"He wanted to make sure his real name was not used for this article."

More at CANADAEAST.COM...

IT Loser of the Week

"A former sys admin at Medco Health Solutions, a US prescription management and health information firm, has been jailed for 30 months over a failed attempt to destroy its systems using a `logic bomb` computer virus.

"Yung-Hsun Lin, 51, of Montville, New Jersey, was sentenced this week after earlier pleading guilty to booby-trapping systems at Medco.

"Yung-Hsun was also ordered to pay $81,200 in compensation to his former employer at a hearing before US District Judge Jose Linares, the New Jersey Star-Ledger adds.

"Yung-Hsun had feared he might lose his job after the firm's spin-off from Merck, and set the 'bomb' to go off after his expected departure."

More at The Register...

India Passes Cybercrime-Friendly Legislation

"In the last week of December, 2008, the Parliament of India has passed the amendments to the Information Technology Act 2000, which is popularly known as Indian cyberlaw. The IT Amendment Act 2008 brings about various sweeping changes in the existing Cyberlaw...

"The most bizarre and startling aspect of the new amendments is that these amendments seek to make the Indian Cyberlaw a cyber crime friendly legislation; — a legislation that goes extremely soft on cyber criminals, with a soft heart; a legislation that chooses to encourage cyber criminals by lessening the quantum of punishment accorded to them under the existing law; a legislation that chooses to give far more freedom to cyber criminals than the existing legislation envisages; a legislation which actually paves the way for cyber criminals to wipe out the electronic trails and electronic evidence by granting them bail as a matter of right; a legislation which makes a majority of cybercrimes stipulated under the IT Act as bailable offences; a legislation that is likely to pave way for India to become the potential cyber crime capital of the world."

From The Business-Standard...

FBI's Human Firewall: All FUD, No LULZ

"He's known as the `human firewall.`

"Massapequa native Shawn Henry is the head of investigating computer crimes for the FBI, and after he was introduced with that informal title, he talked Tuesday of the breadth of the computer-crime problem facing the country and the world at a conference in New York of many of the world's computer experts.

"Computer crime is `the most critical threat to our way of life other than weapons of mass destruction,` Henry, 46, a graduate of Hofstra University, said at the International Conference on Cyber Security, sponsored by the FBI and Fordham University."

Find out which of his ports are open at NewsDay...

Massive Cisco Router PWNAGE Looms

"A researcher has discovered a way to reliably exploit a known security vulnerability in a wide class of Cisco System routers, a finding that for the first time allows attackers to hijack millions of devices with a single piece of code.

"The discovery by Felix `FX` Lindner of Recurity Labs in Berlin brings the write-once-run-anywhere approach of software development to the dark art of compromising routers that form the core of the internet. Previously, reliable exploit code had to be specifically fashioned to one of more than 15,000 different supported builds of IOS, or Internet Operating System, which run various Cisco devices."

More at The Register...

Twits Hacked

"It's been a fun morning for Twitter. After a weekend phishing snafu, the micro-blogging site announced that the accounts of 33 of its more high-profile users had been hacked, including the now-quiet Twitter feed of President-Elect Barack Obama.

"`These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the email address associated with their Twitter account when they can't remember or get stuck,` according to a blog post.

"Those support tools have been taken offline, and will be returned `only when they're safe and secure,` Twitter said.

"Twitter denied that faster implementation of the open authentication protocol OAuth would have prevented the hacking...

"Other accounts that fell prey to the hackers reportedly belonged to Britney Spears, CNN anchor Rick Sanchez (who `tweeted` that he was high on crack), Facebook, Fox News, and the Huffington Post."

From AppScout...

New Malware Study Reaps 33G of Stolen Data

"A recent study of keyloggers and banking Trojans provides a view into the underground economy of stolen bank account credentials, passwords and credit card numbers.

"The study, published earlier this month by Thorsten Holz, Markus Engelberth and Felix Freiling at the University of Mannheim in Germany, analysed malware designed to steal sensitive information from infected machines. The researchers developed techniques for studying the "dropzones" -- servers that are used by attackers to store stolen information.

"Over a seven-month period, they were able to access more than 70 unique dropzones and found about 33GB of stolen data from more than 170,000 compromised machines. Among the stolen data, the researchers found more than 10,700 stolen online bank account credentials, about 149,000 stolen email passwords, and 5,600 full credit card details."

Read the full article at SearchSecurity...

Hot Security Buzzword: Space Faking

"THE growing trend of online `space faking`, where users masquerade as other people, has reignited concerns about the safety and security of social networking sites.

"While space faking is not a crime, federal Home Affairs Minister Bob Debus said such activity could be a precursor to identity theft.

"`This sort of activity can be innocent but you only have to take it a few steps forward to commit an identity crime,` he said.

"`Clever people may be able to use fake identities to gather clues about your identity and then go on to commit a crime.

"`All users have to be aware that strangers can access information you put on the internet.`

"Increasingly, social networking sites are being overrun by space fakers, who swipe other users' photos and create entirely new identities for themselves."

More at smh.com.au...

Microsoft To Release Future Cybercriminals

"The rumor that Microsoft was set to lay off people on January 15th, 2009 is no longer a rumor but a fact. Staff at Microsoft have been informed that the company is readying major layoffs to its worldwide operations and it's not a small cut, either.

"Currently Microsoft employs about 90,000 people across the world and from what we're hearing, some 15,000 of those are expected to be giving marching orders come January 15th. That's almost 17 percent of Microsoft's total work force, not exactly a small number.

"So far, we haven't managed to confirm what departments or regions will be hit the worst, but we're hearing that MSN might be carrying the brunt of the layoffs. We're also hearing rumors about the possibility of somewhat larger staff cuts at Microsoft EMEA (Europe, Middle East and Africa)."

From FudZilla...

USA! NUMBER ONE!!!

US replaces China as top source of Internet attacks

"A year-end report by anti-virus firm Sophos has revealed that more malware is hosted on American websites and more spam is relayed from American computers than any other country.

"In fact, the Sophos Security Threat Report 2008 said that when an American Internet company, accused of collaborating with spammers and hackers, was disconnected from the Internet in November, there was a staggering 75 percent drop in spam.

"According to the report, the US hosted 37 percent of the world’s malware, usurping China, which was responsible for hosting over 50 percent of all web-based malware in 2007.

"The US also relays the most spam at 17.5 percent."

More at mb.com...