Blippy Now An Officially Fucked Company

"One day after being profiled by the New York Times, the social buying site, Blippy, is finding out that being in the public eye cuts in both directions.

"The six-month-old site lets users link their credit cards and e-commerce accounts and share that information with friends and even strangers on their purchases. The venture capitalists seem to be intrigued. Blippy has raised $11.2 million in funding from August Capital and Charles River Ventures.

"But there are limits to sharing private data - especially when it's not done voluntarily. Some sleuths have found they can use Google to come up with the credit card numbers of Blippy users."

More at CBSNEWS...

Can You Hack Me now?

"Malware-tainted memory cards may have ended up on as many as 3,000 HTC Magic phones, a greater number than first suspected, Vodafone said today.

"The problem came to light earlier this month after an employee of Panda Security plugged a newly ordered phone into a Windows computer, where it triggered an alert from the antivirus software.

"Further inspection of the phone found the device's 8GB microSD memory card was infected with a client for the now-defunct Mariposa botnet, the Conficker worm and a password stealer for the Lineage game.

"Vodafone said it was an isolated incident, but an employee at Spanish security company S21sec discovered another phone with an infected card, which it sent to Panda. That phone was purchased directly from Vodafone's Web site in the same week as the first phone, according to Panda.

"It is unclear how the batch of memory cards became infected and an investigation is under way, said a spokesman for Vodafone in Spain."

More at ComputerWorld...

Insurance Companies Leverage Facebook To Raise Your Rates

"Any town U.S.A. You walk into a store and notice someone you recognize, from Facebook. But you really don’t know the individual; only online have you “met” that person. You have shared a note, or played a game on Facebook, Myspace, or other media website. You can choose to say hello or ignore them. That choice is up to you.

"Sometime in the future, you wind up in a car accident and suffer physical injuries that you decide can be claimed in a lawsuit against the insurance company. Now your friends on Facebook may not have any choice of getting to know you up close and in person. You may not even be aware that they are being questioned.

"Insurance companies are beginning to demand access to information about you and they do not want your explicit consent. In a Globe and Mail report, the insurance industry wants to use sites such as Facebook to collect and use background information collected to contradict any evidence you have used in your claim for damages.

"The first thing the insurance lawyers will do in court is to ask plaintiffs if they have Facebook accounts and demand a court order to review those account — even if you have always had your privacy settings configured to be not searchable by Google or other services. And if somehow they find out that you are on Facebook and you said no, chances are your lawsuit against the insurance company may fail. And so the game begins. The lawyers will have access to everything about you; your friends are also now exposed and may be questioned about your online habits what you are doing online, personal messages are read and now your friend’s privacy is also vulnerable - even if you have never met them in person..."

Morre at ZDNet...

XP Users Helpless Against New Web Hack

"Microsoft told Windows XP users today not to press the F1 key when prompted by a Web site, as part of its reaction to an unpatched vulnerability that hackers could exploit to hijack PCs running Internet Explorer (IE).

"In a security advisory issued late Monday, Microsoft confirmed the unpatched bug in VBScript that Polish researcher Maurycy Prodeus had revealed Friday, offered more information on the flaw and provided some advice on how to protect PCs until a patch shipped.

"`The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer,` read the advisory. `If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user.`"

From ComputerWorld...

Massive Oracle PWN@G3 At Black Hat

"In 2001, Larry Ellison brashly proclaimed in a keynote speech at the computing conference Comdex that his database software was "unbreakable." David Litchfield has devoted the last nine years to making the Oracle chief executive regret that marketing stunt.

"At the Black Hat security conference Tuesday afternoon, Litchfield unveiled a new bug in Oracle's 11G database software, a critical, unpatched vulnerability that would allow a hacker to take control of an Oracle database and access or modify information at any security level. `Anything that God can do on that database, you can do,` Litchfield [said] in an interview following his talk.

"The attack that Litchfield laid out for Black Hat's audience of hackers and cybersecurity researchers exploits a combination of flaws in Oracle's software. Two sections of code within the company's database application--one that allows data to be moved between servers and another that allows management of Oracle's implementation of java--are left open to any user, rather than only to privileged administrators. Those vulnerable subroutines each have their own simple flaws that allow the user to gain complete access to the database's contents.

"Litchfield says he warned Oracle about the flaws in November, but they haven't been patched. Oracle didn't immediately respond to a request for comment."

More at Forbes.com...

Hacking Twits For Fun And Profit

"According to researchers at Kaspersky Lab, cybercriminals are trying to sell hacked Twitter user names and passwords on-line for hundreds of dollars.

"Since 2005, the bad guys have been developing new data-stealing malware that is now a growing problem on the Internet. Some of these programs look for banking passwords, others hunt for on-line gaming credentials. But the fastest-growing data stealers are generic spying programs that try to steal as much information as possible from their victims, said Kaspersky Researcher Dmitry Bestuzhev, speaking at a press event Friday.

"In 2009, Kaspersky identified about 70,000 of these programs -- twice as many as the year before, and close to three times the number of banking password stealing programs.

"They're popular because criminals are starting to realize that they can do better than simply swiping credit card numbers. Bestuzhev has seen Gmail accounts for sale on Russian hacker forums, (asking price 2,500 rubles, or $82) RapidShare accounts going for $5 per month, as well as Skype, instant messaging and Facebook credentials being offered.

"Asking prices can vary greatly, depending on the name of the account and the number of followers, but attackers are looking for an initial, trusted, stepping stone from which to send malicious Twitter messages and, ideally, infect more machines.

"Bestuzhev said that one Twitter account, with just over 320 followers, was offered at $1,000 in an underground hacker forum. The user's name was a simple three letter combination that Bestuzhev thought might make it more valuable to criminals. Compare that to an MSN account, which Bestuzhev has seen priced at €1 ($1.40). `The price for Twitter accounts is really high,` he said."

More at ComputerWorld...

USA NUMBER ONE!!!!!

"Insecurity outfit McAfee has named the US as the most likely source of cyber attacks, beating out the widely perceived favourites China and Russia.

"McAfee conducted a study that questioned 600 IT and security executives from various countries to discuss, rate and rank their biggest Internet security concerns. Most of the report just states the bleedin' obvious, except for the finding that the Americans are the most feared by the others.

"With the recent scuffles between Google and the Chinese government it comes as no surprise that almost 75 per cent of respondents believed that the Chinese government was involved in cyber attacks against their country. However, the figures for both the US and Russia were identical at 60 per cent. The UK government came in third from last with only 50 per cent or so believing that it was involved in naughty cyber aggression activities.

"Probably the most startling discovery was that it is the US, not China or Russia, that is feared the most. The majority of countries in the West listed the US ahead of China and Russia as the country `of most concern` when it came to attacks."

More at the Inquirer...

$15M Cyberscam PWN3D

"U.S. prosecutors indicted 19 people Friday – most in Dallas and Fort Worth – on charges related to a `massive cybercrime conspiracy` that they said defrauded local telecommunications companies and other merchants of $15 million worth of services and goods.

"The indictments follow raids by the FBI last year on two data hosting companies where computer servers were taken on suspicion of fraudulent activity. Friday's move expands a Sept. 2 indictment by U.S. Attorney James Jacks that targeted nine people.

"Several of those charged are believed to have fled the United States; one, Michael Faulkner of Southlake, is reported anonymously to have been killed trying to re-enter the U.S., Jacks' office said, though that has not been confirmed.

"The scheme went from 2003 to 2009 and involved the creation of shell companies through the data hosting companies run by Faulkner, according to the indictment."

More at dallasnews.com...

No Comment

"A huge majority of user-generated comments to blogs and forums are malicious, while tools are largely ineffective.

"Websense's biannual `State of the Internet` report revealed that 95 per cent of user-generated comments to blogs, chat rooms and message boards are spam or malicious. Websense Security Labs also identified a 233 per cent growth in the number of malicious websites in the last six months and a 671 per cent growth during the last year.

"Looking at Web 2.0 security trends, the report found that the websites are increasingly being used to carry out a wide range of attacks, and claimed that `efforts to self-police these Web 2.0 properties have also been largely ineffective`.

"The report said: `Websense research during the period showed that community-driven security tools (asking users to report inappropriate content) on sites like YouTube and BlogSpot are 65 per cent to 75 per cent ineffective in protecting web users from objectionable content and security risks.`"

From SC Magazine...

Finally, A Market For Macs

"New research from Sophos underscores a growing interest in the Mac among cyber-criminals.

"In a presentation at Virus Bulletin's VB Conference, in Geneva, Sophos Labs researcher Dmitry Samosseiko revealed a malware affiliate network offering 43 cents per infected Mac computer. The offer was the work of a larger network of Russian spammers, malware authors and businesspeople pushing everything from phony watches to medications—an alliance he called the `Partnerka.`

"This goes to show that Apple Macs, which are targeted far less than Microsoft Windows PCs, are not without security threats..."

From eWeek...

iPwn3d

"On Thursday, two researchers plan to reveal an unpatched iPhone bug that could virally infect phones via SMS.

"If you receive a text message on your iPhone any time after Thursday afternoon containing only a single square character, Charlie Miller would suggest you turn the device off. Quickly.

"That small cipher will likely be your only warning that someone has taken advantage of a bug that Miller and his fellow cybersecurity researcher Collin Mulliner plan to publicize Thursday at the Black Hat cybersecurity conference in Las Vegas. Using a flaw they've found in the iPhone's handling of text messages, the researchers say they'll demonstrate how to send a series of mostly invisible SMS bursts that can give a hacker complete power over any of the smart phone's functions. That includes dialing the phone, visiting Web sites, turning on the device's camera and microphone and, most importantly, sending more text messages to further propagate a mass-gadget hijacking."

More at Forbes.com...

Patch Tuesday Brings 0day Relief

"A critical ActiveX vulnerability used by hackers to exploit Microsoft Corp.'s Internet Explorer browser is a prime candidate for another Conficker-scale attack, security experts said.

"On July 6, just hours after security companies reported that thousands of compromised sites were serving up exploits, Microsoft acknowledged the flaw in the ActiveX control that can be accessed using IE. The bug has been used by hackers since at least June 9.

"Microsoft said it will issue a patch for the flaw on July 14..."

More at ComputerWorld...

REPORT: Exploits At All Time High

"The number of exploits being written to target specific software vulnerabilities could be at all-time highs, new threat figures have suggested.

"Fortinet's Threatscape report for June, which actually covers the period between 21 May and 20 June, reveals that of the 108 new vulnerabilities added to its firewall intrusion detection system in the period, 62 were being actively exploited.

"This is equivalent to a 57.4 percent exploit rate, a rise over previous months and in line with increasing percentages and absolute numbers for recent months. For comparison, April-May exploit rates stood at 46.4 percent, with March-April at 31.3 percent..."

From TECHWORLD...

"High Profile" FTP Sites PWN3D

"Security researchers have found a treasure chest of FTP passwords, some from high profile sites, on an open cybercrime server.

"Jacques Erasmus, CTO at security tools firm Prevx, stumbled across a site where a Trojan is uploading FTP login credentials captured from compromised machines. So far, Erasmus has found logins for ftp.bbc.co.uk, ftp.cisco.com, ftp.amazon.com, ftp.monster.com and, even security sites including ftp.mcafee.com and ftp.symantec.com along the extensive list of more than 68,000."

More...

Virtual PWNAG3 Downs 100K Sites

"Nearly 100,000 websites have been shut down after hackers attacked a UK based internet service provider (ISP).

"The hackers got into Vaserv through a zero-day vulnerability in its virtualisation application, the widely used HyperVM, created by LXLabs.

"Reports across the web have stated the attack happened on Sunday night and according to Vaserv’s website, it is still working to fix the problems."

More at IT Pro...

Hackers Download "Terabytes" Of Pentagon Data

"Hackers broke into U.S. Department of Defense computers and downloaded terabytes of data containing design information about the Joint Strike Fighter, a US$300 billion stealth fighter currently under development, according to The Wall Street Journal.

"The stolen files all relate to the design of the Joint Strike Fighter and its electronic systems, the Wall Street Journal reported, saying they could be used to help defend against the jet...

"The reported attack raised more questions than it answered.

"For example, the report did not say how attackers managed to download terabytes of data before being discovered. A single terabyte can take up to several weeks to download over a relatively fast data connection, such as a DSL or cable modem..."

More at NetworkWorld...

Hackers PWN Ticketmaster

"If you're hoping to score tickets to Coldplay's Vancouver concerts when they go on sale Saturday, you could find yourself up against computer hackers who can order up hundreds and even thousands of tickets in the time it would take you to punch in a single order.

"Scalpers looking to jump the online queue can program a computer to circumvent Ticketmaster's website security and automatically order tickets at speeds far beyond ones the ordinary buyer could hope to match...

"`Maybe it takes you a minute-and-a-half to click through to buy a ticket, in that minute-and-a-half the hacker could have made 100,000 ticket requests," said Ryan Purita, a forensic examiner and security specialist with Sherlock Forensics. "You cannot beat a hacker script...`"

Source: Vancouver Sun...

Most Oracle Shops Ripe For PWNAGE

"A continuing lack of corporate mandates to quickly install Oracle Corp.'s security patches may be leaving many Oracle database installations exposed to vulnerabilities for extended periods of time, according to survey results released on Wednesday.

"In a pair of online surveys that were jointly conducted between May and August of last year by the International Oracle Users Group (IOUG) and Oracle, only 26% of the 150-plus respondents said that their companies required the software vendor's quarterly patch updates to be applied on all systems as soon as they're released.

"Another 6% said they're required to install Oracle's Critical Patch Updates (CPU) on critical systems only, the IOUG and Oracle wrote in a report. Meanwhile, 30% said their companies didn't have any specific policies in regards to Oracle's patches, while 32% said their policies required database administrators to do either risk or cost-benefit analyses in order to justify the installation of patches in production databases."

More at ComputerWorld...

More Payment Processor PWNAGE

"Just weeks after Heartland Payment Systems Inc. disclosed what may be one of the largest breaches of payment card data thus far, news is emerging of what could be another major breach involving a payment processing company.

"The identity of the payment processor is still unclear, as is the number of credit and debit cards that were compromised in the breach. What is known is that attackers broke into systems at a U.S-based company and that the breach exposed the account numbers and expiration dates of payment cards used in so-called card-not-present transactions between last February and this January.

"The breach is the third affecting a payment processor to come to light since late last year, following the one that Heartland acknowledged last month and another that RBS WorldPay Inc. disclosed in December. The latest incident underscores concerns within the financial industry that attackers are increasingly targeting payment processors, which typically handle far more card data than individual retailers do."

Read more at ComputerWorld...

What Would Jesus Do?

"A local pastor’s day was turned upside down Friday after hackers stole his e-mail identity and sent a distress message to all his contacts.

"The Rev. Darren Demaree, pastor of Legacy Church in Loveland [StreetView], said Friday that his Hotmail e-mail account had been hacked into. Hotmail is an Internet-based e-mail service that allows its users to access their accounts from anywhere in the world.

"Apparently, someone somewhere in the world has done just that.

"An e-mail plea was sent to everyone in his address book saying he had taken an unplanned trip to England to take part in a program called `Empowering the Youth to Fight Racism, HIV/AIDS, and Lack of Education.`

"It further reads: `Unfortunately, all my money and traveling documents were stolen in my hotel room during a robbery incident in the hotel where I lodged.`

"It then asks for recipients to send him money — 2,500 British pounds, or about $3,700.

"`This has been awful,` Demaree said from Loveland on Friday. `Everyone’s been calling.`

"Demaree, who didn’t travel to London for any such conference, said he cannot even access his own e-mail account, so his wife has been trying to send messages to everyone from hers.

"He has tried to get the provider of the e-mail account to help him but has been unsuccessful, he said."

From The Reporter-Herald...