Data Thief: Call Center Employee Pleads Guilty

A Bank of America call center employee has pleaded guilty to charges that he stole sensitive client information and then tried to sell it for cash. Read the full article. IDG News Service...

Joomla! Component com_lead - SQL Injection

Joomla! Component comlead - SQL Injection TR Title: Joomla Component comlead SQL Injection TR Date: 03.06.2010 TR Author: ByEge TR Homepage: byege.blogspot.com TR Vendor: http://www.leadya.co.il/ TR ExploiT : TR index.php?option=comlead&task=display&archive=1&Itemid=65&leadstatus=1' TR column...

SMB Remote Disk Scanning for Executable Files

Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network...

Friending HR: A Rich and Mineable Source of Intelligence

One of the most common complaints I hear from information security executives in large organizations is that they are constantly playing defense, not offense. Their network security apparatus is designed to wait for an attack, see if it’s successful and, if it is, to plug the hole, then repeat. T...

iPhone Sandbox Model Not Enough

The iPhone sandbox has always been held up as a major roadblock to thwart hackers from doing damage on the device. But, as European researchers Vincenzo Iozzo and Ralf Philipp Weinmann proved, a hacker can hijack a lot of sensitive data without ever leaving the iPhone sandbox. In this case, they...

Inside a Banker Trojan

The attackers behind the raft of banker Trojans emanating from Brazil these days are continuing to refine their craft and learn new tricks. Their latest efforts have seen them going to greater lengths than ever to obfuscate their creations and hide their true functionality in order to evade...

Law Firms See Uptick As Cybercrime Targets

Cyber-criminals see law firms as particularly lucrative targets that can earn them hundreds of thousands of dollars per heist. Cyberspies also attack attorney firms to steal client data that can be sold or used to learn the details of future litigation. Read the full article. SF Chronicle...

Zeus/Zbot Banking Trojan/Data Theft (credentialed check)

The remote Windows host has files that indicate that the Zeus also known as Zbot banking trojan has been installed, or that stolen data collected by this trojan remains on the system. The Zeus trojan will intercept and log activity related to online banking, as well as other logins, such as web,...

Zeus Trojan Now Has Hardware Licensing Scheme

The authors of the Zeus bot client, perhaps the most popular and pervasive piece of malware of its kind right now, have taken an extraordinary step to protect their creation: inserting a hardware-based licensing scheme into the Trojan. This represents a significant leap in the sophistication and...

CVE-2010-0051

WebKit in Apple Safari before 4.0.5 does not properly validate the cross-origin loading of stylesheets, which allows remote attackers to obtain sensitive information via a crafted HTML document. NOTE: this might overlap CVE-2010-0651...

Mariposa Botnet Caught and Killed

Authorities have smashed one of the world’s biggest networks of virus-infected computers known as the Mariposa botnet, a data vacuum that stole credit cards and online banking credentials from as many as 12.7 million poisoned PCs. Read the full article. Associated Press...

P2P Networks Can Nab Private Medical Info

The personal health and financial information stored in thousands of North American home computers may be vulnerable to theft through file-sharing software, according to a research study published online in the Journal of the American Medical Informatics Association. Read the full article...

PHP 5.3.1 - LCG Entropy Security

PHP 5.3.1 - LCG Entropy Security source: https://www.securityfocus.com/bid/38430/info PHP is prone to a security vulnerability that affects LCG Linear Congruential entropy. Attackers can exploit this issue to steal sessions or other sensitive data. Versions prior to PHP 5.2.13 are affected...

Chuck Norris Botnet Discovered By Honeypot

Czech security experts say they have uncovered a global botnet that may be redirecting Web surfers to other sites for the purpose of stealing their data. The botnet’s creators have dubbed the network “Chuck Norris” after the famous Hollywood actor and martial arts expert. Read the full article...

Vito CMS - SQL Injection

Vito CMS - SQL Injection .:. Author : [email protected] .:. Contact: [email protected], [email protected] .:. Home : www.evilzone.org .:. Script : Vito CMS .:. Info link: http://kameleon-lab.com/vito-cms.php .:. Versions: ALL .:. Bug Type : Sql Injection .:. Risk: High .:. Tested on : Windows ...

Malware, SQL Injections Dominate Breach Reports

With millions of personal records and payment card information stolen on a regular basis, several recently released reports independently confirm some of the main sources of breaches. Not surprisingly, that’s not zero day flaws, not even insiders, but good old fashioned SQL injections next to...

Rogue iPhone Apps Explored at Black Hat

Lax security screening at Apple’s App Store and a design flaw are putting iPhone users at risk of downloading malicious apps that could steal data and spy on them, a Swiss researcher warns at Black Hat DC. Read the full article. cnet...

Anatomy of a Targeted, Persistent Attack

A new report published today sheds light on the steps ultra-sophisticated attackers take to gain a foothold inside governments and company networks and remain entrenched in order to steal intellectual property and other data. The bad news is these attacks — including the recent ones on Google,...

ExxonMobil, Others Attacked Via Email

At least three US oil companies were victims of highly targeted, email-borne attacks designed to siphon valuable data from their corporate networks and send it abroad, according to a published report citing unnamed people and government documents. Read the full article. The Register...

Google Attackers Used Internet Explorer Zero Day

Several of the companies victimized in the attack that hit Google and dozens of other companies recently were compromised through the use of a new, unpatched vulnerability in Internet Explorer, experts say. The flaw was used in a sophisticated attack that included victims receiving targeted email...