Former Employees a Rich Target in Social Engineering Contest

The results of a hacking contest at the DEFCON conference shows that the largest U.S. corporations have a lot to learn. “If any of these targets had hired us to do a social engineering audit, we would have failed them,” an organizer said. HED:DEFCON tournament suggests ex-employees pose big risk...

Facebook Employees Crack Admin Security

Senior engineers at Facebook responsible for SRE site reliability engineering challenged Facebook employees to try to compromise him and gain access to Facebook’s administrative system via information obtained from him. They succeeded. Read the full article. TechCrunch...

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability

No description provided by source. Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the Microsoft-Spurned Researcher Collective. MSRC will fully disclose...

Treasury Bank Robbed by Online Thieves

Organized cyber thieves stole more than $100,000 from a small credit union who serves U.S. Treasury employees in Salt Lake City last week, in a brazen online robbery that involved dozens of co-conspirators. Read the full article. KrebsonSecurity...

Key Employees' Friends Were Facebook Targets in Aurora Attacks

A significant discovery in the recent Aurora attack that affected Google, Adobe, Yahoo and others is that the attackers had selected employees at the companies with access to proprietary data, then learnt who their friends were. The hackers compromised the social network accounts of those friends...

Notre Dame Data Breach Number at 24K

Notre Dame University, who originally discovered a data breach back in early November 2009, said 24,000 NDU employees were affected. Read the full article. The Observer...

Sensitive DHS platform hacked

From Federal Computer Week Ben Bain Attackers have penetrated a network that the Department of Homeland Security uses to share sensitive information with state and local authorities, gaining access to important, but unclassified, data. The attack began in March and occurred again a few weeks late...

Survey: 1/3 of employees would steal sensitive data

From PC Advisor Carrie-Ann Skinner More than one third of employees would steal sensitive company information if they thought they could earn a decent price from the theft, says Infosecurity Europe. Research by the security event organiser revealed that of those willing to steal sensitive data, 6...

Verizon Data Breach Report Reveals Depth of Breach Problem

Last night, the fine folks at Verizon posted the 2009 version of the DBIR. I haven’t had time to do a full deep dive yet, but I thought I’d share my initial notes in the meantime. Stuff in italics is from the DBIR, regular text is me: 81 percent of organizations subject to PCI DSS had not been...

What keeps security pros awake at night?

By Tim Wilson, DarkReading/InformationWeek We polled more than 400 business technology professionals to determine which threats they consider the most serious, how they prioritize their defensive efforts, and what plans they’ve put in place to keep their organizations’ data safe in 2009 and beyon...

CVE-2005-4485

Multiple cross-site scripting XSS vulnerabilities in ProjectApp 3.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the keywords parameter to 1 forums.asp, 2 searchemployees.asp, 3 cat.asp, and 4 links.asp; 5 projectid parameter to pmprojects.asp, 6 retpage parameter...