Lost BP Laptop Contains Financial Information on Thousands of Gulf Oil Spill Victims

Almost a year has passed since the Deepwater Horizon oil rig exploded and spewed three months of oil into the Gulf of Mexico. But less than six months after the beleaguered oil giant managed to cap that well, it is contending with a new spill of a different sort: the loss of personal information ...

Data Breach Could Test Massachusetts Law

UPDATE: The Massachusetts Attorney General has been notified that financial data on 1,800 residents were exposed in a database breach linked to CitySights NY, a sightseeing firm. The case could set the stage for enforcement of the State’s nine month-old data privacy law.Financial data on 1,850...

Forum for Data Fraudsters, Criminals Hacked

Carders.cc, a German online forum dedicated to helping criminals trade and sell financial data stolen through hacking, has itself been hacked. Read the full article. KrebsonSecurity...

Zeus Trojan Now Has Hardware Licensing Scheme

The authors of the Zeus bot client, perhaps the most popular and pervasive piece of malware of its kind right now, have taken an extraordinary step to protect their creation: inserting a hardware-based licensing scheme into the Trojan. This represents a significant leap in the sophistication and...

RSA 2010: BlackEnergy 2 Botnet Revealed

Like the sequel to a successful movie, the botnet behind the distributed denial of service attacks that hit the country of Georgia during its conflict with Russia in 2008 has been updated. This time though, the idea isn’t hacktivism—it’s stealing financial data and, unlike in the case of other...

iPhone Worm Was Simple, Yet Effective, Analysis Shows

The iKee worm that was infecting jailbroken iPhones last month was a simple, yet effective, piece of software that shows how easy it might be for an attacker to create a fairly large, functioning botnet comprising mobile devices, an analysis of the worm shows. Researchers at SRI International’s...

ID Theft Gang Using Amazon's EC2 as Command and Control Server

Security researchers have intercepted a new variant of the Zeus crimeware using Amazon’s EC2 services to command and control the botnet. The cybercriminals appear to be using Amazon’s RDS managed database hosting service as a backend alternative in case they lose access to the original domain,...

Malware Flea Market Pays Hackers to Hijack PCs

Among a slew of online cybercrime forums, Pay-Per-Install.org stands out as a malware flea market where shadowy pushers of Trojan downloaders and tools for evading detection are bargaining with thousands of would-be “affiliates” willing to compromise victims’ computers globally and get paid for i...

Online crime complaints hit record high in 2008

The FBI’s Internet Crime Complaint Center IC3 says complaints of online crime hit a record high in 2008, driven mostly by non-delivery of goods and service and those pesky 419 Nigerian e-mail scams. Accordign to a new report PDF from ic3.gov, the center received a a total of 275,284 complaints, a...

LedgerSMB < 1.2.8, SQL-Ledger 2.x Multiple SQL Injection Issues

Severity: Critical Effect: Compromise of FInancial Data, deletion of audit trails, alteration of system settings, disclosure of confidential information possible in some setups. Affected products: LedgerSMB 1.0.0-1.2.7 , SQL-Ledger 2.x all versions. 1: SQL injection issue in invoice quantity fiel...

XSS by setting img.src to javascript: URI — Mozilla

mozbugra4 reported that the src attribute of an IMG element loaded in a frame could be changed to a javascript: URI that was able to bypass the protections against cross-site script XSS injection. The injected script could steal credentials and financial data, or perform destructive actions on...