Ex Ford Engineer Arrested for Alleged Theft of Trade Secrets

A former Ford Motor Company engineer has been indicted on charges of theft of trade secrets, attempted theft of trade secrets and unauthorized access to protected computers. Xiang Dong Yu, also known as Mike Yu, was arrested last week as he entered the country at Chicago O’Hare International...

Hackers Using Custom Trojans to Hide Online Bank Thefts

Online criminal gangs have begun using special malware that enables them to hide the amount of money that they’re stealing from victims’ online banking accounts, helping them evade detection for longer periods of time and extend the effectiveness of their crime sprees. Using a banking Trojan call...

A Peek at the 'Bahama' Click Fraud Botnet

A new botnet, codenamed the ‘Bahama’ botnet has been linked to the recent surge in click-fraud and scareware attacks. This video by researchers at Click Forensics shows the Bahama Botnet in action. More on this botnet in this report...

Google + reCAPTCHA Could Raise Bar in Anti-Bot, Anti-Spam Fight

Locked in a cat-and-mouse game with spammers who use bots to defeat anti-fraud mechanisms and create fake accounts, Google today announced a deal to acquire reCAPTCHA, a company that provides those squiggly words at login screens. The ReCAPTCHA deal isn’t exactly a security transaction...

Sophisticated Botnet Causing a Surge in Click Fraud

A new botnet has caused a sharp spike in click fraud because it is skirting the most sophisticated filters of search engines, Web publishers and ad networks, according to Click Forensics. The company, which provides services to monitor ad campaigns for click fraud and reports on click fraud...

MicroSolved Explains Credit Union Pen Test

Officials at MicroSolved, the security services company that was involved in the penetration test that set off concerns about malware-infected CDs being sent to credit unions, have posted a detailed explanation of the technique and how it turned into a national news story. In short, the technique...

Spam Kingpin Ralsky Pleads Guilty to Stock Fraud

From IDG News Service Stephen Lawson Alan Ralsky, a spam kingpin who was convicted of felony bank fraud in 1995, could face more than seven years in prison after pleading guilty in a stock fraud case involving spam messages that pumped up Chinese “penny” stocks. Ralsky and four other individuals...

Cormac Herley on the Underground Economy, IRC Economics and the Externalities of Cybercrime

Dennis Fisher talks with Cormac Herley of Microsoft Research about the paper he co-authored on the realities of the underground economy, why sales of stolen credit cards resemble a market for lemons and how we can get better data on cybercrime activities. Podcast audio courtesy of sykboy65 Downlo...

Study: Women more affected by ID fraud

From CNet Elinor Mills Women are more affected by identity fraud then men are, according to a new survey that also found that it takes women longer to restore their identities but they also tend to change their behavior afterward. In a survey of 808 U.S. households, half of which reported fraud, ...

Criminals pay top money for hackable Nokia phone

From IDG News Jeremy Kirk Criminals are willing to pay thousands of euros for a discontinued Nokia mobile phone with a software problem that can be exploited to hack into online bank accounts cio.com, according to a fraud investigator in the Netherlands. About 10 days ago, investigators observed...

Radical steps are needed to fix Internet security

The Internet as we know it today was designed to be a place where people could go about their business, whatever it happened to be, anonymously and without interference from other users. This model worked reasonably well for a long time, but it’s become painfully clear in recent months that some...

Targeted attacks use 'Recession Relief' theme

Internet fraudsters are increasingly taking advantage of the deepening recession to dupe unsuspecting email recipients. The e-mail often includes a request for personal details on the pretense of receiving some financial reward, which later leads to fraud. Common themes include prize wins,...

Ori Eisen on Credit Card Fraud and the Need for a New Internet

Dennis Fisher talks with Ori Eisen, founder of 41st Parameter, about the roots of online fraud, how the credit card companies and banks could have done better and whether we need to start from scratch with a new Internet. Subscribe to the Digital Underground podcast on Podcast audio courtesy of...

Sir Tim Berners-Lee is a cybercrime victim

By Richard Gray, Telegraph.co.uk Sir Tim Berners-Lee, the creator of the worldwide web, has revealed how he fell victim to online fraudsters while trying to buy a gift over the internet. From the article: “The worst thing that has happened to me was when I tried to buy a Christmas present from a...

New e-crime reporting tool being developed

The Anti-Phishing Working Group APWG hasdeveloped a way for police and other organizations to report e-crimes in a common data format readable by a Web browser or other application, according to a report by Jeremy Kirk CIO.com. Peter Cassidy, secretary general of the Anti-Phishing Working Group...

Google launching members-only security forum

internetnews.com’s Kenneth Corbin has the scoop on plans by Google to launch a members-only security forum for businesses, law enforcement, government agencies and others to combat malware and fraud on the Web. In addition to Google, the Internet Security Community will draw participation from...

Namazu cross-site scripting vulnerability

Overview Namazu is vulnerable to cross-site scripting due to a problem in namazu.cgi. If an illegal character is specified in a string search of namazu.cgi, the subsequent characters are not processed properly. Impact All sites that use namazu.cgi for search processing on websites are vulnerable ...

sip-fraud.txt

SIP Digest Access Authentication RELAY-ATTACK for Toll-Fraud In this post, we would like to inform about a potential Authentication vulnerability in SIP, where all SIP equipments using Digest Access Authentication which can issue re-INVITEs are vulnerable. The problem lies in an attack scenario,...

Authentication flaw

Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication...

Authentication flaw

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication forward attack". NOT...