Netcraft Toolbar Takes Aim at Phishers
22843
Netcraft, a UK-based security firm, has released a toolbar to help protect users against phishing attacks. It displays the attributes of Web sites the user visits, helping to determine whether sites are likely to be legitimate.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.
758956
Hole could allow remote attackers to access your local search results.
239180
User-generated Web content is becoming a target for hackers and cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites.
711347
Code that exploits a "critical" Windows flaw has been posted on the Net, opening the door for a worm to be created.
81976
Recently discovered vulnerability allows hackers to use Web graphics to launch attacks.
590294
Some websites are now offering surfers the chance to download free &quot;phishing kits&quot; containing all the graphics, web code and text required to construct the kind of bogus sites used in internet phishing scams.
157290
The internet security company heralded the plug-in toolbar, which displays information about the websites a surfer is visiting, as a strong weapon against phishing attacks.
383627
A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net. The toolkit (screen shot from AV firm F-Secure here) makes it trivially easy for maliciously-minded
347238
Hole allows attackers to create fake Web sites that look genuine.
380030
INTERNET banking users beware, there appears to be a new "phishing" method about.   The technique, which avoids most detection systems, works after you log on to an authentic site.
643542
Security have warned about a new Web browser security hole which could allow scammers to launch phishing attacks from pop-up windows on trusted websites.
16648
Opt-out button in spam used to run exploit
86222
In brief Exploit circulating for unpatched vuln
738631
Fraudsters have developed phishing emails capable of automatically stealing bank log-in details without requiring users to click on a website link, email filtering firm MessageLabs warns.
86025
An Internet Explorer vulnerability first reported yesterday is already getting a workout. Malware utilizing the hole for installation is turning up on various Russian porn sites, with more trouble expected.
657731
Google is working to fix a bug in the Google Toolbar that could allow criminals to steal data or install malicious software on a system, a security researcher warned Tuesday.The flaw lies in the mechanism Google Toolbar uses to add new buttons on the browser. Because the toolbar does not perform adequate checks when new buttons are being installed, a hacker could make his button appear as though it was being downloaded from a legitimate site when in fact it came from somewhere else. By spoofing the origin of the toolbar button, an attacker could download malicious files or launch a phishing attack against the victim, wrote security researcher Aviv Raff in a blog post on the issue.Raff has posted proof of concept code, showing how such an attack would work with the Internet Explorer browser. A Google spokeswoman confirmed Tuesday that the company is working to fix the problem.The attack requires many steps. First, the victim would have to be tricked into clicking on a Web link that would then pop up a window asking the user if he wants to install a custom button on his toolbar. Because of the flaw, this alert could look like it was downloading the button from a legitimate site, such as Google.com, even if it were not. Once the button was installed on the toolbar, the victim would then have to click on it and, finally, agree to download and run an executable file for the malicious software to be installed.Because the user would have to go through so many steps in order to fall victim to the attack, the bug isn&#39;t a critical one, said Marc Maiffret, an independent security researcher. &quot;While it is interesting, it&#39;s probably a low threat compared to other flaws out there,&quot; he said.Still, it was sloppy work on Google&#39;s part to miss such a simple attack, he said. &quot;They should definitely assess how it slipped through the cracks,&quot; he said.This is not the first obvious Google flaw that Raff has found. Last month, he showed how a simple Web programming error on the Google.com Web site could allow attackers to launch what&#39;s known as a cross-site scripting attack.Because Google&#39;s programmers didn&#39;t properly check the HTML generated by the Google search engine, Raff was able to create a specially crafted Google link that, when clicked by the victim, would trick the browser into running unauthorized scripting code. This type of link could be used to steal the victim&#39;s Google account or conduct phishing attacks, Raff saidThis error was fixed by Google just hours after Raff notified the company of the problem, but a demo of the flaw being exploited can be seen online.