McAfee: .gov sites are safest
108165
But one in 10 sites with a domain from the island of Tokelau spread malicious software or warrant a warning.
319294
(InfoWorld) - Top executives from the security firm McAfeeÂ went on the offensive Monday against Microsoft, saying Vista will be even less secure for customers than previous versions of Windows. The day after McAfee took out a full-page advertisement in the Financial Times to publicly air its grievances over the security of Vista, McAfee Chairman and Chief Executive Officer (CEO) George Samenuk, Vice President and Chief Scientist George Heron and Chief Security Architect John Viega delivered the same message in person in New York. "We are disturbed by the fact that with Vista, end customers will be less secure," Samenuk said. "Customers trust us ... To erode that trust would hurt all Internet users, all PC users. I don't think Microsoft wants that, nor does McAfee want that." Two security elements in Vista fare chief among McAfee's concerns, executives said. In Vista, Microsoft is locking down the kernel of the OS through a feature called PatchGuard on 64-bit versions. Microsoft's argument is that this will keep miscreants out of the OS and prevent the incidence of attacks, and it is something for which customers have been asking. "Fooling around with the kernel while it's running is like changing the sparkplugs on your car when the engine is running," said Stephen Toulouse, a senior product manager at Microsoft. "It's never been a good thing for users." But McAfee said since PatchGuard also prevents third-party security companies from getting inside the OS, they can't activate crucial security measures in their software to protect the OS from intruders. PatchGuard is not new in Vista, said Bruce McCorkendale, a distinguished engineer with McAfee competitor Symantec Corp., which shares McAfee's consternation over the feature. He said Symantec has been petitioning for Microsoft to change the feature since the company introduced it in its 64-bit version of Windows XP, but the company will not budge. "If you ask any security vendor that offers advanced protection, you'd get the same answer [about PatchGuard]," McCorkendale said. "It's just inhibiting the way security vendors do their jobs." However, according to Jupiter Research, only 5 percent of companies with 100 employees or more are running Windows XP in its 64-bit version, and that adoption is not supposed to ramp up significantly anytime soon, said analyst Joe Wilcox. "If this new [feature] affects 64-bit only and nobody is using 64-bit, what's the problem?" he said. The other big concern with Vista for McAfee lies in a new security interface called Windows Security Center (WSC). Microsoft will not allow this interface to be turned off, so McAfee and other third-party users can't install their own security-management consoles on Vista machines, executives said. McAfee's argument is that third-party security products can better detect potential or existing security problems that Vista inherently can, and unless those can be surfaced through the interface, users will not be alerted to them, Viega said. Some believe security vendors are crying foul over Vista because Microsoft's ability to control security features of the OS is a threat to their livelihood. Companies such as McAfee and Symantec have all but built their businesses on the fact that Windows is inherently insecure, and add-on security software is needed to protect it from intrusion. "Historically, when Microsoft has gotten into a market, the number of competitors goes down," Wilcox said. However, he said there is a legitimate concern, supported by precedence, that not only will vendors be pushed out of the market, but there will be less innovation in Windows security products and more problems will arise. Wilcox cited Internet Explorer as an example of an area in which Microsoft beat competitors, but then did not innovate on the product until it faced competition once again. "Microsoft won the browser war and for years abandoned the territory," Wilcox said. If Microsoft successfully reduces the number of competitors by building security into Windows, it might also become lackadaisical about security improvements, thus opening the OS up to more attacks.
105981
Most users think their computer is safe from adware and spyware--but they&#39;re wrong. A survey conducted by Internet service provider America Online found that 20 percent of home computers were infected by a
371715
At long last, McAfee is catching up with its competitors in the security space in the field of data encryption, with the rollout yesterday of a new feature that the company appears to have acquired last November.
324151
Attackers continue to use well-worn techniques, such as SQL injection, to exploit holes in popular Web applications but have also moved on to other targets, including government sites, and newer exploit methods, such as cross-site request forgery, according to the latest report filed by the Web Applications Security Consortium.The nonprofit industry group released the findings of its annual Hacking Incidents Database report this week, and despite the fact that cyber-criminals are still capable of using familiar means like SQL injection to victimize e-commerce sites and other transactional systems, a growing number of assailants are broadening their efforts and capabilities and going after new sets of targets, the research contends.Based on WASC's in-depth investigations into roughly 80 individual attacks carried out during calendar 2007, the group concludes that data theft remains the primary goal of most incidents, representing 42 percent of all the events.Surprisingly, site defacement -- thought to be a dying art in the world of profit-driven hacking -- actually still accounted for 23 percent of the attacks covered in the report, followed by exploits aimed at planting malware on sites at roughly 15 percent.And while the lion's share of the incidents studied by the group revolved around the attempted theft of sensitive data that could be sold on the underground market or used to carry out fraud, the phishing threats of years past are increasingly becoming outnumbered by attacks that utilize malware code hidden on legitimate Web applications to victimize unsuspecting end-users, the group said.Of all the threats studied by WASC in its report, 67 percent were designed specifically to derive some form of profit -- pointing to continued growth in the professionalism of those responsible for the attacks, researchers said."One of the biggest issues is that so much of this activity is being delivered directly though legitimate Web sites that are being hacked," said Ryan Barnett, a project leader at WASC who also serves as director of application security training at applications firewall vendor Breach Security, which sponsored the 2008 report."It used to be that as long as users didn't go to certain Web sites they'd be safe, but obviously, that's changing," he said. "SQL injection still works surprisingly well, so we're seeing plenty of those across the board, but you do also begin to see more use of things like cross-site request forgery, to which even greater numbers of sites might be vulnerable."SQL injection, which attempts to use security vulnerabilities occurring in the database layer of applications to compromise them, still remains a weak point in some widely-used Web systems, in particular e-commerce sites, a reality that the researcher views as surprising based on the well-established history of the technique. However, CSRF threats, which attempt to hijack authenticated Web sessions to carry out their ploys, are becoming more common, while still far less frequent than SQL injections, according to the expert. Indeed, CSRF threats accounted for only 2 percent of the incidents tracked by WASC for the 2007 report, while SQL injections represented 20 percent, the most popular format for exploit.Unintentional information disclosure, which involves sites that emanate such detailed authentication failures that hackers may use them to find a way in, was the second most popular format for attackers to break into applications at 15 percent, followed by cross-site scripting exploits, which use malware planted on legitimate sites to subvert end-users' machines, at 12 percent of the incidents.In terms of the types of organizations being assailed by the attacks tracked by WASC, the group found that government agencies actually represented the largest group of targets.Perhaps because financial services companies and retailers have improved their applications defenses, hackers have moved on to the government set as well as educational institutions, the report contends.Some 29 percent of the incidents covered in the report targeted government agencies, followed by education at 15 percent, and retailers and media outlets tied at 12 percent.In addition to attempts to steal data, WASC contends that government agencies may also be getting hacked by parties looking to embarrass or disable the organizations' sites based on ideological goals. Because government agencies are forced to report more of their security incidents publicly, hackers may merely be trying to force the organizations to admit that they have been exploited in public, the researchers said.
538641
Worried about catching viruses, spyware, or other malicious software while surfing the Web?
416925
If you want to know what it&#39;s like to dance with the devil, you might ask the folks at McAfee (NYSE: MFE). Scratch that, you don&#39;t need to ask, just read a few lines of the 10Q.
718835
A study from security vendor McAfee found that search query results returned by Google, AOL, and Ask.com are less likely to lead viewers to dangerous Web sites than they were six months ago. The study also found that Yahoo and MSN are not following that trend toward safer search results.
387990
Blog: In what could be a whopping security hole, Nevada has posted the password to the gubernatorial e-mail account on its official state Web site. It's "kennyc."
71144
McAfee announces an add-on to its enterprise anti-virus software that boosts spyware protection for businesses. By Gregg Keizer, TechWeb News.
104663
Worried about spyware? spam? "spim"? AOL wants to set your mind at rest. Also: Putting patches in place.
347238
Hole allows attackers to create fake Web sites that look genuine.
333352
Blog: Some federal government Web sites, including the Office of the Director of National Intelligence, are trying to remain hidden online by blocking search engines from indexing them. Not only is this lame, but it's a good reason to ignore their robots.txt fi
128025
This article seeks to answer the question: is your personal data safe? Or do you give it away during almost every transaction you make with government or commercial entities?
723764
McAfee is preparing versions of its e-mail and Web security appliances designed for enterprise users.
564244
How can you and your business avoid the riskiest Web sites? A new research report by security software vendor McAfee, released Monday, indicates that you can do more than simply notice if the English seems badly translated.
452780
McAfee says it's sorry for glitches in new security software.