News: Telenor takes down 'massive' botnet
447926
A network of more than 10,000 zombie PCs has been dismantled after security staff at Norwegian telco Telenor located and shutdown its controlling server.
26726
The company fixes a huge security vulnerability that made it possible for attackers to steal users' personal data. By the Associated Press.
49498
THE PROBLEM with phpBB software, which we reported on this time yesterday is over. And it&#39;s thanks to Google, it appears. F-Secure said that the Santy worm, which defaced web sites and used a Google search
768812
Password-stealing Trojan horse may--or may not--be targeting popular VoIP feature.
392900
Spammers are suspected of hacking into and downing Lycosâs anti-spam Web site just hours after it went live. The Web site is currently inaccessible and could also be the victim of a DDoS attack.
768367
A new worm can spy on users by hijacking their Web cameras, a security firm warned Monday. The Rbot.gr worm -- the latest in a long line of similar worms; one security firm estimates that more than 4,000 variations
241820
Also: Hackers rig Google to deliver malware. See what people are saying on News.com Extra.
356225
Security experts contend that a growing number of operators of compromised computer networks (or "botnets") are finding new ways to grow their networks and make them immune to potential shutdowns, including sophisticated fault-tolerance planning to help ensure that their networks can't be easily wiped out.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
237409
Storm, now a large remotely controlled botnet, is getting a graphic profile on a Web site set up to track it.
231567
Russian connection in hacking investigation PlusNet has accepted blame for its latest email blunder, having previously fingered vulnerabilities in third party webmail software for last week's security flap.â¦
152473
An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods.The Web Application Security Consortium's Distributed Open Proxy Honeypot Project, which was initially turned on in Jan. 2007, will relight its set of attack monitoring sensors on or about the first of the year after significantly scaling back its operations during the month of December.After its initial 11 months of data collection, the project undertook the month-long hiatus to give project researchers more time to examine results and plan for the year ahead.In addition to tweaking their tactics for tracking and luring malware distributors in 2008, WASC project leaders said they are also planning to add new honeypots to their existing network, which already spans locations in Europe, Russia, South America, and the United States.Unlike more traditional OS-level or SMTP-based honeypot applications -- systems designed to collect individual malware samples for subsequent examination by anti-virus researchers -- the WASC project utilizes a network of 14 specially-configured open proxy servers (or proxypots) to monitor traffic for nefarious activities carried out by everyone from botnet herders to adware purveyors.Traditional honeypots have proven useful for tracking widespread computer viruses and allowing AV companies to produce the signature files needed to protect machines against infection, but those targets are ill-suited to provide the level of real-time intelligence needed to protect against today's fast-moving customized threats, said Ryan Barnett, the WASC project's leader.By serving up an unprotected open proxy server to the larger Internet, and thereby advertising itself as exactly the type of anonymous conduit that attackers seek out to distribute their work -- rather than merely an undefended computer, the effort is already garnering new insight into cyber-criminals' methods, he said.Barnett, who is also director of application security training at Breach Security and an instructor for the SANS Institute, said that despite being pleased with the project's initial ability to identify attacks and test ways to thwart malware campaigns further upstream, he is hoping that 2008 will provide even greater rewards.Among the improvements the group is aiming to make to its system -- built around the ModSecurity open-source Web application firewall, for which Barnett also serves as development community manager -- are more effective ways for categorizing attacks, correlating anomalies, and applying forensics to trends that it charts over time.The security expert is hoping that the same open-source movement that has allowed ModSecurity to mature, with the firewall recently adding a range of new features in its late-December version 2.5 release, will also take hold with the honeypot effort and encourage more people to launch sensors or help research its data findings."Getting different versions of data analysis will be key, but we will need to get a lot more people onboard," Barnett said. "We feel that there's a whole symbiotic approach with the project and the open-source community already. We need to export more of the raw data into that community to help analyze the results -- there's simply too much data for us to churn through alone."The future of the proxypots What the use of the proxypot model allows the project to observe are the source IP addresses being used by attackers running over its sensors, along with the nature of their threats and their targets.For instance, out of the 8.9 million questionable transactions carried out over the group's servers in October, when the sensor network was last running at full bore, 2.6 million of the requests were related to advertising click fraud, the leading type of threat observed in the firewalls' logs.Further investigation of the results would allow WASC to figure exactly which sites were being pumped-up by those automated traffic hoarders and inform any companies involved of the illegal activity, Barnett said.For the record, more than three quarters of the traffic moving over the proxypots fails to trigger any of the firewall rules, meaning that it is either benign or unidentifiable as malware.While the WASC honeypot project could eventually be used to snuff out some malware sources or block the threats themselves, for now, the idea is to create an early warning system to help the security industry respond to emerging attacks.Along with finding more bodies to throw at analysis of its findings, the project is also considering how it will continue to move forward in relation to the matter of allowing its proxypots to be used to carry out actual attacks.Thus far, participants in the program have been sending spoofed information back to the attackers channeling traffic over their proxies to fool them into thinking that their campaigns are working and prevent detection of the honeypots.However, some researchers involved with the program have been asking to allow traffic to pass over their systems unrestricted under the belief that it would be the best way to screen for the newest and smartest threats.In most cases, project participants will need to defer to local laws governing their level of liability for allowing nefarious traffic flow over their servers if they decide to run wide open, said Barnett. Figuring out exactly how to tackle the issue is one of the WASC honeypot's other major goals in advancing its status during 2008."We're trying to regroup and figure out how to best address everything in the next twelve months, enough people are asking about the alternative of not blocking malicious traffic that it has become a question we seriously need to consider," said Barnett. "There are legal issues to study if we want to let real attack run through us, it could still happen anyways -- people can always get around rules, so, there is definitely still some risk involved."
295779
Blog: Low ransom request and a self-termination date on the code suggest this is a test attack.
300862
Reposted in the queue as it's impossible or at least very complicated to move it as I asked (although the post where aphrael said such thing disappeared so perhaps this is not the case after all - another minor K5 mystery).  The original discussion can be found here (read it as there are some clarifications by rusty). All right, here is the (adapted) diary. Rusty posted a comment in the diary entitled "Would you pay 10USD for K5 Life Membership?" saying that K5 will become a pay site once new user registrations will be reactivated: "I was thinking $5.00 (none / 0) (#18) by rusty on Thu Sep 06, 2007 at 04:42:15 PM CET But it would actually be charged. That plus a hash of the identifying CC info so you only get one account ever, and I think we'd either shrivel up to nothing and die, or solve the spamming and crapflooding issues. Funny that someone else is thinking about this right now. It'll probably happen before I turn new signups back on." This of course begs the question: HIBT? If so I'll bite (see some considerations under the fold).
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
87414
A few of my previous columns discussed my vision of creating a more secure Internet. It involved replacing the Internet's default anonymity with pervasive authentication, from the hardware initialization, through the OS and all applications, the user, and ending with a verifiable network stream. It is my strong belief that without a complete overhaul of default authentication, malicious hacking is going to continue indefinitely.
461240
And Vint Cerf drops us a line Letters We at El Reg are used to hobnobbing with the cream of internet high society [er, we are? - Ed], so we were not surprised at all when one of the Founding Fathers dropped us a note in response to an article we'd written about the threat of botnets, as highighted to the World Economic Forum. So used to it, in fact, that we thought we'd run it as our headline letter on Letters this fine Tuesday.â¦
553001
Denial-of-service attacks, which take down a Web resource, are used by digital blackmailers. Part of a series on hot security topics.