Exploit code found served from popular advertising site
524524
An attack utilizing a vulnerability in an ActiveX control for the popular RealPlayer media program may be spending in a more more dangerous fashion than anyone realized. Exploit code for the vuln has been found embedded in ads served up from a popular advertising site.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
256319
Saddling up money mules Popular UK-based free ads website Adzooks is inadvertently helping fraudsters by failing to properly screen job offers for obvious cons, anti-fraud activists have warned.â¦
189807
Browser flaw may leave you vulnerable to phishing attacks.
737101
Dubbed MyDoom.AH by security firms, this latest variant in the MyDoom family of worms is exploiting the recently publicised vulnerability in Microsoft Internet Explorer&#39;s (IE) IFRAME buffer overflow.
408824
Well, if you haven&#39;t patched your PC yet, now is the time. A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the
599984
Blog: Security researchers found PHP exploit code embedded in a GIF on a major image hosting site, slipping through the proverbial gates with the aid of a legitimate image at the beginning of the file, according to security researchers.
517744
A vulnerability that McAfee Avert Labs first warned about last week is now being exploited in the wild, according to VeriSign&#39;s iDefense. At issue are embedded objects in Rich Text Format (RTF) files.
259358
Malicious hackers tout a site with an strip show download to entice victims to download malware.
740908
Danish security research firm Secunia has reported a vulnerability that occurs in most browsers that can be exploited by hackers looking to spoof the content of Web sites.
365486
A security company has identified a Trojan horse program that replaces Google text advertisements on Web pages with ads from another source, depriving Google of revenue and potentially causing problems for end users.Google may be powerless to stop the trick since it involves the modification of an internal PC file, called the hosts file, that is used to match domain names of Web sites with IP (Internet protocol) addresses, said Romanian security company BitDefender.When a person visits a Web site, the browser checks the hosts file to see if it has an IP address for a particular domain name. If the hosts file is corrupted or hijacked, the browser can be directed to fetch a different Web page than the one the user intended to.Modifying the hosts file can be done for legitimate reasons. For example, PC users can change the hosts to block banner ads served from known ad networks. When a Web page tries to contact an ad server, the request is diverted by the hosts file and no ad appears.BitDefender said in an advisory this particular malware directs a browser to download advertisements from a different server than Google&#39;s ad server.BitDefender named the malware Trojan.Qhost.WU and said it is not spreading fast and poses a &quot;medium&quot; risk of damage. It did not say how the Trojan is being circulated, and company representatives did not return a call for comment.Besides costing Google ad revenue, there is a danger that those replacement advertisements could contain links to sites with malicious software, BitDefender said. Web site owners who buy ads through Google, as well as Google itself, can lose out on both Web traffic and revenue if people are diverted from its ads.There is not much that Google can do for those who download the malware. However, security products such as BitDefender&#39;s can detect and remove it.Without commenting on the Trojan specifically, Google said it removes Web sites from its search index that contain malware.&quot;We have canceled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles,&quot; the company said in a statement.
53629
Clicking the fraudulent update could install malicious code on your desktop.
719753
Thousands of websites have been infected with code that tries to install keylogging software, say security firms.
210359
Blog: Presence of exploit code puts pressure on Yahoo to fix the security flaws.
240803
(InfoWorld) - It has become a familiar pattern: A hacker posts exploit code to a security Web site; Microsoft follows soon after with a warning to customers. The pattern was repeated again Thursday, only this time Microsoft's warning that it is investigating "new public reports" of a critical bug in Windows comes more than two months after sample code showing how to take advantage of the flaw was posted to the Web. Microsoft's advisory can beÂ found here. The flaw that Microsoft warned about is in an ActiveX control (called WebViewFolderIcon) used by the Windows' graphical user interface software. It was first disclosed on July 18 as part of aÂ month-longÂ project byÂ hacker HD MooreÂ to expose problems in browser software. Moore's blog post on the flaw can beÂ found here. Moore called his project theÂ "Month of Browser Bugs"Â and ended up disclosing a total of 22 Microsoft vulnerabilities during the period. A few days ago, Moore quietlyÂ added exploit codeÂ for this latest flaw to his Metasploit hacking tool. The exploit caught Microsoft's attention after it was posted to theÂ milw0rm.com Web site,Â Moore said. But the security researcher believes that any competent hacker could have developed an exploit based on his July blog posting. So far, Microsoft has patched only two of Moore's flaws. In fact, Microsoft engineers haven't even been able to investigate close to a third of the vulnerabilities, Moore said. Microsoft executives could not immediately be reached for comment, but the company's security advisory said this latest WebViewFolderIcon bug will be patched on Oct. 10. "We have been in contact with HD Moore and at this time our investigations have revealed that most issues relating to Internet Explorer in particular will result in the browser closing unexpectedly," Microsoft's public relations agency said Thursday in a statement. "Because of their nature, most of these issues will more likely be resolved through a service pack release rather than a security update." Microsoft has been busy this month, rushing out an emergency, "out-of-cycle" fix for a flaw in Internet Explorer's Vector Markup Language (VML) rendering engine that was being widely exploited by attackers. Microsoft has even more work ahead of it, according to Moore. In early August, he handed Microsoft another 70 bugs that he had not publicly disclosed. Still, he believes that more of his flaws should have been fixed by now. "I was kind of amused that they would do an out-of-cycle patch for the VML bug, but would let all of these lapse," he said. Microsoft has told him that at least four of his bugs are "exploitable issues," meaning that an attacker could take advantage of them to run unauthorized software on a victim's computer, Moore said. Earlier this week, SymantecÂ said that Microsoft was the slowest of the major browser-makers at patching its bugs during the first half of this year. But according to Symantec's numbers, Microsoft patched IE bugs, on average, nine days after the public disclosure of a flaw. Most of the 22 Month of Browser Bugs flaws have been in public for two months now.
36812
In a twist, security researchers have discovered a group of hackers who are exploiting a new category of victims -- aspiring Internet scammers.A Moroccan group called &quot;Mr. Brain&quot; is offering free phishing kits on a Web site hosted in France, said Paul Mutton, Internet services developer at Netcraft, a security company in Bath, England.The software packages make it easy to quickly set up a fraudulent Web site mimicking a known brand in order to trick people into divulging credit card details or bank account numbers. Templates for spam e-mail are also included, targeting brands such as Bank of America, eBay, PayPal, and HSBC.Mr. Brain&#39;s Web site lists the kits and what kind of details each one is capable of collecting, such as usernames, passwords or Social Security numbers. Netcraft posted screenshots on its Web site.But what the aspiring scammer doesn&#39;t know is that the phishing kits are designed to send any sensitive information that&#39;s collected back to e-mail accounts controlled by Mr. Brain, Mutton said.&quot;Obviously, that&#39;s why they are offering this stuff for free,&quot; Mutton said. &quot;I was impressed by it.&quot;Mr. Brain hides the special e-mail function in a blend of PHP scripts, one of which is encrypted, Mutton said. Just in case someone decrypts it, Mr. Brain has written at the top of the file &quot;Don&#39;t need to change anything here. Created by Mr. Brain Morocco Team.&quot;The scheme seems to be targeted at new phishers, Mutton said. Mr. Brain benefits since other wannabe scammers shoulder the cost and risk of finding an ISP (Internet Service Provider) to host the phishing site, Mutton said.&quot;Essentially, they&#39;re exploiting all these novice phishers -- basically getting them to do all the hard work,&quot; Mutton said.It&#39;s difficult to tell without further research how many of the free phishing kits linked with this latest scam are live on the Internet, but Mutton said Netcraft noticed one earlier this month targeting Bank of America.&quot;Clearly, these are actively being used in phishing attacks,&quot; Mutton said.
223591
Security researcher demonstrates a way to use cross-site scripting to remotely spam an internal network printer.