Warcraft gamers locked out after Trojan attack
595297
Keylog catastrophe Keylogging scammers are once again laying siege to World of Warcraft gamers.â¦
431543
Con-pensation Chinese PC users whose machines were crippled by a dodgy software update from Symantec have two weeks to apply for compensation. The company has announced that the 50,000 users affected by the error are entitled to some free Norton anti-virus licenses.â¦
86222
In brief Exploit circulating for unpatched vuln
567405
Who guards the guards? Hackers planted malicious script on the site of an Indian anti-virus firm this week. The website of AVsoft Technologies was attacked by unidentified miscreants in order to distribute a variant of the Virut virus.â¦
259444
A new computer virus is catching people out by coming back from the dead.
244224
Computers running Microsoft Windows XP can be infected by a new Trojan horse, program remotely controlled in a victim&#39;s system, even after it is patched with Microsoft&#39;s
656315
Unknown DDoS tool, predecessors A deluge of Trojan-laced spam that slyly tricked recipients by promising information about winter storms ravaging Northern Europe last month was even more crafty than we thought.â¦
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
626410
It's warcraft out there Online games have become a major target for fraud in recent years. A study from Kaspersky Labs, published today, dissects the techniques and targets used by hackers to make "easy money" by selling stolen login credentials of users or in-game items on the black market.â¦
510748
A group of software engineers with ZERT has issued what it characterizes as an interim patch for the VML exploit, possibly closing the door to a new series of Trojans. In so doing, a new group resurrects some old questions about whether third parties should be trusted to patch Microsoft products.
23696
A quarter of all Net-connected PCs could become infected by Trojans, Vint Cerf tells World Economic Forum attendees.
105455
Blizzard makes noises about cracking down on real-money sales of items from the virtual World of Warcraft, but such transactions may impossible to stop. By Daniel Terdiman.
236872
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.The malware, called Trojan.Mebroot by Symantec, installs itself on the first part of the computer&#39;s hard drive to be read on startup, then makes changes to the Windows kernel, making it hard for security software to detect it.Criminals have been installing Trojan.Mebroot, known as a master boot record rootkit, since mid-December, and were able to infect nearly 5,000 users in two separate attacks, staged on Dec. 12 and Dec. 19, according to Verisign&#39;s iDefense Intelligence Team. In order to install the software on a victim&#39;s computer, attackers first lure them to a compromised Web site, which then launches a variety of attacks against the victim&#39;s computer in hopes of finding a way to run the rootkit code on the PC.Once installed, the malware gives attackers control over the victim&#39;s machine.The group behind this latest rootkit is the same one responsible for the Torpig Trojan, and it is believed to have already installed more than 250,000 Trojan programs, iDefense said in a report on the rootkit published Monday.The interesting thing about Trojan.Mebroot is that it installs itself on the master boot record (MBR). This is the first sector of the computer&#39;s hard drive and it is the place the computer goes to first whenever it wants to boot up the operating system. &quot;Basically, if you can control the MBR, you can control the operating system and therefore the computer it resides on,&quot; wrote Symantec researcher Elia Florio in a blog posting on Trojan.Mebroot.The criminals are using several different versions of this attack code, some of which are not currently being detected by some antivirus products, iDefense said.&quot;At the moment the AV detection is hit and miss across the board, however in the last day a number of vendors have added detection for it already,&quot; said Andrew Storms, director of security operations with nCircle Network Security. &quot;As for penetration, so far many people are showing it as having a low overall distribution. The concern is that the group which may be preparing to distribute the rootkit is well-prepared.&quot;Malicious software that infected the master boot record was common during the MS-DOS era, but it has not been used much in attacks in recent years.In 2005, however, researchers at eEye Digital Security gave a talk at the Black Hat security conference, showing how a rootkit could hide itself on the MBR. This Trojan.Mebroot software is derived from that code, iDefense said.Getting this kind of malicious software to work reliably is a technical challenge, and there have generally been easier ways for the bad guys to take over PCs in recent years, said Marc Maiffret, an independent security researcher who was chief technology officer at eEye when the code was first developed.Attackers were given a hand last year, however, when researchers at NV Labs published a proof of concept MBR rootkit.Maiffret said that while we may soon see more of these MBR rootkits, &quot;it won&#39;t take long for all the antivirus companies to react.&quot;&quot;It&#39;s not some new attack vector that&#39;s going to be hard to prevent,&quot; he said. &quot;It&#39;s just something that people haven&#39;t really paid attention to.&quot;
735246
Malware was being deployed as a Trojan Horse that attempts to disable anti-virus programs, modify registry keys, download additional files, and log keystrokes when connecting to banking websites.
128276
Passwords to popular online world Second Life may have been stolen in hack attack.
145834
Accessing the beta version of Yahoo Mail on a PC with Symantec's updated antivirus software incorrectly causes alarm bells to go off.
330830
Collateral damage A faulty signature update to CA's antivirus software created headaches for sys admins last week after the software falsely identified a Windows 2003 component as malware.â¦