Stealthy attack serves malicious code only once
692013
A new malware strategy that involves tracking IP addresses to see when a machine has already been infected could prove vexing for those attempting to hunt down malicious code, according to Finjan. The new tactic is already turning up on compromised Web pages.
267647
The Banker-AJ trojan has been coded to lie dormant in the background on infected Windows PCs. When users visit legitimate online banking Web sites of certain UK banks, the malicious code is
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
391424
Adds what Symantec calls "threat interceptor" defense to prevent execution of malicious code enabled through a drive-by download.
292176
NBC muckraker outed at DEFCON &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
111823
Shared music abuse bug hits iTunes &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
551854
InfoWorld - A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
166352
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.
173750
Rinbot, the on-again, off-again threat that exploits a pair of long-patched vulnerabilities, may be back. But security researchers differ over how serious a threat it actually is.
16648
Opt-out button in spam used to run exploit
266160
Flaws in media players could automatically download malicious code, let hackers in.
22770
Unpatched Windows machines are vulnerable to latest adware attack
35029
Unpatched vulnerabilities may leave computers open to remote attacks.
524524
An attack utilizing a vulnerability in an ActiveX control for the popular RealPlayer media program may be spending in a more more dangerous fashion than anyone realized. Exploit code for the vuln has been found embedded in ads served up from a popular advertising site.
416558
Bot-net attacker gets three years for breaches &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
542850
A directory reversal within "flat" extensions could lead to system profile attacks.
337561
(InfoWorld) - A new hacking method is causing concern for the lengths it goes to avoid detection by security software and researchers. The attack involves a Web site that has been hacked to host malicious code, an increasingly common trap on the Internet. If a user visits one of the sites with an unpatched machine, it's possible that the computer can become automatically infected with code that can record keystrokes and steal financial data typed into forms. The new method, which uses special JavaScript coding, ensures that malicious code is only served up once to a computer that visits the rigged site, said security vendor Finjan. "These attacks represent a quantum leap for hackers in terms of their technological sophistication," according to the report. "Equally important, this minimizes the exposure of the malicious code to forensic analysis or security research, as there is just one opportunity for a visitor to actually see the code." After a user visits the malicious Web site, the hackers record the victim's IP (Internet protocol) address in a database. If the user goes to the site again, the malicious code will not be served, and a benign page will be served in its place, Finjan's report said. It's also possible for hackers to block exposure of malicious code for users in a particular country. Also, the hackers can identify IP addresses of crawlers used by search engines and reputation services, which evaluate the risk in visiting certain Web sites, and serve them legitimate content. These methods are used to avoid alerting security researchers. Hackers generally want their malware to be effective for as long as possible, but that window has increasingly been closed by faster reaction times from antivirus companies. For example, a huge spam run with a Trojan horse program -- one that looks harmless but isn't -- is usually quickly detected by antivirus companies, which issue updates for their software to detect the malware. However, the quantity of malicious code has moved security vendors to add other defenses to their software, such as the ability to detect when a new program is doing something suspicious, such as suddenly communicating with a remote server. It wasn't immediately clear how many Web sites may be using this style of attack. However, Finjan said it's an example of how hackers are raising the bar to mask their attacks on computers and steal data, such as bank details. "Large numbers of infected users means higher revenues for the attackers," Finjan said. Â