Google: Attack code more likely on Microsoft IIS
88443
A study by Google's team of anti-malware researchers finds that Web sites running Microsoft's IIS Web server software are twice as likely to be hosting malicious code as Web sites hosted by other servers.
734135
Google's search appliances could expose Web sites that use the products to information-stealing phishing attacks.
567801
A newly found vulnerability in Microsoft's Internet Explorer browser could allow an attacker to take over a targeted machine -- even one with all its patches up to date.
632521
Better install Microsoft's latest patches--hackers have posted attack code to exploit the flaws in Works.
744409
Security researchers release code that shows how a pair of widely used technologies could be misused to take control of a victim's Web browsing experience.
391310
Internet Security Systems' intrusion prevention software on Crossbeam Systems security switches.
97618
Code that claims to partially exploit a weakness in Microsoft software&#39;s handling of image files has been published on the Internet.
95664
A attack on Windows machines that uses Internet Explorer and a vulnerability in a RealPlayer ActiveX control is spreading in the wild, and researchers say the situation is urgent.
754347
Hacker web sites are claiming to have posted proof-of-concept exploit code for the latest critical Microsoft Corp software vulnerability, which is sometimes a precursor to broader attacks using a worm.
211846
The Web is scarier than most people realize, according to research published recently by Google.The search engine giant trained its Web crawling software on billions of Web addresses over the past year looking for malicious pages that tried to attack their visitors. They found more than 3 million of them, meaning that about one in 1,000 Web pages is malicious, according to Neils Provos, a senior staff software engineer with Google.These Web-based attacks, called &quot;drive-by downloads&quot; by security experts, have become much more common in recent years as firewalls and better security practices by Microsoft have made it harder for worms and viruses to directly attack computers.In the past year the Web sites of Al Gore&#39;s An Inconvenient Truth movie and the Miami Dolphins were hacked, and the MySpace profile of Alicia Keys was used to attack visitors.Criminals are getting better at this kind of work. They have built very successful automated tools that poke and prod Web sites, looking for programming errors and then exploit these flaws to install the drive-by download software. Often this code opens an invisible iFrame page on the victim&#39;s browser that redirects it to a malicious Web server. That server then tries to install code on the victim&#39;s PC. &quot;The bad guys are getting exceptionally good at automating those attacks,&quot; said Roger Thompson, chief research officer with security vendor Grisoft.In response, Google has stepped up its game. One of the reasons it has been scouring the Web for malicious pages is so that it can identify drive-by-download sites and warn Google searchers before they visit them. Nowadays about 1.3 percent of all Google search queries list malicious results somewhere on the first few pages.Some of the data surprised Provos.&quot;When we started going into this, I had the firm intuition that if you go to the sleazier parts of the Web, you are in more danger,&quot; he said.It turns out the Web&#39;s nice neighborhoods aren&#39;t necessarily safer than its red-light districts.&quot;We looked into this and indeed we found that if you ended up going to adult-oriented pages, your risk of being exposed [to malicious software] was slightly higher,&quot; he said. But &quot;there really wasn&#39;t a huge difference.&quot;&quot;Staying away from the disreputable part of the Internet really isn&#39;t good enough,&quot; he noted.Another interesting finding: China was far and away the greatest source of malicious Web sites. According to Google&#39;s research, 67 percent of all malware distribution sites are hosted in China. The second-worst offender? The U.S., at 15 percent, followed by Russia (4 percent), Malaysia (2.2 percent), and Korea (2 percent).It costs next to nothing to register a Web domain in China and service providers are often slow to shut down malicious pages, said Thompson. &quot;They&#39;re the Kleenex Web sites,&quot; he said. Criminals &quot;know they&#39;re going to be shut down, and they don&#39;t care.&quot;Malicious site operators in China fall into two broad categories, Thompson said: Fraudsters looking to steal your banking password, and teenagers who want to steal your World of Warcraft character.So how to stop this growing pestilence?Google&#39;s Provos has this advice for Web surfers: Turn automatic updates on. &quot;You should always run your software as updated as possible and install some kind of antivirus technology,&quot; he said.But he also thinks that Webmasters will have to get smarter about building secure Web sites. &quot;I think it will take concentrated efforts on all parts,&quot; for the problem to go away, he said.
164552
Blog: Although rare, a sophisticated attacker could perform a man-in-the-middle attack using Google Desktop.
240803
(InfoWorld) - It has become a familiar pattern: A hacker posts exploit code to a security Web site; Microsoft follows soon after with a warning to customers. The pattern was repeated again Thursday, only this time Microsoft's warning that it is investigating "new public reports" of a critical bug in Windows comes more than two months after sample code showing how to take advantage of the flaw was posted to the Web. Microsoft's advisory can beÂ found here. The flaw that Microsoft warned about is in an ActiveX control (called WebViewFolderIcon) used by the Windows' graphical user interface software. It was first disclosed on July 18 as part of aÂ month-longÂ project byÂ hacker HD MooreÂ to expose problems in browser software. Moore's blog post on the flaw can beÂ found here. Moore called his project theÂ "Month of Browser Bugs"Â and ended up disclosing a total of 22 Microsoft vulnerabilities during the period. A few days ago, Moore quietlyÂ added exploit codeÂ for this latest flaw to his Metasploit hacking tool. The exploit caught Microsoft's attention after it was posted to theÂ milw0rm.com Web site,Â Moore said. But the security researcher believes that any competent hacker could have developed an exploit based on his July blog posting. So far, Microsoft has patched only two of Moore's flaws. In fact, Microsoft engineers haven't even been able to investigate close to a third of the vulnerabilities, Moore said. Microsoft executives could not immediately be reached for comment, but the company's security advisory said this latest WebViewFolderIcon bug will be patched on Oct. 10. "We have been in contact with HD Moore and at this time our investigations have revealed that most issues relating to Internet Explorer in particular will result in the browser closing unexpectedly," Microsoft's public relations agency said Thursday in a statement. "Because of their nature, most of these issues will more likely be resolved through a service pack release rather than a security update." Microsoft has been busy this month, rushing out an emergency, "out-of-cycle" fix for a flaw in Internet Explorer's Vector Markup Language (VML) rendering engine that was being widely exploited by attackers. Microsoft has even more work ahead of it, according to Moore. In early August, he handed Microsoft another 70 bugs that he had not publicly disclosed. Still, he believes that more of his flaws should have been fixed by now. "I was kind of amused that they would do an out-of-cycle patch for the VML bug, but would let all of these lapse," he said. Microsoft has told him that at least four of his bugs are "exploitable issues," meaning that an attacker could take advantage of them to run unauthorized software on a victim's computer, Moore said. Earlier this week, SymantecÂ said that Microsoft was the slowest of the major browser-makers at patching its bugs during the first half of this year. But according to Symantec's numbers, Microsoft patched IE bugs, on average, nine days after the public disclosure of a flaw. Most of the 22 Month of Browser Bugs flaws have been in public for two months now.
625347
(InfoWorld) - Security experts are finding an increasing number of Web sites hosting malicious JavaScript code firstÂ detected on Super Bowl-related sitesÂ last week. Sites covering topics ranging from health care to government have been hacked to host the JavaScript, SANS Internet Storm Center Director Marcus H. Sachs wrote on the SANS blog, listing some of the hacked sites. "System administrators might want to check their network flow logs for any traffic to these sites and for any traffic to the five sites that hosted the hostile JavaScript," Sachs wrote. The attack targets two known vulnerabilities in Microsoft's Windows operating systems, for which patches were issued in April and January. Computers with unpatched software are vulnerable to the attack. If one of the hacked sites is visited, the JavaScript code directs the browser to a second Web server, based in China, and tries to install a Trojan Horse downloader and password-stealing program on the victim's computer. Initially, the exploit appeared isolated to Web sites related to U.S. football, as hackers tried to capitalize on the surge of traffic to sites concerning the Super Bowl sporting event, which was played on Sunday. The site of the Miami Dolphins team, and another site for its stadium, were hacked, although they were eventually cleaned up. Security company WebsenseÂ reported the problem on the stadium site on Friday. Websense recommended that users stay away from the affected sites until they had been cleaned up. Â
22770
Unpatched Windows machines are vulnerable to latest adware attack
216335
A vulnerability in AOL's instant messenger could allow attacks. Also: A new Bagle variant rumbles across the Net.
86299
Plus: Is Microsoft search engine crawling Google? [News.com Extra]
729334
(InfoWorld) - A vulnerability in Microsoft Internet Explorer (IE) browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday. The flaw lies in the way IE7 processes a locally stored HTML (Hypertext Markup Language) error message page that is typically shown when the user cancels the loading of a Web page, said Aviv Raff, a security researcher based in Israel. The error message tells the user that "navigation to the webpage was cancelled," and offers the user the opportunity to "refresh the page." If the refresh link is clicked, IE can be tricked into displaying the wrong Web address for a page. Raff has published proof of concept code that shows how IE can be made to display a Web page on his Web site as if it is from the cnn.com domain. This flaw could be exploited by phishers who want to make their spoofed Web sites appear legitimate, Raff said. "I can inject a script that will display anything I want in the page when the user clicks the 'refresh' link," he said via instant message. "Combining this with the design flaw, an attacker can render in the browser whatever he wants with whatever URL he wants in the address bar." This type of bug is known as a cross-site scripting vulnerability. It affects IE 7 on Vista and Windows XP, Raff added. Microsoft could not immediately confirm Raff's findings, but the company issued a statement saying that it is investigating the issue and is "not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time."