Contest seeks the most diminutive XSS worm
83482
Let the hacking begin Think you have a gift for writing compact code that replicates using one of the web's most vexing classes of security vulnerabilities? Then Security researcher RSnake (aka Robert Hansen) would like to hear from you. He has set up a contest to see who can write a self-propagating cross-site scripting (XSS) worm using the fewest number of characters.â¦
672973
Making use of the current trend to send festive greetings via email, a new virus is making the rounds. A variant of the ZAFI worm, the WORM_Zafi.
731797
This is really cool!  I finally get my own comment spam!  For some reason I felt left out of the party.  I just wasn't cool enough for the spammers to consider me worthy of their spam.  Anyway.  I implemented my own little turing test.  Now the comments say:  {{{  Turing Test: Are you a human? (required. Just type yes... this is for automated spam prevention)  }}}  While this wouldn't work for all blogs in the wild I'm sure it will work just fine here in my little corner of the blogosphere.  If spammers really want my blog enough then I'll deploy a captcha.  If they solve the captcha I'll deploy a sentient robot  which will traceroute packets back to the host and then terminate with prejudic ...
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
594361
A new version of the Download.ject worm has begun spreading on the Internet, according to security firm PivX.
420300
Introducing The 404s, a contest to find the least informative military websites. Strike a blow for open government; win prizes. In Danger Room.
526426
It may be a single malicious user with an axe to grind, and that user may be targeting a very small group of people who just happen to use Microsoft Excel. But whoever it is continues to make security firms like Symantec nervous, as yet another Excel-based document with a malformed image string, dubbed Trojan.Mdropper.Y, has turned up.
246281
Cal Evans and the Zend Developer Zone are hosting a new contest for all of the avid PHP readers out there - a giveaway for free PHP-related books.   There are a lot of good programming contests out there for PHP programmers to enter and win. Most of them require you to write a piece of code or solve a problem. There's nothing wrong with that but programmers are busy people. So I've come up with a contest for busy programmers. Give blog about PHP Abstract and you could win a free book. Not just any book though, these are programming books. (you know the ones, when you go to check out at your favorite book store they charge you by the pound.)   Entering the contest is simple - just blog about your favorite episode of PHP Abstract (DevZone's great podcast series) and get it tracked on Technorati.    Cal will scan the listings each week and pick the one he likes the best. He'll send along the book of his choice and will spring for the postage to send it along. Nice and easy - so check out their podcast series and find an episode you like the best (or just talk about it in general) and get it tracked.   Click here to subscribe to their podcast in your favorite feed reader.
467571
Lycos Europe has released a special screensaver for Windows and the Mac OS platforms that will attack spam web pages. The screensaver âMake Love No Spamâ will overload a variety of spam servers by flooding
376280
In circolazione una nuova variante del worm in grado di disabilitare il firewall integrato in Windows XP. Si propaga via e-mail. Eâ di nuovo allarme Bagle. Una nuova variante del noto worm si sta diffondendo
611270
A new version of the Santy worm appeared over the weekend and poses a broader threat than its ancestors. A new version of the Santy worm appeared over the weekend, and according to analysis done by some security
387344
On 20 November 2004, a major malicious-code attack emerged targeting European Web sites via banner ads. This two-step attack exploits two previously identified security vulnerabilities: the Bofra (or IFRAME
513309
News.com reports that a web worm named Santy is utilizing Google to help it spread to web bulletin boards using the PHP scripting language.
402521
Introducing The 404s, Wired's contest to find the least-informative sites on the military web. Strike a blow for open government (and win prizes).  In Danger Room.
86147
Anti-virus experts at Sophos have advised that a new Internet worm is defacing web bulletin boards across the globe. The Santy worm exploits a vulnerability in a piece of software often used to provide discussion
605079
A variant of the Zafi worm, Zafi.d, is doing the rounds disguised as a Christmas message. This worm arrives via email and through peer-to-peer networks bearing the message &quot;Happy Hollydays&quot; and the subject
235687
Three new MyDoom variants have been found in the wild that contain not only malicious code but a plea for a job. MyDoom U, V and W attempt to download a Trojan called Surila onto users&#39; computers, which would