Man In The Browser (MITB) Attacks

A new botnet named Feodo has been discovered. It doesn't seem to have much new about its internal workings, but the linked article gives a good description of how Man In The Browser attacks work.

Feodo rewrites specific banking app web pages in order to add input fields, such as PIN numbers and other personal information, that the bank wouldn't normally request on the unmodified version of the page.

Information Security Strategy Generator

I don't usually post sites with swearing all over them, but this one was too good to pass by.

The site whatthefuckismyinformationsecuritystrategy.com automagically generates realistic sounding security strategies. Just hit reload to generate a new one. They pay people good money to come up with these kinds of statements.

I got this: Monitor vendor access and restrict personal use of computing resources by removing admin rights on critical assets

Microsoft Hopelessly Battles with an Angry Dragon Inside Its Own Network

Ok, the headline is exaggerated, but only a bit.

Microsoft's squeaky-tight security was bypassed by hackers who subsequently used their uber-hardened servers to send spam about cheap viagra, penis enlargement, and other services that don't come with a dubious EULA. Oh, and they even launched an attack against an information security blogger.

I can't wait to hear the spin on this one.

Antivirus Companies Finally Do Something About Their Own Website Security

In an industry where security companies have gotten rich enough to practice what they preach, you'd expect them to be setting the example when it comes to secure coding practices. It's the age old story about the cobbler's kids wearing crappy shoes.

You would expect security companies to hire coders that have at least a basic knowledge to do their jobs securely. How is it that so many such company websites would be afflicted with something as blatant as Cross-Site Scripting flaws? What makes this worse is that some of these companies offer secure web hosting, and post bulletins about other company's security issues! Someone isn't doing their homework.

Some of the companies that should know better: Symantec, Eset, and Panda.

Tired of the crap "news" websites are posting about Stuxnet?

F-Secure has posted a bit of a FAQ to help people interested in understanding the Stuxnet worm issue to get more realistic information, versus the omg-CNN-style garbage that has been going around so far.

Is it targeting Iranian nuclear plants? We don't know.

All this conjecture reminds me of the days when hundreds of STONED virus variants were running rampant, and McAfee started pretending they were totally different, and gave them fancy names just to make them sound like different beasts. (for example, Michelangelo). The same virus, with 2 or 3 lines changed suddenly became a totally amazing technological advance hell bent on the worse possible destruction. Just sayin...

Blackberry Encryption Cracked

Elcomsoft, the overseas infosec group who seem to be able to break into just about everything, have now cracked the Blackberry encryption mechanism.

It seems like only yesterday when certain freedom-free countries were complaining that they couldn't read Blackberry messages sent by their own hostile population.

Only 1.7% of sites blocked by Scandinavia's "child-porn" filters are actually child porn

It seems that most of the sites on the anti-kiddyporn filters are simply fake. As well, they found that simply reporting sites that have kiddy porn, instead of blocking and ignoring them, got them immediately removed at the ISP level.

Which leaves the author of this story wondering what the list is for in the first place, since it is so easy to get the sites removed.

This is the same type of lip service that has been keeping the antivirus industry alive for years. It doesn't matter that 90% of the functionality claims are useless for absolutely everything except marketing.