Google cyber-knight lances Microsoft for bug-hunter 'hostilities'

Top Google engineer Tavis Ormandy has slammed Microsoft for treating security bug hunters with “great hostility”.

He blasted Redmond's behaviour towards those who report vulnerabilities as he publicly revealed a new unpatched security hole in the Windows operating system - a bug that can be exploited to crash systems or gain administrator privileges. The vulnerable driver is present in "all currently supported versions" of Windows, according to the Googler...

......After documenting the bug, he posted his initial findings to the Full Disclosure mailing list, and published a complete dossier last week.

In a related post on his personal blog, Ormandy invited others to look into the flaw, before finishing the essay with trenchant criticism of Redmond's attitude towards computer security professionals...

...Vulnerability management specialists Secunia warned that the flaw discovered by Ormandy can be used to launch denial-of-service assaults or elevate a local user's privilege......

...“The vulnerability is caused due to an error within 'win32k.sys' when processing certain objects and can be exploited to cause a crash or execute arbitrary code with the kernel privilege,”....

..Click here to read more ....

CNN International Breached, Accounts Leaked, Fake Articles Claim to be Posted By @Reckz0r

A hacker who has been quite for some time now in headlines has come back out with a claim that they have hacked CNN’s international Edition website (http://edition.cnn.com/).

.....In the post comes a short statement which states that CNN has been hacked for false news reports and also makes further claims that they have published 4 fake articles, which i could not locate or distinguish on the site and the leak also comes with small amount of data leaked from the websites database with claims that anyone who can figure out the 4 fake articles is able to obtain the complete database from them (the hacker)....

.....The site breached as you can see is the International Edition site for CNN and the leaked data that has been published to paste bin is 9 administrator accounts with usernames, user IDs and encrypted passwords along with a list of database tables......

Click here to read more ...

DHS employees' info possibly compromised due to system flaw

"U.S. Department of Homeland Security employees have begun receiving notifications about a vulnerability that has inadvertently made their personal information potentially accessible to unauthorized parties.

The flaw was apparently found in the software used by a DHS vendor to process personnel security investigations and has been immediately addressed. "

There is no evidence that the information contained in the system - names, social security numbers, date of birth - were actually stolen or accesses at all, but potentially affected employees, contractors, inactive applicants, and former employees. ...


Click here to read more ....

A spotlight on grid insecurity

Drawing from responses from more than 100 utilities across America, a new report shows that the nation’s electric grid remains highly vulnerable to attacks from Iran and North Korea, or other threats like geomagnetic storms from solar activity.

The electric grid is the target of numerous and daily cyber attacks. One utility said that there were 10,000 attempted attacks each month, and others describe the level of potential incursions as “daily”, “constant”, “malicious” and “seeking to gain access to internal systems.”

...Most utilities comply with mandatory standards only, not additional voluntary ones, and do so unevenly. For example, while almost all utilities said they complied with mandatory Stuxnet standards, only 21 percent of industry-owned utilities, 44 percent of municipally- or cooperatively-owned utilities and 62.5 percent of federal entities reported compliance with voluntary Stuxnet recommendations that industry did not agree to mandate.

Most utilities have not taken concrete steps to reduce the vulnerability of the grid to geomagnetic storms and it is unclear whether the number of available spare transformers is adequate...

Click here to read more ....

Microsoft decrypts Skype comms to detect malicious links

.. Several independent researchers including security consultant Ashkan Soltani who was hired by Ars Technica confirmed that some of the URLs contained in chats were, indeed, accessed from an IP address belonging to Microsoft...

..encrypted communication must be decrypted in order for the links to be scanned, and according to its Privacy Policy, Skype can record and retain links and other content sent over Skype.

"There's a widely held belief—even among security professionals, journalists, and human rights activists—that Skype somehow offers end-to-end encryption, meaning communications are encrypted by one user, transmitted over the wire, and then decrypted only when they reach the other party and are fully under that party's control. This is clearly not the case if Microsoft has the ability to read URLs transmitted back and forth," points out Ars Technica's Dan Goodin.

Click here to read more

LulzSec cyber hackers jailed in Britain

Four online hackers who masterminded attacks against major global institutions, including Sony Pictures and the CIA, have been jailed in Britain. The sentencing judge criticized the group's quest for publicity.


The group hacked into Pentagon computers, crashed the website of the US Central Intelligence Agency (CIA), as well as targeting British institutions - including websites belonging to the National Health Service and the Serious Organized Crime Agency.
In one attack, the group targeted the website of Rupert Murdoch's The Sun newspaper, redirecting visitors to a spoof story that Murdoch had committed suicide. The group also carried out distributed denial of service (DDoS) attacks, using linked networks of up to one million computers to crash websites.


Click here to read more ....

Is Microsoft reading your Skype communications?

The question of whether Skype - a Microsoft subsidiary since May 2011 - allows U.S. intelligence and law enforcement agencies to access the communications exchanged by its users has still not been adequately answered by Microsoft...


That conclusion has been reached after The H's German associates at heise Security have been notified, and then independently confirmed, that every HTTPS URL sent over Skype gets checked from an IP address registered to Microsoft headquarters in the U.S...

When asked why that is, the company has replied that they are indeed accessing all sent URLs so that they could spot and remove spam and phishing links.

But the researchers remain unconvinced...


Click here to read more ....

Private messages of Bloomberg clients end up online

Private messages of Bloomberg clients end up online: "Mere days after Bloomberg News admitted that its journalists could access some client information via the company's financial terminals, it has been revealed that the company inadvertently leaked on the Internet over 10,000 private messages exchanged by its clients.

Financial Times reports that the messages in question were found by a unnamed financial markets professional via a simple Google search, and that they were online for a number of years, accessible to anyone who knew what to look for. After the FT inquired about them, they were taken down.

“This work was done with client consent, where emails were explicitly forwarded to us to a dedicated email account and released by the person responsible for the email so that we could conduct internal testing to improve our technology for the client,” a Bloomberg spokesman stated.

Click here to read more ....

Info-stealing Dorkbot worm spreading on Facebook

The Dorkbot worm, which first appeared in 2011 and has since been spreading via removable drives, IM programs and social networks, is currently targeting Facebook users.

The worm is delivered to potential victims via a chat message that appear to be coming from a friend and, at first glance, the link looks like it should take users to a regular JPG image file hosted on MediaFire...

According to Bitdefender, over 9,000 malicious links pointing to the malware have been detected in 24 hours, but Facebook is reacting quickly and blocking them.


Click here to read more

IT security jobs: What's in demand and how to meet it

The information security job market continues to expand. In fact, according to a report by Burning Glass Technologies, over the past five years demand for cybersecurity professionals grew 3.5 times faster than that for other IT jobs..

Employment in the occupational group that includes information security analysts is projected to grow 22 percent from 2010 to 2020, faster than the average for all occupations, according to Eric Presley, CTO at CareerBuilder

Read more: IT security jobs: What's in demand and how to meet it