Apparently not! On December 20, a new zero-day exploit for Microsoft Windows operating systems was released. This exploit targets a weakness in the Client Server Run-Time Subsystem, and allows local privilege escalation or denial of service. Microsoft has acknowledged this vulnerability and admitted that its newest operating system, Windows Vista, is vulnerable. Keep reading for Read more…
As we see every year, Christmas season is a great opportunity for a new virus to spread by email using “Christmas” as a reason to read the email. We just had a post here on Avert Labs blog about one a few days ago. If it was just the spammers, we could understand, since they Read more…
Tags: bueno, pedro bueno
In the “good old days” spammers aggressively scanned the Internet for open relay servers to send spam. Open relays are out of fashion these days. So much so that the Open Relay DataBase is shutting down due to changes in spammer tactics. Today’s spammers, in collusion with malware authors, infect thousands of machines on the Read more…
Tags: labs, McAfee Labs, vinoo thomas
I was quite intrigued, recently, by a question posed by the author of Securosis.com and his answer: “So how do you build the mindset? You immerse yourself in security, and I don’t mean the job. Don’t read books on cryptography, go read some quality spy novels and security tales with ultra-paranoid protagonists that consistently improvise Read more…
Technologies advance with time, and so is the case with Instant Messengers. Not long ago, people were happy sending text messages. Then VoIP came along and changed the scene. Soon after IM vendors embraced it. Many IM clients are now VoIP enabled. As soon as VoIP started going deeper into the mainstream, security researchers warned Read more…
Inside the Trojan family, password stealers (abbreviation : PWS) are dedicated to monitoring some of your keystrokes. They collect confidential information like Internet logins. Depending on the data collected, an attacker is then able to access your bank, e-commerce, game or social networking website account for the purpose of fraud or other criminal activities. McAfee Read more…
In the week leading up to 12 December 2006, two new Microsoft Word zero-day vulnerabilities became public (Word I, Word II). Microsoft’s December Patch Tuesday fell on December 12, but this cocktail of Microsoft’s patches did not include fixes for the two new Word flaws. To make matters worse, on December 12, a third zero-day Read more…
Responding to a post on the Layer 8 IT security blog about how those setting IT security policies should be within the IT organization, Riskanalys.is has a post saying that IT risk management people belong outside of an IT group. The thinking is that IT isn’t well enough respected, to some degree. It’s not seen Read more…
Some helpful soul has decided there isn’t enough Symbian spyware in the world. A Russian malware author has released a prototype of SMS forwarding spyware, SymbOS/Htool-SMSSender.A.intd. He’s included the source code to aid in modification. The author, let’s call him Scripty, says that SymbOS/Htool-SMSSender.A.intd can: Hide from the user Load on startup Copy the text Read more…
This Patch-Tuesday, Microsoft patched 11 vulnerabilities. Among the patched vulnerabilities are two that can be remotely exploited by an anonymous user, MS06-074 SNMP Buffer Overflow Vulnerability and MS06-077 Remote Installation Service Vulnerability. The Windows SNMP Service and Remote Installation Service are not default installed which greatly reduces the attack surface. The vulnerability in Visual Studio, Read more…