NIST IT Security

NIST Site Search

Product Research

Advertise on this site

Headlines

US-CERT Current Activity

»	Malicious Email Campaign Circulating
»	Microsoft Releases Advance Notification for September Security Bulletin
»	Cisco Releases Updates for Wireless LAN Controller
»	Mozilla Releases Firefox 3.6.9
»	Apple Releases Safari 5.0.2 and 4.1.2
»	Apple Releases iTunes 10
»	Google Releases Chrome 6.0.472.53
»	Insecure Loading of Dynamic Link Libraries in Windows Applications
»	VMware Releases Updates for ESX Service Console Packages
»	Cisco Releases Security Advisory for IOS XR Software Border Gateway Protocol

Date published: not known
Details

DOE-CIRC Updates

»	T-434: Security update available for Shockwave Player Security update available for Shockwave Player
»	T-433: Security Advisory for Adobe Reader and Acrobat Security Advisory for Adobe Reader and Acrobat
»	T-432: Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code Google Chrome Multiple Flaws Let Remote Users Execute Arbitrary Code
»	T-431: Linux Kernel Null Pointer Dereference in irda_bind() May Let Local Users Gain Elevated Privileges Linux Kernel Null Pointer Dereference in irda_bind() May Let Local Users Gain Elevated Privileges
»	T-430: Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code Apple QuickTime Flaw in QTPlugin.ocx ActiveX Control Lets Remote Users Execute Arbitrary Code
»	T-429: WaspTime MS-SQL Database instance with blank password for sa account WaspTime MS-SQL Database instance with blank password for sa account
»	T-428: Vulnerability in Help and Support Center Vulnerability in Help and Support Center
»	T-427: VMWare WebAccess Vulnerability VMWare WebAccess Vulnerability
»	T-426: Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability
»	T-425: Desktop Java running in web browsers Desktop Java running in web browsers
»	T-424: Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service Windows TCP/IP Stack IcmpSendEcho2Ex() Bug Lets Local Users Deny Service
»	T-423: Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution Microsoft Security Advisory (2269637) - Insecure Library Loading Could Allow Remote Code Execution
»	T-422: Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability Adobe Flash Player and AIR (CVE-2010-2216) Unspecified Memory Corruption Vulnerability
»	T-421: Multiple CACTI Security Vulnerabilities Multiple CACTI Security Vulnerabilities
»	T-420: Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability Microsoft Windows TCP/IP IPv6 Extension Header Remote Denial of Service Vulnerability

Date published: not known
Details

Virus Bulletin news

»	September issue of VB published The September issue of Virus Bulletin is now available for subscribers to download.
»	ARF published as IETF standard Abuse report format helps auto-handling of email complaints
»	Microsoft releases new fix for DLL vulnerability Earlier workaround believed to be too complex for most users.
»	Malicious tweets link to fake TweetDeck update Twitter resets passwords for accounts that appear to have been hacked.
»	94% of Internet users befriend unknown 'good-looking woman' Sensitiva data shared after two-hour chat.
»	Investment boost for Quick Heal Indian security firm gets hefty cash injection.
»	41% of spam sent via Rustock botnet Botnet spam back after short summer break.
»	Avast gets $100m investment boost Growth equity firm invests in Czech firm
»	Computer chip giant buys AV giant Intel becomes new owner of McAfee for the princely sum of $7.8bn

Date published: not known
Details

DarkReading - All Stories

»	SHould SMBs Invest In Cyber Risk Insurance? Experts say the right cyber risk insurance policy could save even small enterprises from catastrophi ...
»	NSS Labs To Open Marketplace For Buying And Selling Exploits No zero-days on 'Exploit Hub'
»	Fraud At Sprint Offers Lessons For Enterprises, Experts Say Insider attacks leading to Sprint phone fraud might have been prevented with a few simple practices, ...
»	Forensics Out Of Reach For Most Small To Midsize Organizations Software-as-a-service, managed forensics services needed
»	String Of Deals Shows Demand for Cloud-Based Authentication Acquisitions highlight how authentication-as-a-service is now part of identity and access management ...
»	Tech Insight: Retooling Vulnerability Scanning, Penetration Testing For IPv6 Traditional host discovery via network scanning won't work with IPv6, but alternative methods are av ...
»	Five Ways To Stop Mass SQL Injection Attacks The best practices for mitigating this popular form of attack often are not being deployed
»	IPv6 Transition Poses New Security Threats Next-generation IP protocol comes with more security as well as some potential flaws of its own ...
»	Networked Scanners Offer A Window Into The Enterprise, Researcher Says Emerging Web-based features make it possible to capture document contents remotely from networked sc ...

Date published: not known
Details

Newsfeeds

DarkReading - All Stories

SHould SMBs Invest In Cyber Risk Insurance?

Experts say the right cyber risk insurance policy could save even small enterprises from catastrophic losses

click to view
NSS Labs To Open Marketplace For Buying And Selling Exploits

No zero-days on 'Exploit Hub'

click to view
Fraud At Sprint Offers Lessons For Enterprises, Experts Say

Insider attacks leading to Sprint phone fraud might have been prevented with a few simple practices, experts say

click to view
Forensics Out Of Reach For Most Small To Midsize Organizations

Software-as-a-service, managed forensics services needed

click to view
String Of Deals Shows Demand for Cloud-Based Authentication

Acquisitions highlight how authentication-as-a-service is now part of identity and access management strategies

click to view
Tech Insight: Retooling Vulnerability Scanning, Penetration Testing For IPv6

Traditional host discovery via network scanning won't work with IPv6, but alternative methods are available

click to view
Five Ways To Stop Mass SQL Injection Attacks

The best practices for mitigating this popular form of attack often are not being deployed

click to view
IPv6 Transition Poses New Security Threats

Next-generation IP protocol comes with more security as well as some potential flaws of its own

click to view
Networked Scanners Offer A Window Into The Enterprise, Researcher Says

Emerging Web-based features make it possible to capture document contents remotely from networked scanners, researcher says

click to view
U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year

Small- to midsized businesses taking the biggest hit, experts say, but consumer banking customers could be next in the bull's eye

click to view
Product Watch: Verizon, VMware Team Up With Hybrid Cloud Service

New Verizon service offers private public-cloud option

click to view
Could USB Flash Drives Be Your Enterprise's Weakest Link?

The Pentagon last week conceded that a USB flash drive carried an attack program inside a classified U.S. military network. Could your company be next?

click to view
Delaware Contractor Mistakenly Posts Personal Data Of 22,000 Employees

State of Delaware contractor Aon mistakenly posts personal data of 22,000 retirees without randomization, officials say

click to view
IBM Corrects Unpatched Vulnerability Numbers After Google Challenge

X-Force Team at IBM revises data on vendors with most unpatched bugs in recent IBM X-Force 2010 Mid-Year Trend and Risk Report

click to view
Major Disruption of Pushdo Botnet Wasn't The Original Goal

Botnet's spam traffic cut by 80 percent

click to view
China, Taiwan Nab 450 Suspects In Biggest Fraud Raid Ever

Law enforcement authorities in China, Taiwan seize cash, fraud "manuals" from alleged telecom fraud ring

click to view
Four Best Practices For Tokenization

Going beyond Visa's best practices guide

click to view
Mariposa Botnet Operators Didn't Bite In 'Cookie-Stuffing' Offer

Ecommerce fraud technique siphons commission, referral fees from website affiliates

click to view
Careful With That Third-Party Web Widget

Smaller businesses are more likely to use third-party Web applications on their websites -- and they are less likely to scan such code

click to view
California Legislation Would Require Companies To Specify The Data Exposed In Breaches

New legislation sitting on Governor Arnold Schwarzenegger's desk raises issue of standard breach notifications

click to view
DNSSEC Will Drive Certificate Market

While DNNSEC will improve domain authentication, certificates still needed to verify the brand

click to view
Mobile Devices Threaten Enterprises From Within

Security researchers are focusing increasingly on mobile devices. The result: your next insider attack could come from a smartphone

click to view
United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says

Bug used in infamous 2007 defacement fixed, but additional SQL injection bugs remain

click to view
Tech Insight: Using Network Segmentation And Access Control To Isolate Attacks

The right network design can protect against hidden threats from embedded systems and rogue access points as well

click to view
Tiger Team Sends DHS Suggestions On How To Better Safeguard Patient Privacy

19-page letter recommends that the HIT Policy Committee adopt the guidelines set out in the Fair Information Practices

click to view
Intel To Purchase McAfee For $7.68 Billion In Cash

Security experts skeptical of hardware-based security strategy

click to view
Slideshow: Fashion Statements from DEFCON 2010

Tattoos, mohawks, sheep, and 'pimp' necklaces were just some of the scenes from the hacker conferences in Las Vegas earlier this month.

click to view
Researcher Cracks ReCAPTCHA

Homegrown algorithms for cheating Google's reCAPTCHA released earlier this month

click to view
Ferreting Out Rogue Access Points And Wireless Vulnerabilities

To comply with regulations, companies increasingly must scan their wireless networks -- a third of which have rogue APs or other insecurities

click to view
Mass Drive-By Attack Used Web Widget

Attack used a different spin on mass injection, targeted hosting provider Network Solutions Inc.

click to view
Inside Verizon's Insider Threat Data

Verizon Business' latest Data Breach Investigations Report shows insiders as a growing threat -- but increase comes from a selective data set

click to view
Six Healthcare Data Breaches That Might Make Security Pros Sick

Most of the healthcare industry's biggest recent IT security breaches could have been avoided, experts say

click to view
A Peek At The Next Version Of PCI

Clarifications but no big changes -- but that's what concerns some security experts

click to view
Small And Midsize Businesses Look For Ways To Cut Compliance Costs

Strapped for cash, SMBs seek strategies to achieve IT security compliance on a shoestring

click to view
Six Florida Colleges Victims Of Widespread Data Breach

SSNs, other personal data of students, employees were inadvertently exposed -- and viewed -- online

click to view
New Mobile Security Threat: Fingerprint Oil

Oily residue left on touchscreen mobile devices may help an attacker deduce password

click to view
Targeted Attack Nets 3,000 Online Banking Customers

Major financial institution's commercial and consumer customers bilked of more than $1 million so far

click to view
Healthcare Suffers More Data Breaches Than Financial Services So Far This Year

Lax handling of data, storage of it, and access to databases biggest culprit

click to view
Microsoft Investigates New Zero Day Reported In Windows Kernel

Windows 7 and Vista also contain this new heap overflow vulnerability, according to security researcher reports

click to view
Flawed Deployments Undermine Kerberos Security

Researchers find practical problems that can weaken secure authentication via popular Kerberos standard

click to view
Tech Insight: Building The Right Defense Against Social Engineering

DEFCON capture the flag contest shows that humans are still the enterprise's weakest security link

click to view
Social Engineers Successfully Gather Info

The Defcon18 contest worked well -- too well -- its organizers say

click to view
Slide Show: Barnaby Jack Hits The Jackpot With ATM Hack

Barnaby Jack, director of research at IOActive, at Black Hat USA in Las Vegas last week demonstrated attacks that would allow a criminal to compromise ATMs in order to steal cash, copy customers' ATM card data, or learn master passwords of the machines

click to view
Holy Zeus! Popular Botnet Rules As New Exploits Come Online

Researchers identify two new botnets, both built on Zeus botnet development kit

click to view
Cloud-Based Denial Of Service Attacks Looming, Researchers Say

Two consultants at DEFCON conference use a handful of virtual servers in Amazon's EC2 cloud to take down an SMB's network

click to view
Researchers Throw Down Vulnerability-Disclosure Gauntlet

TippingPoint's Zero Day Initiative (ZDI) program institutes deadline of six months for vendors to fix bugs -- or else the bugs get published

click to view
Majority Of IS Pros OK With Government Online Spying: Sophos

In addition, 49% think "crippling denial of service attacks against another country's communication or financial websites" is OK during wartime

click to view
Building Botnets For Fun And Profit

Creating a botnet business can be lucrative -- and isn't as hard as you might think, Black Hat speaker says

click to view
Ghost In The Machine: Database Weaknesses Expose SAP Deployments

Attacker can create a nearly undetectable user account in SAP once he or she gains unauthorized access

click to view
Researcher Reads RFID Tag From Hundreds Of Feet Away

Demonstration raises privacy and security concerns with RFID EPC Class 1 Generation 2 used in some passport cards, inventory tags, and drivers' licenses

click to view