Stormy April Fool’s Day
March 31, 2008 – 1:59 PMA wave of April Fool’s Day related Storm mails have just been sent out. Similar as the other times with a link that points to an IP address.
Top 10 Harmless Geek Pranks
March 31, 2008 – 1:24 PMSince the dawn of time, geeks have been playing harmless pranks on their beloved (but unsuspecting) associates, and it’s up to all of us to carry the torch forward. On the eve of April Fools’ Day, when you’ve got local network access to your coworkers’ and family systems, cubicles just crying out to be filled with packing peanuts, and webapps that can do all sorts of things automatically, there’s no better time to baffle, confuse, perplex, and just plain mess with your loved ones and associates. Hit the jump for our top 10 favorite harmless geek pranks, just in time to get your prankster pistons firing for tomorrow.
Shedding (Black)Light on the Master Boot Record
March 31, 2008 – 9:28 AMA while ago we blogged about the MBR rootkit, which has been getting attention from all the security vendors. We’re glad to inform you that the latest version of the F-Secure BlackLight standalone rootkit scanner now detects MBR rootkit infections.
BlackLight has stood the test of time ever since it was released in the beginning of 2005. A new rootkit technique that has been able to evade detection has been a very rare event. The MBR rootkit is quite different from other rootkits we’ve seen over the years, so we had to add completely new technology into BlackLight to detect it successfully.
You can download standalone BlackLight here.
Source: F-Secure
Wireshark 1.0 Released
March 30, 2008 – 6:15 PM“I’m proud to announce the release of Wireshark 1.0. This is the culmination of nearly ten years of hard work by a team of brilliant and talented developers. It is an honor to be able to work with these people.
On behalf of the development team, I would like to thank Wireshark’s user community for all of your enthusiasm and support over the years. Wireshark development will continue, and we have lots of great features to offer in the coming years.”
Phishers Use Google to Find Exposed Servers
March 30, 2008 – 1:51 PMThree-quarters of phishing sites are built on hacked servers that have been tracked down using pre-programmed Google search terms, according to research from brand-protection firm MarkMonitor.
Among other activities, MarkMonitor tracks phishing attacks that target brand names.
Researchers compiled a list of 750 Google search terms that are used to track down websites likely to have easily exploitable vulnerabilities — mostly PHP-based sites.
The search terms return a list of sites likely to have particular vulnerabilities; the attackers then exploit the vulnerability, gain access to the site, and then use it to host malicious code or counterfeit web pages as part of the scam.
MarkMonitor found that 75 percent of the phishing sites it had discovered had been originally tracked down using one of the list of 750 Google search terms. The finding was based on a sample of one-quarter of the phishing sites logged by the firm.
The search terms, called “Google dorks,” are actively traded on internet forums, and are routinely scanned by IRC-based “bots,” which also scan Yahoo and AOL Search results, according to MarkMontitor.
Google has already made moves to block automated exploitation of the “dorks,” but they can still be used manually.
The websites exploited tend to be small, local PHP-based sites, which are less likely to have the latest patches installed, and are invaded via one of more than 1,800 known PHP bugs, MarkMonitor said.
In the fourth quarter of 2007, 412 organizations were targeted by phishing attacks, up 37 percent from the same period in 2006, according to the firm’s Brandjacking Index, published last month.
Auction sites were the biggest targets, accounting for 44 percent of the phishing emails in the fourth quarter, up from 36 percent in the first quarter of 2007.
Source: PC World
