Security

Malware and Vulnerabilities Topic Center

Get the latest news, advice and in-depth analysis on malware, including information on viruses, worms, Trojans and zero-day vulnerabilities

Microsoft to issue more critical patches next week for Win7 than XP

Microsoft today said it would deliver nine security updates next week, four of them critical, to patch 21 vulnerabilities in Windows, Internet Explorer (IE), Office, .Net and Silverlight.
Read more...

Citadel banking malware is evolving and spreading rapidly, researchers warn

A computer Trojan that targets online banking users is evolving and spreading rapidly because its creators have adopted an open-source development model, according to researchers from cyberthreat management firm Seculert.

Google Chrome will no longer check for revoked SSL certificates online

Google plans to remove online certificate revocation checks from future versions of Chrome, because it considers the process inefficient and slow.

Adobe sets IE as next target in Flash security work

Adobe next plans to tackle Microsoft's Internet Explorer in its ongoing work to "sandbox" its popular Flash Player within browsers, Adobe's head of security said today.

Kelihos botnet still dead, say Microsoft, Kaspersky

Contrary to reports, the Kelihos botnet has not crawled out of the grave, Microsoft said last week. But the company acknowledged that a new botnet is being assembled using a variant of the original malware.

Hundreds of DreamHost websites abused by spammers

Rogue PHP pages that redirect users to work-at-home scams have been added to hundreds of websites hosted at DreamHost following a security breach suffered by the company in January, researchers from cloud security vendor Zscaler said.

Facebook malware scam takes hold

A "worrying number" of Facebook users are sharing a link to a malware-laden fake CNN news page reporting the U.S. has attacked Iran and Saudi Arabia, security firm Sophos said Friday.

PHP 5.3.10 fixes critical remote code execution vulnerability

The PHP Group released PHP 5.3.10 on Thursday in order to address a critical security flaw that can be exploited to execute arbitrary code on servers running an older version of the Web development platform.

Google reveals Android malware 'Bouncer,' scans all apps

Google yesterday unveiled an automated system that scans Android apps for potential malware or unauthorized behavior, a move critics have long called the company to make.

Symantec warns of Android Trojans that mutate with every download

Researchers from security vendor Symantec have identified a new premium-rate SMS Android Trojan horse that modifies its code every time it gets downloaded in order to bypass antivirus detection.

Best Security Suites: PC Bodyguards

Have security suites reached the point where they all work?

How smarter hypervisor use can lead to a 'big, big change' in security

To gain insight on the months ahead as they relate to IT attacks, malware, cloud security, and the impact of virtualization on security, we recently chatted with Simon Crosby, former CTO of Citrix Systems' data center and cloud business. Crosby recently founded a cloud security startup, Bromium, with Guarav Banga, former CTO and senior vice president at Phoenix Technologies, and Ian Pratt, chairman of Xen.org and co-founder of XenSource.

Fundamental Oracle flaw revealed

A design decision made by Oracle architects long ago may have painted some of Oracle's largest customers into a corner. Patches have arrived, but how much will they correct?

2012 Outlook: The end of everything?

Gibbs reviews last year's predictions and sees that the end could be nigh ...

Flaw in web app frameworks pushes Microsoft to patch ASP.net promptly

Many web app frameworks are vulnerable to a denial-of-service attack targeting the way they handle hash tables, researchers revealed Wednesday, prompting Microsoft to announce an "out-of-band" patch for its ASP.NET platform just hours later.

How stupid can cell carriers be? Really Stupid.

The recent revelation that most of us are carrying around smartphones with embedded rootkits is both surprising and not so surprising. It's surprising because it makes you wonder, "How stupid can the carriers be?" It's not surprising in that we know the answer to that.

When Cybercriminals Attack

Criminal hackers are industrious -- they stay up late devising new ways to attack individuals and businesses. Watch out for cyberattacks that can turn smartphones into spam bots, shut off electricity to homes and businesses, jam GPS signals and more.

Stupid hacker tricks: Exploits gone bad

Taunting tweets, provocative pics, iPad-spam chats -- stupid slip-ups lead to high-profile hacker arrests

Hacktivism: The fallout from Anonymous and LulzSec Part 2

Caveat Vendor

Hacktivism: The fallout from Anonymous and LulzSec Part 1

Like the mutant offspring of Captain Jack Sparrow and French anarchist Pierre Proudhon -- famous for his 'property is theft' claim -- activist hacking group LulzSec surfed the Web spreading debonair charm, chaos and reckless acts of 'hacktivism' in equal measure.