SecurityWeek

A new variant of the DirtJumper malware has been discovered that is capable of launching even more powerful distributed denial-of-service attacks.

Researchers at FireEye have spotted a malware campaign using Google Docs to redirect victims and evade callback detection mechanisms. Connecting the malicious server via Google Docs, offers the malicious communication the protection provided by the legitimate SSL offered by Google, explained FireEye researcher Chong Rong Hwa.

Yahoo is taking action to clean up inactive accounts, but some fear they may be opening up a new door to clever attackers. On July 15, any Yahoo email account or Yahoo ID that has not been logged into for more than a year will be freed up  to be acquired by another user. The idea is to give Yahoo's "loyal users and new folks" the chance to sign up for the Yahoo ID they want.

In my previous SecurityWeek column, I wrote about Managing Security with the Business in Mind and discussed briefly the importance of taking an application-centric approach to security policy management.

Scammers are using fake mug shots as part of an elaborate campaign to steal identities from unsuspecting individuals, the Federal Bureau of Investigation warned.

STOCKHOLM - A Swedish court Thursday sentenced the co-founder of file-sharing site The Pirate Pay to two years in prison for hacking into the servers of a company managing data for Swedish authorities and banks.

PARIS - France on Thursday threatened Google with a fine of up to 150,000 euros ($198,000) if it does not bring its privacy procedures into line with French law on data protection within three months.

Trustwave this week unveiled new security information and event management (SIEM) software designed to help businesses better defend against security threats that put sensitive data and operations at risk.

The NSA is tapping into our digital lives, monitoring voice calls, emails, social media, and who-knows-what-else. It’s for national security, say those on the side of the NSA; it has stopped terrorist plots already and will stop more.

During his talk earlier this month at RSA Conference Asia Pacific 2013, Alexander Polyakov, CTO of ERPScan, disclosed that there are thousands of unpatched and thus insecure SAP deployments online today, all over the world.

Craig Heffner, a vulnerability researcher for Tactical Network Solutions in Columbia, MD, is returning to Black Hat this summer with a presentation that will include a proof-of-concept attack against network surveillance cameras that is usually reserved for the movies.

On Monday, Government Security News’ (GSN) Editor-in-Chief Jacob Goodwin told readers that the site had been the victim of a cyberattack, which was targeting visitors to the site with malware. As it turns out, more than 60 other sites were victimized by the same attack.

Microsoft Dangles “Mitigation Bypass Bounty” of $100,000 for Exploit Techniques That Can be Used Against Windows

Russia and the United States have agreed to cooperate on cybersecurity issues in order to prevent an accidental cyberwar between the two countries.

Security Firm Raises $11 Million To Help Combat Bank Phone Fraud and Improve Enterprise Call Center Security

The structure of today’s enterprise organization security operations must evolve to compete with the growing threat landscape and sophistication of adversaries.

Risk I/O, a vulnerability intelligence platform designed to help organizations efficiently report and mitigate security vulnerabilities, on Wednesday announced that it now analyzes real-time, global attack data alongside security vulnerabilities.

After analyzing many of the most popular WordPress plugins, researchers found many of them contained serious security vulnerabilities.

Oracle pushed out patches for 40 security vulnerabilities in Java SE today. Virtually all of the vulnerabilities can be exploited over a network without authentication, and four of the bugs are applicable to server deployments of Java, according to the company.

Researchers have found the source code for the Carberp Trojan on sale in underground forums. A person using the name "madeinrm" announced that the Carberp source code was available for sale, Group-IB researchers told SecurityWeek.