SecurityWeek

The denial-of-service toolkit used against financial institutions late last year has also been used against hosting and energy companies, DDoS protection firm Prolexic said in an advisory Thursday.

Google on Thursday said that late on Christmas Eve, they detected and blocked an unauthorized digital certificate created for the "*.google.com" domain that had been issued by an intermediate certificate authority (CA) which linked back to Turkish certificate authority, TURKTRUST.

Certainly we are no strangers to increased regulations, standards and internal policies, and the resulting audits that impact most organizations – often multiple times per year. While regulations and ensuing IT audits go beyond firewalls and firewall policies, these devices are often a good place to start when it comes to becoming "audit-ready" and gaining continuous visibility of what's going on in your network.

TEHRAN - Iranian forces have carried out what they called cyber warfare tactics for the first time as the Islamic republic's naval units staged manoeuvres in the key Strait of Hormuz, media reports said on Monday. The navy "launched a cyber attack against the computer network of the defensive forces in order to infiltrate the network and hack information or spread virus," the English-language Iran daily reported, quoting Rear Admiral Amir Rastegari.

Cisco remained the leader in the overall security appliance in the third quarter of 2012, according to the latest market numbers from International Data Corporation (IDC). Unified Threat Management appliances accounted for the majority of growth over the quarter.

PARIS - Armed robbers broke into an Apple store in central Paris on New Year's Eve and made off with about one million euros ($1.3 million) in merchandise, police said.The four armed men broke into the shop behind the Palais Garnier Opera around 9:00 pm on Monday, about three hours after it closed.They overpowered an employee, leaving him lightly injured, and loaded the stolen goods into a truck parked near the store.

From hackers’ point of view, launching a successful attack, either malware based or through web application hacking, requires an investment in infrastructure. The infrastructure may take a physical form: Internet servers to host Command and Control servers (C2) and exfiltrated data, or be a logical asset: software hacking tools development, vulnerabilities research and stealth communication protocols definition.

SINGAPORE - Singapore police on Tuesday arrested a 13-year-old Indian boy for posting a Facebook message in which he allegedly threatened to bomb a luxury casino resort in the city-state. The unnamed boy vowed to take "a big big revenge", "spit everywhere" and "plant bombs on Marina Bay Sands", a major tourist attraction, on the day he leaves Singapore, according to The Straits Times.

SAN FRANCISCO - Facebook sidestepped a privacy gaffe on Monday by fixing a flaw that made it possible to snoop on private New Year's Eve messages sent using a "Midnight Delivery" service. Facebook took "Midnight Delivery" offline temporarily to patch a vulnerability pointed out by Britain-based blogger Jack Jenkins.

Microsoft has pushed out a tool to help users address a zero-day vulnerability affecting Internet Explorer.

Trend Micro has spotted a piece of malware in the wild targeting Java-based HTTP servers and Java Servlet containers. According to Trend Micro, the malware is disguised as a Java Server page (JSP). Once installed, it performs backdoor routines and gains control over vulnerable servers.

Microsoft has issued a security advisory, and confirmed reports that a zero-day vulnerability in Internet Explorer has been used in targeted attacks. One such attack was reported last week, when a drive-by download attack on the website maintained by the Council on Foreign Relations (CFR), leveraged the vulnerability to spread malware.

According to an Army spokesperson, 36,000 records maintained by CECOM (Communications-Electronics Command) and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR), were breached earlier this month by an unknown hacker or group of hackers.

In August, Kaspersky Lab started an initiative to get the public’s help in cracking the encryption used in the payload of the Gauss malware. On Friday, the Hashcat project lent their resources to the cause by releasing a tool to help crack Gauss’ verification hash.

BEIJING - China has approved new rules that require Internet users nationwide to provide real-name identification, state media reported on Friday, as the government increases its already tight online grip. The National People's Congress (NPC), the country's legislature, adopted the measures at a meeting on Friday, the official Xinhua news agency and other media said.

WASHINGTON - US authorities are probing allegations by Hewlett-Packard that a British software firm it bought out had fraudulent accounts, the US tech giant said in its annual report released Thursday. On November 20, HP reported a writedown of $8.8 billion, including more than $5 billion it attributed to inflated data from Autonomy, acquired by HP in 2011 for more than $10 billion.

Get Off The Bench And Look Into Your Virtual Environment Free Forrester Research White Paper

A new ransomware scam has taken an interesting twist – rather than simply demanding payment, the attackers want the victims to fill out a survey. It is a new tack for a scam that traditionally relies on threats and intimidation, and perhaps a foreshadowing of what is to come, noted Malwarebytes Malware Intelligence Lead Adam Kujawa.

A National Security Agency (NSA) program designed to discover security vulnerabilities at critical infrastructure companies is in full swing, according to documents reportedly obtained by the Electronic Privacy Information Center (EPIC).

Cybersecurity teams should focus on security resolutions rather than predictions.