SecurityWeek

TEHRAN - Iran blocked access to Google's popular and relatively secure Gmail service Monday amid first steps by the Islamic republic to establish a walled-off national intranet separate from the worldwide Internet. Access to Google's search page was also restricted to its unsecured version, web users in Iran found. Attempts to access it using the secure HTTPS protocol were also blocked.

Researchers at Symantec have discovered malware that has been written using Google’s Go programming language. Go was introduced by Google in 2009, two years after its initial design, and Symantec’s discovery seems to be the first time a malicious application has been found that was developed using the programming language.

Please join SecurityWeek and Symantec TODAY at 1PM ET / 10AM PT for an informational webcast on how you can protect your company's endpoints against the latest threats.

As promised, Microsoft has patched Internet Explorer against the recently disclosed Zero-Day that made headlines all week. In addition, they patched four other flaws that were privately disclosed, but unlike the main vulnerability, were not being exploited in the wild.

A security researcher from Application Security, Inc. (AppSec) has discovered a flaw in Oracle’s software that would allow an attacker to crack database passwords with basic brute-force attacks. Details of the attack were discussed on Thursday at the Ekoparty conference in Argentina.

The ZeroAccess rootkit used to be a problematic kernel-mode family of malware that was hard to remove; new versions of the malware itself have dropped the kernel-mode aspects. Now it operates entirely in user-mode memory. This shift in development has led Sophos researchers to dig deeper, and they found some interesting things.

New Guidance Provides a Starting Point and Template for Action as Industry and Government Work Together to Secure Industrial Control Systems in the Transportation Sector

The U.S. Attorney’s Office said on Wednesday that a former software engineer working for Chicago-based CME Group pleaded guilty to theft of trade secrets after he stole source code and other proprietary information from the company.

Zeus. Gauss. Stuxnet.

LOS ANGELES  — A 21-year-old man whose alleged Internet rant about killing children alarmed law enforcement authorities, leading them to knock down his door and arrest him, is being described by his own attorney as "just a dumb kid."

BEIJING - Despite several years of escalating diplomacy and warnings, the U.S. is making little headway in its efforts to tamp down aggressive Chinese cyberattacks against American companies and the government. U.S. Defense Secretary Leon Panetta, who is wrapping up three days of meetings with military and civilian leaders, said he has brought the issue up at every session and come away with little more than agreements to talk again.

New Tool Checks To See If MySQL Servers Are At Risk From The MySQL CVE-2012-2122 Vulnerability

Attackers can remotely login to a control system used by electric utilities and oil and gas companies via a backdoor to gain administrative access, according to the Department of Homeland Security.

Salesforce.com unveiled a new identity management to bring "Facebook-like" identity platform to the enterprise.

Cyber Espionage Attacks Hit Philippine Oil Company and Canadian Energy FirmResearchers from Dell SecureWorks’ Counter Threat Unit say they have discovered yet another cyber espionage campaign targeting oil and energy companies. 

Employees are increasingly turning to web-based or web-enabled applications to help get their jobs done. To combat the risks associated with these applications, one of the most significant evolutions in network security over the last few years has been the advent of application control. This technology gives administrators visibility and control over each application that is allowed to communicate on the network.

IBM's X-Force 2012 mid-year report found a sharp increase in browser-related exploits, Mac-based attacks, and SMS related scams. Since its last Trend and Risk Report, released at the beginning of the year, IBM's X-Force has seen an increase in malware and malicious Web activities, a disconnect in how corporations implement "bring your own device" (BYOD) programs, and increased concern in how users are selecting passwords to protect their various Web accounts.

MANILA - The Philippines said Thursday it had deported 279 Taiwanese accused of running a multi-million-dollar online scam that prompted stepped-up airport screening to guard against criminal gangs. The Taiwanese were put on two chartered flights on Wednesday to Taipei, where they face prosecution, immigration spokeswoman Antonette Mangrobang said.

On Wednesday, Microsoft released a FixIt tool for those wanting some automated protection from the latest Zero-Day for Internet Explorer. However, if users at home are using caution as they surf the Web, and organizations are being proactive, it might be easier to wait until Friday, when Microsoft will issue an out-of-band security update to their browser, fully addressing the problem.

Veracode Launches Vendor Application Security Testing ProgramApplication security testing firm Veracode on Wednesday launched an automated program to help businesses evaluate security risks associated with third-party software.