SecurityWeek

In a letter to Senator John McCain, originally obtained by the Washington Post for a report published last Friday, General Keith Alexander, the director of the NSA and current commander of the U.S. Cyber Command, says that the U.S. should implement policy that would require hardened network defenses.

Context is Invaluable, and Lets you Understand What your Security Event and Alert Information Mean.

The Blackhole exploit kit has moved its ransom-based payloads forward from child porn and terrorism to copyright violations. The new theme from the crime kit is professionally developed and is mostly targeting users in Europe.The changeup from Blackhole was discovered by researchers at abuse.ch, the Swiss security blog. Briefly, the Blackhole exploit kit was launched in 2010 by developers in Russia. The kit targets various vulnerabilities, from Windows only, to Adobe’s Flash and PDF formats, and Java.

McAfee Targets Data Centers with Scalable 80 Gbps Next Generation Network IPS

On Tuesday, the PHP Group plans to release new versions of PHP in order to address the problems with a previous patch, which was intended to close a security problem. As SecurityWeek reported on Friday, the first patch released by PHP was easily bypassed.

Version 11.3 of Adobe’s Flash Player, due in June, will provide the same silent update feature currently available to Windows users to those running OS X. In addition, Adobe will also offer a new security enhancement to Firefox called protected mode.

WatchGuard Technologies, a Seattle, Washington-based provider of IT security solutions for business, today said its entire portfolio of content and network security products are now being offered as virtualized solutions.

CORE Impact Pro Release 12.3 Provides Enhanced Endpoint, Mobile, Web and Wireless Testing Capabilities

Solution Helps Consolidate Multiple ID Badges into a Single Secure Certificate-based Credential Digital security vendor Gemalto, on Monday launched Protiva MedSecure, a solution designed to help streamline identity verification for healthcare professionals.

DHS Warns of Cyber Attack Targeting Natural Gas Industry: Companies Requested Not To Take Action to Remove Attackers, Says Source

Joint Innovations from Intel and McAfee Help Address Cloud Security Challenges

Jared Wein, a Software Engineer at Mozilla, has come up with a rather clever security feature for Web browser plugins such as Flash – manual activation. The feature is currently only available in the nightly build of Firefox, but Wein expects it to be ready for Firefox 14.The manual activation is called “click-to-play” and once it is enabled, plugins will require an additional click – or manual activation – before rendering Web content. For example, videos on YouTube will require...

On Friday, security researcher David Emery reported the discovery of a problem within Mac OS X 10.7.3, which results in a user’s password being recorded to a log file in plain text.Emery explained that a debug switch in the current release of Lion was activated sometime before its release, resulting in the user’s legacy Filevault password being written to a log file in plain text. This log will remain on the system for several weeks, and anyone with read access...

Jericho Botnet Analysis: Infection, Persistence and Malicious FunctionsWe’ve talked a lot about modern malware as a concept, but I’d like to use this week’s column to call out one particular sample of malware that I’ve had my eye on for the last several weeks – a new banking botnet that has been referred to as the Jericho Botnet.

CVE-2012-0779 Used in Targeted Attacks Aimed At Manufacturers of Products Used by Defense IndustryOn Friday, Adobe issued a security bulletin to address a recently discovered critical vulnerability in its Flash Player, that according to reports, is being used in targeted attacks.

Subscription-based Service Helps Website Owners Pinpoint Third Party Trackers Violating Privacy Policies

A hacker group going by the name “The Unknowns” is gaining attention for a string of attacks against government and private networks, which started back in March. However, there are questions as to whether or not their recent actions could lead to their downfall.

On Wednesday, a remote code execution vulnerability in PHP was accidentally exposed to the Web, prompting fears that it may be used to target vulnerable websites on a massive scale. The bug itself was traced back to 2004, and came to light during a recent CTF competition.The group that discovered the bug was waiting for a patch to be published before they released any information. However, on Wednesday details were leaked to Reddit prompting the group (Eindbazen) disclose what they...

During what can only be classified as a partial drive-by download attack, visitors to arriving at a compromised domain using an Android device may be subjected to malware that automatically downloads. However, unlike established drive-by attacks, the malware will require user permission to install.The attack was initially reported by a user on Reddit, and the malware family involved has been around since late 2011.

The Internet Represents Enormous Complexity, And One of The Most Profitable Vehicles For Commerce And Crime The World Has Ever Seen.