SecurityWeek

SINGAPORE - Singapore police on Tuesday arrested a 13-year-old Indian boy for posting a Facebook message in which he allegedly threatened to bomb a luxury casino resort in the city-state. The unnamed boy vowed to take "a big big revenge", "spit everywhere" and "plant bombs on Marina Bay Sands", a major tourist attraction, on the day he leaves Singapore, according to The Straits Times.

SAN FRANCISCO - Facebook sidestepped a privacy gaffe on Monday by fixing a flaw that made it possible to snoop on private New Year's Eve messages sent using a "Midnight Delivery" service. Facebook took "Midnight Delivery" offline temporarily to patch a vulnerability pointed out by Britain-based blogger Jack Jenkins.

Microsoft has pushed out a tool to help users address a zero-day vulnerability affecting Internet Explorer.

Trend Micro has spotted a piece of malware in the wild targeting Java-based HTTP servers and Java Servlet containers. According to Trend Micro, the malware is disguised as a Java Server page (JSP). Once installed, it performs backdoor routines and gains control over vulnerable servers.

Microsoft has issued a security advisory, and confirmed reports that a zero-day vulnerability in Internet Explorer has been used in targeted attacks. One such attack was reported last week, when a drive-by download attack on the website maintained by the Council on Foreign Relations (CFR), leveraged the vulnerability to spread malware.

According to an Army spokesperson, 36,000 records maintained by CECOM (Communications-Electronics Command) and Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR), were breached earlier this month by an unknown hacker or group of hackers.

In August, Kaspersky Lab started an initiative to get the public’s help in cracking the encryption used in the payload of the Gauss malware. On Friday, the Hashcat project lent their resources to the cause by releasing a tool to help crack Gauss’ verification hash.

BEIJING - China has approved new rules that require Internet users nationwide to provide real-name identification, state media reported on Friday, as the government increases its already tight online grip. The National People's Congress (NPC), the country's legislature, adopted the measures at a meeting on Friday, the official Xinhua news agency and other media said.

WASHINGTON - US authorities are probing allegations by Hewlett-Packard that a British software firm it bought out had fraudulent accounts, the US tech giant said in its annual report released Thursday. On November 20, HP reported a writedown of $8.8 billion, including more than $5 billion it attributed to inflated data from Autonomy, acquired by HP in 2011 for more than $10 billion.

Get Off The Bench And Look Into Your Virtual Environment Free Forrester Research White Paper

A new ransomware scam has taken an interesting twist – rather than simply demanding payment, the attackers want the victims to fill out a survey. It is a new tack for a scam that traditionally relies on threats and intimidation, and perhaps a foreshadowing of what is to come, noted Malwarebytes Malware Intelligence Lead Adam Kujawa.

A National Security Agency (NSA) program designed to discover security vulnerabilities at critical infrastructure companies is in full swing, according to documents reportedly obtained by the Electronic Privacy Information Center (EPIC).

Cybersecurity teams should focus on security resolutions rather than predictions.

As you embark on 2013 and evaluate your security risks for the coming year, what should not change in terms of your network security focus is data center security.

Peter Winter-Smith, a researcher from the U.K., published an interesting exploit for the NVIDIA Display Driver Service on Christmas Day, which enables an attacker to install a user on the target system, completely bypassing Microsoft’s Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protections.