SecurityWeek

After detecting an increase in malicious attempts to access user accounts, the retail giant Best Buy is alerting customers to reset their passwords. However, it appears that the warning is confusing some users. The letter starts as one would expect; “Dear Valued Best Buy Customer.” From there, the message to customers says that the company is investigating increased attempts from attackers around the globe, who appear to be targeting BestBuy.com and other e-commerce sites.

Formspring, the Social Q&A portal focused on conversations and personal interests, admitted to being breached on Tuesday. The compromise led to the loss of 420,000 hashed passwords, forcing the website to reset the passwords used by every member.

The Google Chrome team has moved the Flash plugin into a separate sandbox on all versions of Windows to make it harder for attackers to exploit.

Microsoft plugged a pair of vulnerabilities in Internet Explorer 9 today as part of a sizeable Patch Tuesday update.

Google is working on a new capability that will allow users to turn off ads, or at least, reduce the number of ads it sees.

Websense announced a number of enhancements today to the latest version of its TRITON Web, email and data security product to help customers fight off attackers.Websense's Advanced Classification Engine (ACE) has been armed with 10 new defenses in TRITON 7.7, including: detecting criminal encrypted uploads, optical character recognition of text within images for data-in-motion and geo-location awareness.

In the security and privacy world, 2012 is turning out to be the year for Internet security bills. From CISPA to CSA to SECURE IT, you name it and there’s been a bill introduced in Congress for “securing” the Internet.

Attackers are increasingly shifting their focus on smaller businesses when crafting targeted attacks, according to Symantec's monthly threat report. The June 2012 Symantec Intelligence Report found that 36 percent of all targeted attacks that were detected over the last six months were directed at businesses with 250 or fewer employees. In comparison, a mere 18 percent of targeted attacks went after small businesses in December 2011.

Seculert, a Petach-Tikva, Israel-based malware threat detection company, today announced that it has closed a $5.35 million round of venture funding that will be used to further expand its sales and product development teams and establish a U.S. presence.The funding was led by Norwest Venture Partners, with existing investor YL Ventures also participating in the round.

Researchers at Trusteer have discovered a type of attack that is targeting Android users via their desktops, with the aim of controlling both endpoint devices. So far the malware itself is limited to Spain, Germany, the Netherlands, and Portugal.Trusteer's discovery offers some additional insight into the development of SpyEye and Tatanga, the families of malware making headlines recently. In May, Trusteer observed Tatanga mixing traditional social engineering with browser hijacking in an attempt to fool the victim into legitimately approving...

On July 4, researchers from mobile protection firm TrustGo detected a new piece of malware targeting Android. Unlike other Android attacks however, this one gained a large install-base rather quickly – infecting 100,000 devices in less than a week.

Symantec, who bought their way to the top of the SSL market with the purchase of VeriSign in a $1.28 billion deal announced in May 2010, has said they will adopt the Certification Authority Browser (CA/B) Forum Baseline Requirements, which were

General Alexander Urges Congress That Defensive Cybersecurity Actions Must Be Taken Before it Is Too Late

Network security firm Cyberoam has released an update for all of its unified threat management (UTM) devices in response to the leak of the default private key used by all of the company's UTM devices. The company pushed the fix out over-the-air after an anonymous poster leaked the key online. The update forces devices to use unique certificate authority (CA) SSL certificates when intercepting SSL traffic on corporate networks.

This is the third in a series of articles on the new “3x3” security model for critical infrastructure cyber security. The first defined the model itself, so if you haven’t read it yet, you may want to read it here before continuing.