News

California software company Cybersitter LLC, has sued the People’s Republic of China and seven computer manufacturers in U.S. Federal court for stealing 3,000 lines of its Internet filter software code and using it in last year’s Green Dam fiasco in China. The suit, “Cybersitter v. the People’s Republic of China,” was filed in U.S. District Court, Central District of California (Los Angeles). It also names Acer, Lenovo, Sony Corp., Toshiba, Asustek Computer Inc., Benq Corp. and Haier Group as defendants. ...

There has been extensive news coverage this week of Adobe’s plans for ramped-up security in its popular Reader, Acrobat and Flash Player applications, especially the Reader and Acrobat updates promised next week. A vulnerability that was publicized in December in Reader and Acrobat allows an attacker to execute arbitrary code with a specially crafted PDF file using ZLib compressed streams. In a short time, proof-of-concept code was made public. In the past week, anti-virus companies began intercepting malicious .pdf files that exploit the vulnerability to install a back door on victims’ machines. ...

Seal Shield, a Jacksonville, Fla., company that makes washable computer keyboards and mice, said it will introduce the world’s first washable cell phone at the Consumer Electronics Show in Las Vegas this week. The company’s washable mice, keyboards and TV remotes can be cleaned in a dishwasher. This might be good. I have three 20-something step children who have discovered that cell phones as we have come to know them do not survive being dropped in toilets. ...

Mike Cardwell, an IT consultant in Nottingham, UK, reported on his blog finding a Y2010 bug in Spam Assassin. He found an error in a rule that Spam Assassin folks thought they fixed. “I think a lot of systems will be experiencing false positives on their ham because of this at the moment. It is a particularly high scoring rule considering that the default threshold is 5.0,” he wrote. For further information see: SpamAssassin Rule: FH_DATE_PAST_20XX

With a dazzling laser show, the 26th Chaos Communication Congress (26c3) in Berlin, the last big security conference of 2009, has ended. If you haven’t been here, you might have missed fewer of the sessions than people on site, thanks to the worldwide availablility of live streams (and recordings). What you did miss was meeting all these people, though! 26c3 has simply outgrown the location it has occupied for the last few years, but this may be offset by a very successful experiment: allowing full remote access to the conference network via VPN for those who couldn’t attend. Other conferences should consider this (hey, Defcon team, are you reading this? 😉 ) as well, especially as air travel becomes less and less attractive. ...

It’s the time of year to make predictions. I only have one: in 2010, governments around the world will BEGIN to increase their efforts to do something about the massive malware threat that every Internet user on the planet faces. It’s going to be controversial and difficult legally and technically. It’s going to cost serious tax money, political capital and diplomatic work to counter this crime wave that is like nothing the world has ever known. ...

Atif Mushtaq, a researcher at FireEye security company, has coordinated a global effort to take down of one of the top 10 botnets – Mega-D. PC world said the botnet controlled 250,000 machines in a massive network that was responsible for nearly 12 percent of world spam according to Message Labs statistics. Mushtaq and those working with him coordinated their efforts with Internet service providers to isolate the Mega-D command-and-control servers in Israel, Turkey and the U.S. ...

AV-Comparatives Summary Reports 2009 Available! Summary Report 2009 AV-Comparatives Site: http://www.av-comparatives.org/ Read/Download Summary Here. Overall winners of 2009 (Best Products of the Year by AV-Comparatives): To be rated “Best Anti-Virus Product of 2009” by AV-Comparatives, an Anti-Virus product should preferably have very high detection rates (of malware and also potentially unwanted applications), high proactive on-demand detection (or provide proactive protection), very few false positives (FP), scan fast and reliably with a low system impact, provide good malware removal capabilities, protect the system against malware/websites with malicious software without relying too much on user decisions/interactions, cause no crashes or hangs, and have no annoying bugs. Based on the awards given by AV-Comparatives during 2009, several products got many high awards and are very close, so that we decided to award not only the Best Product of 2009 but also the second and third places (Silver and Bronze). Looking into the detail of the raw results, we decided to give the following awards: ...

Performance comparative test result is available! AV-Comparatives: http://www.av-comparatives.org/ Read/Download test result from Here.

This is the ‘12 scams of Christmas’ I mentioned in last post: Pipers tout fake gold rings as Maids are ‘a-phishing’ to milk bank accounts On what is traditionally the busiest online shopping day of the year (1), consumers are being warned not to become victims of the ‘12 Scams of Christmas’ and to take extra care with personal and IT security. The ‘12 Scams of Christmas’ developed by the National Fraud Authority (NFA), The UK Cards Association and the City of London Police (CoLP) highlight the greatest holiday fraud threats and how to spot them. ...

Tanya has just posted over on Kaspersky Russian site about losses caused by Internet fraudsters in England and Wales. If you want to practice your Russian, hop over there, and take a look! I know that most people in the UK prefer to get their news in English. So here’s a few facts and figures: In a recent statement, the Office of Fair Trading estimated that losses caused by Internet fraud amounted to £14 billion per year. That’s a lot of money! It’s also a lot of victims! ...

After months of negotiations, US President Barack Obama has finally chosen a Chief of CyberSecurity – Mr Howard A Schmidt. Confirmation of the appointment is expected shortly. Mr Schmidt, who previously served with the Bush administration as a cyber security official, comes to the job with an impressively lengthy list of credentials. The new Chief will essentially be the administration’s go-to man for any coordinated efforts to deal with cyber threats and will be reporting to the National Security Council. ...

For the first time, the FBI has issued a public warning about the threat of rogue anti-virus software, which the agency said has resulted in more than $150 million in losses to victims. In an intelligence note posted Friday on the website of the Internet Crime Complaint Center, the FBI said users should be on the lookout for pop-up advertisements masking as legitimate-looking AV software, known as “rogueware” or “scareware.” Rogue anti-virus software typically is purveyed through malicious advertisements, or “malvertisements,” on trusted websites. When viewed or clicked, the ads lead users to sites that claim their computer is infected and, to resolve the issue, they should buy an anti-virus product, which turns out to be fake. In other instances, the ads try to install trojans onto the victim’s PC. ...