Friday, June 6, 2008
Daily Report
• The San Francisco Chronicle reports that three tanker trailers filled with chemicals burst into flames Wednesday at the Ashland Distribution chemical plant in Fairfield, California. The cause of the blaze has not yet been determined. (See item 5)
• According to the Washington Post, Prince George’s County police found explosive material in a deserted car near Andrews Air Force Base Wednesday morning. Federal and county officials are investing the source of the explosives and whether there is a terrorist connection. (See item 26)
Banking and Finance Sector
10. June 4, Clarion Ledger – (Mississippi) Internet scam targets EPPICard users. The state attorney general is warning people about a phishing scam that targets Mississippi residents who use EPPICards to receive child support or unemployment benefits. The link from this spam e-mail or other pop-up messages may bring online users to a site similar to the EPPICard Web site. “These sites are very hard to distinguish from the real ones,” the official said in a news release. “EPPICard has posted a notice on their website warning users that they would never request personal information through email, text messaging, or phone calls.” Source: http://www.clarionledger.com/apps/pbcs.dll/article?AID=/20080604/NEWS/80604033
11. June 4, Reuters – (National) U.S. SEC to propose new rating agency rules June 11. The U.S. Securities and Exchange Commission (SEC) said on Wednesday that it would hold an open meeting on June 11 to propose new rules on credit rating agencies. The SEC, which is responsible for ensuring that credit ratings agencies make adequate disclosures, is considering whether additional industry regulations are needed. Rating agencies such as Moody’s Corp, Standard & Poor’s, and Fimalac SA’s Fitch unit have been criticized for failing to properly analyze securities backed by mortgages before assigning top ratings. Critics have said the rating agencies sometimes assigned too-high ratings to securities backed by poor-quality mortgages. The SEC has spent months examining the credit rating industry and plans to propose new rules for them in June, the SEC Chairman has said. New regulations could include requiring better disclosure of past ratings, limiting conflicts of interest, and requiring rating agencies to differentiate between corporate bonds and more complex structured finance products, he said. Source: http://www.reuters.com/article/marketsNews/idUSN0435864820080605
Information Technology
29. June 5, IT Pro – (International) Google targeted as spam levels increase. A MessageLabs Intelligence Report for May report claims spam is back on the increase with levels not experienced since early 2007 – with increased targeting of free hosted services like Google Docs. The report said that levels had reached 76.8 per cent of all emails. It was suggested the high figure was due to changes in tactics by spammers. The report said there was a move away from reliance on new and undetectable email attachments (switching between image, PDF, MP3, office DOC, and XLS spam). The trend was now moving towards taking advantage of open and free mainstream services such as Google Docs and Calendar. Links to the Google Docs domain were not blocked by traditional spam filters and the environment carried enough bandwidth to host spammer’s websites. It was also said to be possible to track their success by the use of Google Analytics. Spam levels rose across all industry sectors in May with manufacturing the top for spam activity at 83.7 percent of all emails. The highest rise was in the non-profit sector, where spam levels grew by seven per cent to 81.3 percent. Source: http://www.itpro.co.uk/security/news/203814/google-targeted-as-spam-levels-increase.html
30. June 5, Channel Register – (International) ‘Legit’ website compromises reach epidemic proportions. Web security firm ScanSafe reports that changes in hacking tactics mean that compromised content on legitimate website has become the main conduit for so-called drive-by download attacks. According to the firm, two in three instances of web-based malware it blocked last month came from legitimate sites. ScanSafe blames the increase on attacks that have planted malicious scripts, often exploiting iFrame web browser vulnerabilities, on pukka websites. Hacked sites are commonly used to deliver password-stealing Trojans and other strains of malware onto compromised PCs. Source: http://www.channelregister.co.uk/2008/06/05/scansafe_web_malware_survey/
31. June 4, Computerworld – (National) XP SP3 omits critical security update. Microsoft Corp. confirmed Tuesday that Windows XP Service Pack 3 (SP3) omits a critical security update issued by the company in November 2006. The company acknowledged the omission while attempting to clarify the effect XP SP3 has on existing installations of Flash Player, an add-on that Microsoft bundled with Windows XP when it first shipped in 2001. Microsoft has patched Flash Player in the past using Windows Update, notably with the MS06-069 security update it issued November 14, 2006. The missing update, MS06-069, patched five vulnerabilities in Adobe Systems Inc.’s Flash Player and was rated “critical” by Microsoft, the company’s highest threat ranking. Microsoft did not explain why the patch is missing from the service pack, which it has billed as including “all previously released updates.” Flash Player has made security news of late; last week, for example, researchers revealed that hackers were actively exploiting Flash Player 9.0.115.0, an edition released by Adobe in December 2007. On Monday, Computerworld reported that Windows XP SP3 shipped with that out-of-date and vulnerable version rather than the newer and more secure Flash Player 9.0.124.0, which Adobe issued in early April, about two weeks before Microsoft wrapped up the service pack and began distributing it to resellers. Source: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9093338
Communications Sector
32. June 4, ZDNet Australia – (International) Mobile malware threat heightened by Symbian hack. A hacker has created a way of bypassing security measures in the Symbian operating system that block malware. A “jailbreak,” similar to those developed to crack the iPhone, has been developed for Symbian S60 3rd edition. Security company F-Secure fears it could be used to target phones which run Symbian’s latest operating system, such as the Nokia N95, with malware. “It allows an application to do things to the device it shouldn’t be able to do, such as use the network connection without a user prompt,” F-Secure’s senior security specialist said. Symbian S60 3rd edition is considered to offer better security than computer operating systems such as Windows because applications need a certificate from Symbian itself before they can be run. While the block on unsigned applications comes as Symbian’s default setting, users can circumvent it manually, allowing the applications to run. “If you run it, any application that’s currently running will get access to everything on the device, including things they shouldn’t be able to do,” he added, such as contact lists and personal files. The hack is delivered as a Symbian (SISX) installation file and must be run before the device becomes vulnerable. Nevertheless, phone users are still far safer than PC users, according to the specialist. “A drive-by download type install is not possible,” he added. Source: http://www.zdnet.com.au/news/security/soa/Mobile-malware-threat-heightened-by-Symbian-hack/0,130061744,339289590,00.htm
No comments:
Post a Comment