Robert Lemos

Kelihos keeps coming back, Citadel is hard to kill, and Zeus seems immortal. Security firms, led by software giant Microsoft, have tried to shut down each of these botnets, but despite some initial signs of success, each has come back to life. Botnets, networks of compromised computers under the control of a cyber-criminal gang, are […]

Edward Snowden has not publicly stated how he leveraged his privileged access to certain servers and top-secret information at the National Security Agency into a wider fishing expedition, netting classified secrets that he had no clearance to access. The NSA hasn’t provided much insight either. This week, however, security researchers at certificate-management firm Venafi threw […]

In an effort modeled after the 1950s push to educate Americans in hard sciences and mathematics, U.S. private and public organizations have launched a number of initiatives to build cyber-security expertise this year, including partnerships with universities to develop cyber-security training programs and coursework to build a steady supply of technical graduates. This week, IBM […]

The embedded systems used by administrators to monitor servers, known as baseboard management controllers (BMCs), are poorly coded and have numerous vulnerabilities that could be used to disrupt and potentially take control of a system, according to a growing number of research reports. Earlier this month, researchers from vulnerability management firm Rapid7 found seven security […]

Edward Snowden, a former contractor with the National Security Agency, convinced up to two dozen NSA employees to part with their passwords, saying he needed the credentials to do his job, according to a Nov. 8 report by Reuters citing unnamed federal investigators. If the allegations are true, it would be a serious violation of […]

Phishing attacks are nothing new, but they are increasingly used by attackers as a way to exploit a vulnerability common to all businesses: their employees. In a study released Nov. 4, security-training firm ThreatSim found that an average of 18 percent of messages in a phishing campaign successfully induced recipients to click on a malicious […]

Microsoft expanded its bounty program on Nov. 4 to reward, not just researchers, but anyone who discovers a new technique for bypassing the security of the Windows operating system. The change means that the company will pay out $100,000, its top award, to individuals who discover a previously unreported method of evading Windows’ defenses, even […]

The technology research arm of the U.S. Department of Defense has launched a cyber-security grand challenge—a contest to take on a fundamental problem in cyber-security—tasking teams to create a system capable of automatically defending a network by generating security patches. Modeled after the grand challenges for the development of automated vehicles and cheap space flight, […]

The backlash against the surveillance and data-gathering activities of the National Security Agency gathered momentum the week of Oct. 25 with more calls for political action and new revelations about the extent to which the spy agency went to tap into Internet communications. On Oct. 30, the Washington Post published additional documents released by former […]

Using the compromised username and password of an administrator, attackers breached the network of database-as-a-service firm MongoHQ, accessing the data of a “limited number” of users, the firm said in a detailed description of the attack published on Oct. 29. MongoHQ, which provides managed access to instances of that unstructured database software MongoDB, discovered the […]

A malware campaign has infected at least 40,000 Web pages in the past two weeks with malicious code that could infect visitors’ computers with a program that poses as a media player, according to security firm Websense. The attack, known as GWLoad, compromises legitimate Websites to host malicious code to then be delivered to users. […]

Cyber-criminals likely based in Russia and the Ukraine have compromised computers at thousands of companies with a malware program known as Mevade, hijacking search traffic and conducting click fraud to turn the compromised systems into cash, security firm Websense stated in an analysis posted online on Oct. 23. The attack has hit companies in the […]