Ryan Naraine

Spyware has landed on Facebook. According to researchers at Fortinet, a malicious Facebook Widget actively spreading on the popular social networking site is serving as a lure to trick users into installing the notorious Zango adware/spyware program. According to a detailed advisory from Fortinet (complete with screenshots), the so-called “Secret Crush” widget powers a software […]

Israeli security researcher Aviv Raff has issued a warning for a fairly serious browser vulnerability that exposes Firefox users to identity theft attacks. Raff, a well-respected hacker who regularly reports security problems in software products, discovered a way to use a browser bug to lure Firefox users into entering login credentials into a maliciously rigged […]

Microsofts first Patch Tuesday for 2008 will be unusually quiet. The Redmond, Wash. software maker plans to ship just two security bulletins on Jan. 8 to patch code execution vulnerabilities in the Windows operating system. One of the two bulletins will be rated “critical,” Microsofts highest severity rating. The second is rated “important.” According to […]

If you use RealNetworks’ RealPlayer software, you might want to pay close attention to this demo from the folks at Gleg Ltd., a Russian vulnerability research and exploit creation outfit. According to Gleg founder Evgeny Legerov, there is a zero-day vulnerability that allows code execution in RealPlayer 11, the most up-to-date version of the cross-platform […]

America Online’s decision to put Netscape to sleep has triggered sadness and nostalgia. I have a one-word reaction: Yay! Everyone loves an underdog and for many years, most of us rooted for Netscape during the first browser war but, truth be told, the current Netscape had become a security liability—a browser with a fundamental design […]

If you turn to Google to find information on the assassination of former Pakistan Prime Minister Benazir Bhutto, chances are you will land on a Web site rigged with malicious exploits. Within hours of Bhutto’s death, researchers at Websense Security Labs discovered several Web sites capitalizing on the breaking news surrounding Bhutto’s death, including one […]

After a brief lull, the “Storm Worm” malware attacks returned with a bang this holiday season, using electronic greeting card lures to build and replenish one of the most notorious spam botnets. The latest social engineering attacks began just before Christmas Day with a large spam run using a malicious link embedded in e-mail messages. […]

Microsoft has filed a patent claim for the Strider HoneyMonkey malware/exploit detection system created by its internal research unit. The claim, currently being reviewed at Peer-to-Patent, is a clear signal that the two-year-old research project could soon find itself in a software product coming out of the Redmond, Wash., software vendor. The HoneyMonkey system, first […]

According to reports out of Russia, two men who allegedly built and distributed the notorious Pinch malware creation kit have been busted and could soon face prosecution. The two men, identified as Ermishkin and Farkhutdinov, are allegedly responsible for the do-it-yourself toolkit that makes it possible to hijack e-mail, ICQ and other sensitive data for […]

SecureWorks anti-malware guru Joe Stewart is not one to be intimidated by advances in online crime activity. But, when he reversed the backend code associated with the Pushdo Trojan downloader, he discovered a modern malware distribution system fitted with complex tracking mechanisms and hiding techniques—another clear sign that virus fighters are up against a clever […]

An undocumented flaw in Google’s Gmail, Blogger and Search History widgets could introduce security risks to Mac OS X users. According to Scott Knaster, a member of Google’s Mac Team, the vulnerability was discovered and reported by the World Wide Web Consortium’s Thomas Roessler. “We’ve updated the widgets to fix the issues,” Knaster said, urging […]

For the first time in a decade, members of the famous LOpht Heavy Industries hacking think tank will have a reunion of sorts at a new Boston security conference. According to organizers of the SOURCE Boston confab, many of the original L0pht members will be speaking on a panel for the first time in 10 […]