Ryan Naraine

Microsofts twice-yearly BlueHat hacker summit, running Oct. 19-20, will kick off later this week with a demo of a virtual machine rootkit that can potentially be used to defeat the controversial PatchGuard technology. Dino Dai Zovi, a principal at penetration-testing outfit Matasano Security, has been invited to Microsofts Redmond, Wash., campus to showcase a hardware […]

The dramatic rise in phishing and identity theft attacks includes a well-organized offline component—the not-so-innocent “money mule” recruited by fraudsters to launder stolen money across the globe. The ads appear innocently on all the major employment listing sites, offering stay-at-home positions titled “shipping manager,” “private financial receiver” or “sales representative.” These, however, are active attempts […]

Its dress-down Friday at Sunbelt Softwares Clearwater, Fla., headquarters. In a bland cubicle on the 12th floor, Eric Sites stares at the screen of a “dirty box,” a Microsoft Windows machine infected with the self-replicating Wootbot network worm. Within seconds, there is a significant spike in CPU usage as the infected computer starts scanning the […]

If the plan is perfectly executed, Nicholas Negropontes One Laptop Per Child project will deploy 100 million laptops in the first year. In one fell swoop, the nonprofit organization will create the largest computing monoculture in history. Wary of the security risks associated with a computing monoculture—millions of machines with hardware and software of identical […]

Multiple security flaws in Bugzilla could put users of the software defect tracking software at risk of cross-site scripting, data manipulation and data exposure attacks. According to a warning from the open-source Bugzilla project, users should immediately upgrade to versions 2.18.6, 2.20.3, 2.22.1 or 2.23.3 to minimize the risk of malicious attacks. Security alerts aggregator […]

Oracle plans to make a significant change to the way product flaws are described in its security bulletins, an admission of sorts that the quarterly alerts were almost impossible to understand. Beginning with the Oct. 17 release of the scheduled CPU (Critical Patch Update), the Redwood Shores, Calif., database vendor will start adding severity scores […]

If the plan is perfectly executed, Nicholas Negropontes One Laptop Per Child project will deploy 100 million laptops in the first year. In one fell swoop, the nonprofit organization will create the largest computing monoculture in history. Wary of the security risks associated with a computing monoculture—millions of machines with hardware and software of identical […]

For the second time this year, a major management reshuffle at Microsoft has sent ripples through the software makers security unit. Just seven months after tapping Ben Fathi to head up the newly formed STU (security technology unit), the Redmond, Wash. company announced that Fathi would move over to manage a Windows Core System development […]

MONTREAL—A computer security expert is predicting that hackers will crack the controversial PatchGuard kernel anti-tampering technology coming in Windows Vista within one year of its release. Alexander Czarnowski, chief executive of Avet, in Warsaw, Poland, said he believes its inevitable that the technology will be broken once the final version of Windows Vista is released […]

Can a small startup in San Francisco play a big role in the fight against the phishing scourge? OpenDNS, a 10-employee company with technological expertise in the domain-name-resolution field, is betting that a mix of social networking, Web services and user-generated submissions can power a valuable, freely available anti-phishing database. Phishing, which has emerged as […]

In-the-wild exploits against the latest unpatched Windows vulnerability have started circulating, using Internet Explorer as the attack vector to load identity theft Trojans and rootkits on infected machines. The exploits target a Windows Shell vulnerability that was first released during the Month of Browser Bugs project in July. The project was kicked off by security […]

A public claim by hackers that Mozillas Firefox browser is vulnerable to multiple code execution vulnerabilities may be an overblown hoax. On the heels of a ToorCon presentation where two security researchers—Mischa Spiegelmock and Andrew Wbeelsoi—warned that Firefoxs implementation of JavaScript was badly flawed and could allow PC takeover attacks, Mozillas engineers say the risk […]