Ryan Naraine

An anonymous security researcher has posted a proof-of-concept exploit for a flaw patched in Microsofts “critical” MS06-035 bulletin, but the companys security response team says the issue is actually a brand-new, unpatched vulnerability. The researcher, who uses the online moniker “cocoruder,” published the attack code on the Milw0rm Web site alongside a claim that it […]

For Microsoft, the coming days of Black Hat Briefings hacker scrutiny in Las Vegas could make or break its claim that Windows Vista is the “most secure operating system ever.” The software maker will use the August 2-3 security conference to showcase a wide range of security features and functionality being fitted into the successor […]

Jesper Johansson, a high-profile security guru at Microsoft, has left the company. Johansson, who served for five years as a senior security strategist at the Redmond, Wash., software maker, will move to become principal security program manager at Amazon.com, headquartered in Seattle. A regular at security conferences and Microsoft events, Johansson served as a passionate […]

Internet security vendor Symantec has shipped patches to cover a pair of vulnerabilities in its enterprise-facing BrightMail AntiSpam product. Cupertino, Calif.-based Symantec warned in an advisory that the bugs could lead to data manipulation, denial-of-service attacks or the exposure of sensitive information. Affected products include Symantec BrightMail AntiSpam 4.x through 6.x. The company recommends that […]

Looking to jumpstart widespread adoption of the OpenID online identity system, a dozen software vendors are backing a $50,000 bounty program to open-source developers. The OpenID Code Bounty, which is supported by a slew of companies including VeriSign and Six Apart, offers $5,000 directly to 10 open-source projects that successfully implement OpenID 2.0 support. Others […]

The ongoing Digg versus Netscape spat has apparently escalated into a hacking attack against America Onlines Netscape.com social media Web site. Virus researchers at Finnish security vendor F-Secure discovered the Netscape.com hack during research work around cross-site scripting vulnerabilities on social networking sites and said the attack was obviously the work of Digg fans. Netscape.com, […]

British database security vendor NGSSoftware has tapped former McAfee chief security officer Ted Barlow to head up its North American operations. NGSSoftware, based in London, said Barlow will handle its expansion into major U.S. markets. Barlow previously served for four years as vice president and CSO at McAfee, a Santa Clara, Calif., provider of anti-virus […]

The worlds most popular search engine can be used to pinpoint software security bugs in source code available on the Internet, according to a new research project launched by a U.K.-based researcher. The project, called Bugle, is a collection of Google search queries that can be used to identify some of the most common vulnerabilities […]

HD Moore, creator of the metasploit hacking tool and the security researcher behind the Month of Browser Bugs, or MOBB, project, has released a search engine that finds live malware samples through Google queries. The new Malware Search engine provides a Web interface that allows anyone to enter the name of a known virus or […]

In the midst of back-to-back zero-day attacks against select businesses in the Far East, Microsoft on July 17 released a security advisory with a terse message: Do not open or save unexpected Microsoft Office files, even if they come unexpectedly from a trusted source. The companys advisory comes less than a week after virus hunters […]

Detailed exploit code for a critical Windows worm hole has been published on the Internet, putting millions of users at risk of PC takeover attacks. The code, which was posted to the Milw0rm Web site, attempts to exploit a known—and already patched—vulnerability in the DHCP (Dynamic Host Configuration Protocol) Client service. Microsoft released the MS06-036 […]

A second Trojan used in the latest zero-day attack against Microsoft Office contains characteristics that pinpoint corporate espionage as the main motive, according to virus hunters tracking the threat. According to an alert from Symantec, a backdoor called Trojan.Riler.F is installing itself as a layered service provider, or LSP, allowing it access to every piece […]