Security Response WeblogSecurity ResponseDo You Know Where Your Baby Is- August 29, 2008 Notice! The virus-spreading spammer doesn't have your baby but is claiming to. In recent emails observed by Symantec, malicious code is being spread by hoax emails claiming to have pictures of your hijacked sic baby. The Subject line makes the claim that someone hashttps://forums.symantec.com/syment/blog/article?blog.id=spam&message.id=113#M113 Security Bugs Vs. Regular Bugs- August 28, 2008 There has been much debate recently that stems from discussions related to Linux kernel development, over whether or not security vulnerabilities should be treated differently than regular software bugs. This has meant there has been a slight departure from the exhausted "full disclosure" debatehttps://forums.symantec.com/syment/blog/article?blog.id=evolution_of_security&message.... When Spammers Kill You While You Sleep- August 27, 2008 I must admit that I was puzzled for a second when I saw an email with a suicide note as subject line in my spam inbox. I wondered what product they might try to sell with that note or which drive-by download site might be hidden behind it. So, I opened it. The email was actually written like a real suicide note.https://forums.symantec.com/syment/blog/article?blog.id=spam&message.id=112#M112 PCI-DSS Version 1.2 - Changes Forthcoming- August 26, 2008 The PCI Security Standards Council has released a summary of changes and clarifications for version 1.2 of the PCI-DSS standard, which is scheduled for release on October 1, 2008. In an effort to combat the growing problem of card theft, the Payment Card Industry Data Security Standard has been established to ensure that through the use of imposed regulations, compromises of customer card data will not be easily possible.https://forums.symantec.com/syment/blog/article?blog.id=evolution_of_security&message.... Cisco WebEx Meeting Manager Drive-By Exploit- August 23, 2008 On August 20, our honeypots began to receive attacks against the Cisco WebEx Meeting Manager vulnerability. This August 6 vulnerability exists in the ActiveX control used by WebEx to permit users to participate in meetings via Internet Explorer. Users running the vulnerable version of the Webex control who happened upon a Web site distributing the exploit would become infected. The first exploits that we have seen so far have been served via gaming sites that have had the exploit package...https://forums.symantec.com/syment/blog/article?blog.id=vulnerabilities_exploits&messa... RussiaGeorgia Conflict News Used to Hide Malicious Code in Spam- August 21, 2008 In the past few days Symantec has observed virus spam masquerading as news articles regarding the current Georgia-Russia conflict. We felt it was important to blog about this because this particular event is garnering a lot of media attention and holds a very high profile.https://forums.symantec.com/syment/blog/article?blog.id=spam&message.id=111#M111 |