Defensive Security

Kaspersky study indicates 200,000 malware variants are released daily, the Carberp trojan's source code is leaked and an 0day is discovered, FINRA reports on prolific cyber attacks against its members, the FT is attacked by the Syrian Electronic Army and gives a play by play on what happened, Kaspersky reports an 87% increase in phishing attacks, Google reports that compromised legitimate sites are more dangerous than malicious sites, Sophos says 30,000 SMB sites are hacked per day to spread malware, the age old debate about administrator rights, password complexity, and the unintended consequences of leaks: foreign companies defect to more hospitable countries, renewed focus on systems administrators, and we can stop pretending to not know where Stuxnet came from.

The discrepancy between perception and reality when it comes to quantifying risk, the major fail that was OpPetrol, Malvertising, EMET 4 released, How not to be a CSO by the Harvard Business Review, Linked In's DNS woes, and CSOs are not recognizing reality.

Gartner security myths, 2013 OWASP top ten, FDA finds security risk in medical devices, Oracle fixes 40 more java bugs, B-sides Rhode Island videos, Can the Germans break PGP?

Verizon, PRISM and Edward Snowden, Java users are bad at patching, cost of breaches is up, Microsoft operation takes down 1462 Citadel botnets, malware increasingly using peer to peer communications for command and control, and malware trends.

US power grid is highly vulnerable and under constant attack, Iran attacking energy companies, increase in sophisticated attacks against keys and certificates, Indian government site redirects to black hole exploit kit, FSB report find that only 36% of small businesses regularly patch, 5 quick wins from the DBIR, Google to give software vendors 7 days prior to releasing information on active exploits, and planning for the failure of malware prevention.

Adobe and Microsoft patches, signed Mac malware, EC Council website hacked, 7 steps to secure Java, Microsoft on invulnerable software, more on OpUSA, Ohio city's taxpayer database stolen and the importance of malware being invisible.

Adobe warns customers of a Cold Fusion 0day, Washing courts owned by that 0day, web servers found compromised with the Cdorked/Darkleech, critical vulnerability in Nginx, Anonymous' opUSA turned out to be a bunch of nothing, too many admins is bad for security, Name.com gets compromised, The Onion's twitter feed is compromise by the SEA, slippery slope of BYOD and Google's plans for authentication.

Twitter warns news agencies of attacks and to use dedicated PCs for using twitter, the US department of Labor website was compromised and serving up an 0day for IE8, 18 12-13 year olds in Alaska socially engineered passwords for 300 computers out of their teachers, iOS did NOT have a malicious app discovered, AV vendors are starting to shun Windows XP, 7 elements of a successful security awareness program, and the unforeseen impacts of cyberwar.

In this episode, another Java 0day, Symantec's Q1 2013 0day roundup, the Akamai State of the Internet report, the Verizon 2013 DBIR, AP's twitter feed hack, and cyber terrorists.

This week: Twitter account hacks highlight opportunity for exploitation by attackers, Microsoft and Malwarebytes both release bad patches, Oracle releases a Java patch which fixes 42 security bugs, Oracle announces that Java 8 is delayed due to the focus on Java 7, a new botnet is being created by compromising Wordpress installations for some unknown purpose, Linode was compromised in an attack targeted at some Linode customers, Microsoft finds a trojan that cleans up after itself in the next wave of anti-forensics, the Boston marathon bombing and West, Texas explosions see many phishing scams leading to malware installations, spam is down, targeted attacks via email are up, Microsoft released it's second half 2012 Security Intelligence Report with some odd mixes of data, Microsoft releases EMET 4.0 beta, and a former employee has been charged with planting back doors on 2723 Hostgator servers.

Vudu loses data because a drive stolen from their office was not encrypted, there was a spate of Windows and Adobe patches that allow remote code execution and local privilege escalations, SEC filings seem to contradict the hype around cyber attacks on companies in the US, There are 51 weeks left of Windows XP support, 2 ideas for better security, SSH is getting an update, Shylock got an update too, popular porn sites are serving malware through advertisements, and the Global Payments breach cost $93.9M.