A group of researches on Tuesday said 637 million Web users are surfing with outdated Internet browsers and therefore at greater risk of Web-based attacks.

Using data collected from Google Web searches and security firm Secunia, the researchers, Stefan Frei (of ETH, Zurich), Thomas D?bendorfer (Google), Gunter Ollmann (IBM ISS), and Martin May (ETH, Zurich), analyzed the browsers used in a new report (PDF). They did so in an effort to understand why so many recent attacks by criminal hackers have been aimed at the browser, and why those attacks have been so successful.

Overall the authors found that … Read more

Taking a cue from Morgan Spurlock who lived on fast food for 30 days in the Super Size Me documentary, McAfee gathered volunteers from around the world who would, for one hour a day, surf the Internet, signing up for various newsletters, filling in various forms. As they did so, the participants were asked to blog about their experiences.

On Tuesday, McAfee released the results of the experiment it called S.P.A.M., or Spammed Persistently All Month.

Over the course of the month, McAfee's test subjects accumulated 104,000 spam messages, or roughly 70 per day per … Read more

On Monday, SecureWorks released its analysis of the Coreflood Trojan, providing an inside look at a stealthy online predator.

According to a blog by Joe Stewart, director of malware research for SecureWorks, Coreflood started out as an IRC (Internet relay chat) botnet back in 2002. Coreflood--or AFcore, as the author refers to it within the code--is apparently viewed by its author as corporate software that can be tweaked as business needs change. For example, over the last six years, Coreflood has evolved from initiating distributed denial-of-service attacks to collecting IDs and passwords for bank fraud.

With the help of Spamhaus, … Read more

On Monday, Apple released Mac OS X 10.5.4. In addition to enhancements to existing features, Apple bundled in 13 specific security updates, including one for Safari 3.1.2. The security update APPLE-SA-2008-004 and Mac OS X 10.5.4 can be downloaded and installed from Apple Downloads.

Alias Manager This patch only affects users of Mac OS X v10.4.11 and Mac OS X Server v10.4.11. The update addresses an alias manager vulnerability described in CVE-2008-2308. According to Apple, a "memory corruption issue exists in the handling of AFP volume mount information in … Read more

On Thursday, the domains used by ICANN, the Internet Corporation for Assigned Names and Numbers, and IANA, the Internet Assigned Numbers Authority, were hijacked. A Turkish hacking group known as NetDevilz claimed =responsibility. There is no word on how the hijack was accomplished.

The group successfully redirected ICANN site visitors to a page with the following message:

According to SANS, changes to the ICANN site were corrected within … Read more

Jeff Moss, founder and director of Black Hat, on Thursday moderated the first-ever Black Hat Webinar, previewing five presentations to be given at the security conference in Las Vegas in August.

Moss said he was pleased that more than 1,000 people attended and admitted they were "expecting maybe a few hundred." Black Hat has already implemented RSS feeds, Twitter, and even a LinkedIn group.

"The Webinars will be much more than that," Moss said. In the future, he hinted, Black Hat will publish an editorial calendar, with a new Webinar at least once a month. … Read more

Last week a Dutch researcher rode free on the London transit system, having hacked the public transit system's card system; he used a clone of a paying passenger's transit cards. His point? The transit smartcards, which are used my millions worldwide, are vulnerable to attack.

Dr. Bart Jacobs of Radboud University in Holland used an ordinary laptop to show how to clone the Mifare Classic smartcard used in London's Oyster transit card. The Mifare Classic smartcard is used for worker access cards as well.

Once he obtained the key used by the London transit system, Dr. Jacobs … Read more

On Tuesday, the FBI announced the indictment of a former technology director accused of hacking into the system at a Houston organ bank and deleting patient files.

The indictment alleges that Danielle Duann, 50, illegally accessed and damaged LifeGift Organ Donation Center's database in November 2005, shortly after she was fired as director of information technology for the company. She is alleged to have deleted organ donation database records and accounting invoice files from the network. LifeGift said that all of the records were restored from a backup and that no patients were put into jeopardy.

At the time … Read more

On Tuesday, Microsoft issued new tools to assist Microsoft ASP and ASP.NET technologies against recent Web-based attacks.

In April attackers went after Microsoft SQL sites by injecting malicious JavaScript onto legitimate sites. The JavaScript would direct a browser to a server hosting malicious software infecting the desktop with a variety of exploits. At the time Microsoft insisted it was not the result of a vulnerability, but lack of best practices on the sites themselves.

The tools released Tuesday are designed to help Web developers mitigate against such attacks.

"These free tools offer detection and defense, as well as … Read more