websense

The next iPhone will be unveiled tomorrow, Facebook partners with Websense to check for malicious links, and a major security vulnerability in HTC Android phones reveals a huge amount of personal data.

Links from Monday's episode of Loaded:

Former security company Finjan has filed a lawsuit against five companies--McAfee, Symantec, Webroot Software, Websense, and Sophos--claiming they are in violation of its patents.

Finjan is asking for financial damages and an injunction to stop the five security companies from selling software allegedly tied to the patents.

The lawsuit, filed Monday in U.S. District Court for the District of Delaware, targets two patents.

The first, Patent No. 6,092,194, is for a "system and method for protecting a computer and a network from hostile downloadables" and covers both an interface and a security policy to determine … Read more

Security firm Websense has put out an advisory warning Web site owners about malicious code that redirects surfers to seemingly safe sites.

About 40,000 Web sites appear to have been compromised with rogue JavaScript code that redirects Web surfers to a fake Google Analytics site, after which they get passed onto a site that tries to exploit Internet Explorer or Firefox vulnerabilities to infect that PC with malware, according to a Websense researcher quoted by Computerworld. Just for good measure, if the site can't find a browser vulnerability, it tries to trick the user into downloading a Trojan.… Read more

Within hours of settling the U.S. presidential election on Tuesday, spam seen worldwide began incorporating the name and image of Barack Obama, according to various security vendors. The U.K.'s Sophos reported 60 percent of all spam seen by the lab on Wednesday was in some way Obama related.

One piece of spam alleges to contain a link to video of Obama's acceptance speech. If you follow the video link within the e-mail message you will be taken to a Web page where you'll be asked to update your Adobe Flash Player with a file, adobe_flash9.… Read more

Recent e-mails stating that the U.S. has already attacked Iran and, in some cases, also offering links to a video purportedly from a soldier, are not to be believed, according to Websense. The security vendor said in an advisory Wednesday that it has linked the provocative e-mails to the Storm worm.

Storm got its name because it first took advantage of a huge winter storm in Northern Europe in early 2007. Since then, it has used a variety of social engineering tricks, including the use of political themes, to get unsuspecting users to open its malicious payload.

This time … Read more

Comparisons between two mass Javascript injection attacks suggest they may be related, according to a security company. The latest attack has compromised various sites including one United Nations and several UK government sites with links to malicious servers.

On Tuesday Websense reported seeing distinct similarities between attacks staged earlier this month and over the weekend. Specifically, they cite the use of the same tool to execute the attack being resident on the malicious server. Last summer various groups used the MPACK toolkit to propagate a similar series of Javascript injections.

Javascript injections are browser attacks and require no more effort … Read more

LogLogic, a software company with an open-source twist to the business of monitoring and analyzing server log files, has hired software industry veteran Pat Sueltz to be its new chief executive.

Sueltz has made the rounds in the software industry, working at IBM, Sun Microsystems, Salesforce.com, and most recently, SurfControl, which as CEO Sueltz sold to Websense for more than $400 million in April.

LogLogic sells proprietary software but also made an open-source move in 2006 with a component called Lasso, governed by version 2 of the General Public License (GPL).

LogLogic's acting CEO, Dominique Levin, now is … Read more

Over the weekend, thousands of legitimate English-language Italian Web sites fell victim to one line of code. Taking advantage of the trust the users have in the sites they visit, the malicious code silently redirects browsers via JavaScript to servers containing a variety of drive-by exploits. If the visiting computer is unpatched for a variety of operating system, browser, and specific application flaws, malicious code is downloaded. Once installed, the new software can then be used to steal personal information or enlist a compromised machine in attacks on other machines. According to security vendor Websense, the attack now affects over … Read more

The Connecticut attorney general has launched an investigation into the compromise of up to 17,000 of Pfizer employees, including some 300 employees within his home state. Pfizer would not comment on when the breach occurred other than to say it involved a Pfizer employee who had taken the data home on a laptop, a machine that subsequently became compromised. The data, including the employees' name, home address, bonus information, and Social Security number, was surreptitiously uploaded and later appeared on an Internet site. Pfizer did not know how much of that information had been copied or used by others. … Read more