Stories by Lucian Constantin

Mayor of New Jersey town arrested on hacking and conspiracy charges

The mayor of West New York, New Jersey, was arrested together with his son on Thursday, for allegedly hacking into a website that criticized him and his administration.

By Lucian Constantin | 25 May, 2012 15:45

Tags: cybercrime, Access control and authentication, data breach, Criminal, legal, intrusion, security

Researchers propose TLS extension to detect rogue SSL certificates

A pair of security researchers have proposed an extension to the Transport Layer Security (TLS) protocol that would allow browsers to detect and block fraudulently-issued SSL certificates.

By Lucian Constantin | 24 May, 2012 20:35

Tags: pki, privacy, online safety, security, Web servers, software, Internet Engineering Task Force

Yahoo leaks private key, allows anyone to build Yahoo-signed Chrome extensions

Yahoo was forced to release a new version of its Axis extension for Google Chrome after the original one contained a private key that allowed anyone to digitally sign extensions in Yahoo's name.

By Lucian Constantin | 24 May, 2012 16:41

Tags: encryption, security, browsers, applications, software, search engines, internet, Yahoo

Bredolab botnet author sentenced to 4 years in prison in Armenia

The creator of the Bredolab malware received a four-year prison sentence in Armenia on Monday for using his botnet to launch DDoS (distributed denial-of-service) attacks that damaged multiple computer systems owned by private individuals and organizations.

By Lucian Constantin | 23 May, 2012 15:50

Tags: security, malware, legal, cybercrime

Banking malware monitors victims by hijacking webcams and microphones, researchers say

A new variant of SpyEye malware allows cybercriminals to monitor potential bank fraud victims by hijacking their webcams and microphones, according to security researchers from antivirus vendor Kaspersky Lab.

By Lucian Constantin | 23 May, 2012 02:07

Tags: spyware, security, scams, malware, kaspersky lab, Identity fraud / theft, fraud, data protection, data breach, Access control and authentication

Cross-browser worm spreads via Facebook, security experts warn

Malware writers have used Crossrider, a cross-browser extension development framework, to build a click-fraud worm that spreads on Facebook, security researchers from antivirus firm Kaspersky Lab said on Monday.

By Lucian Constantin | 22 May, 2012 02:34

Tags: software, security, online safety, malware, kaspersky lab, Facebook, browsers, applications

Zeus variant tricks Facebook, webmail users into exposing card details

A new variant of the Zeus trojan tricks users into exposing their debit card details by displaying rogue offers when they visit Facebook, Gmail, Yahoo and Hotmail, according to researchers from security firm Trusteer.

By Lucian Constantin | 16 May, 2012 06:17

Tags: social networking, security, mail, Internet-based applications and services, internet, Facebook

Wikipedia warns users about malware injecting ads into its pages

Visitors to Wikipedia who see advertisements on the site have most likely fallen victim to a browser-based malware infection, Wikimedia Foundation, the organization operating the website, said on Monday.

By Lucian Constantin | 16 May, 2012 04:33

Tags: Wikimedia Foundation, social media, security, malware, Internet-based applications and services, internet

Hackers break into bitcoin exchange site Bitcoinica, steal $90,000 in bitcoins

Bitcoin exchange site Bitcoinica suspended its operations on Friday after hackers managed to steal 18,547 bitcoins -- valued at about US$90,000 -- from its online wallet.

By Lucian Constantin | 15 May, 2012 08:41

Tags: security, Internet-based applications and services, internet, Bitcoinica

Amnesty International's UK website compromised to infect visitors with cyberspying malware

The U.K. website of Amnesty International, a human rights watchdog organization, was compromised by hackers, who used it to infect visitors with a remote access Trojan horse program known as Gh0st RAT, security firm Websense reported on Friday.

By Lucian Constantin | 12 May, 2012 01:41

Tags: security, malware, Exploits / vulnerabilities, Amnesty International

APT attackers are increasingly using booby-trapped RTF documents, experts say

Booby-trapped RTF documents are one of the most common types of malicious Microsoft Office files that are used to infect computers with advanced persistent threats (APTs), according to security researchers from Trend Micro.

By Lucian Constantin | 11 May, 2012 00:26

Tags: trend micro, spyware, sophos, security, Patch management, patches, malware, Exploits / vulnerabilities, Desktop security

Police-themed ransomware starts targeting US and Canadian users

A ransomware application that locks computers and asks their owners to pay fines for allegedly violating several laws through their online activity is targeting U.S. and Canadian users, malware experts from security firm Trend Micro said on Wednesday.

By Lucian Constantin | 10 May, 2012 01:45

Tags: trend micro, security, scams, online safety, malware, Desktop security

PHP patches actively exploited CGI vulnerability

The PHP Group has released PHP 5.4.3 and PHP 5.3.13 on Tuesday in order to address two remote code execution vulnerabilities, one of which is being actively exploited by hackers.

By Lucian Constantin | 09 May, 2012 22:44

Tags: Web servers, software, security, php, patches, Exploits / vulnerabilities

Financial malware tricks users with claims of free credit card fraud insurance

A piece of financial malware called Tatanga attempts to trick online banking users into authorizing rogue money transfers from their accounts as part of the activation procedure for a free credit-card fraud insurance service purportedly provided by their banks, security researchers from Trusteer said Tuesday.Tatanga is an online banking Trojan horse that was first discovered in May 2011. It is able to inject rogue Web pages into browsing sessions and affects nine different browsers, including Internet Explorer, Mozilla Firefox, Google Chrome, Opera and Safari.The malware is known to use social engineering techniques against victims in order to bypass security measures enforced by banks, like one-time passwords (OTPs) or transaction authorization numbers (TANs).A new Tatanga configuration detected recently by Trusteer displays a rogue message inside the browser when the victim authenticates on their bank's website, claiming that their bank is offering free credit-card fraud insurance to all customers.The message claims that the new service is provided in partnership with Visa and MasterCard and covers losses that might result from fraudulent online transactions performed with the victim's credit or debit card. The malware grabs the user's real account balance, rounds it up, and presents the result as the allegedly insured sum.The rogue message includes a bank account number that's supposed to be the victim's new insurance account opened by the bank. However, in reality, this account belongs to a money mule -- an individual paid to receive money from fraudulent activity on behalf of cybercriminals -- said Ayelet Heyman, a security researcher at Trusteer, in a blog post Tuesday.The user is told that to activate the service they need to authorize a transaction from their bank account to their new insurance account. In order to do this, they need to input the transaction authorization code sent by their bank to their mobile phone number.This code allows the malware to finalize the rogue transfer in the background and send the victim's money to the money mule. "In all likelihood, the victim does not expect any funds will be transferred out of their account," Heyman said.The maximum sum that is transferred by the malware in a single transaction is €5,000 or about US$6,500. "We can assume that fraudsters have identified this amount (5,000 Euros) as the upper threshold that triggers the bank to address the transaction as high risk," Heyman said via email.The rogue message displayed by the Tatanga configuration analyzed by Trusteer is written in Spanish, which suggests that it targets users in Spain or other Spanish-speaking countries. The company hasn't seen a version of this attack in a different language yet, but the malware is known to have targeted users in other European countries and the U.S. in the past, Heyman said via email.The Trusteer researcher advises users to call their banks over the phone and check the validity of sudden announcements or requests that appear on banking websites. If an online banking website suddenly starts asking users for sensitive information like card security codes or PIN numbers, it's most likely because of a malware infection, he said via email.Users should also install the security software recommended or supplied by their financial institution and should use some type of browser-based security solution that prevents financial fraud, Heyman said.

By Lucian Constantin | 09 May, 2012 02:46

Tags: Trusteer, security, scams, online safety, malware, Identity fraud / theft, fraud

PHP working on new patch for critical vulnerability after initial one failed

The PHP Group plans to release new versions of the PHP processor on Tuesday in order to patch two publicly known critical remote code execution vulnerabilities, one of which was improperly addressed in a May 3 update.

By Lucian Constantin | 07 May, 2012 21:51

Tags: Web servers, software, security, php, patches, Exploits / vulnerabilities

Twitter Feed

  • rohan_p RT @Techworld_AU: Gear and gadgets at @CeBITAUS 2012, Sydney http://t.co/J1Sch1sX #cebit2012
    1 day, 2 hours
  • Techworld_AU Gear and gadgets at @CeBITAUS 2012, Sydney http://t.co/J1Sch1sX #cebit2012
    1 day, 2 hours
  • HamishBarwick CeBIT 2012: Will NBN speed up freight delivery times? http://t.co/gaZyjOlH #cw #cio #tw #CeBIT2012 #nbn
    1 day, 22 hours
  • HamishBarwick CeBIT 2012: NAB calls for mobile app security overhaul http://t.co/3Z3ZPUPq #cw #cio #tw #CeBIT2012 #infosec
    2 days, 1 hour
  • rohan_p RT @Techworld_AU: BigPond Games Arena, Games Shop hit by hackers http://t.co/OXNPeDfL #bigpond #infosec #security
    2 days, 4 hours

Whitepapers

- + c

Latest News

- + c
more