Get hold of yourself

Monday, August 3, 2009

Chinese Hackers Crack Windows 7 Activation Codes

The pirated version even tricks the computer and Microsoft's servers into believing it is a genuine copy, allowing it to avoid Microsoft's validation safeguards. The report said that the copied software was hacked via a disc stolen from Chinese computer maker Lenovo, but that the pirated version would work just as well on Dell and HP computers too.

Chinese hackers have cracked the activation codes for Windows 7, less than a month after Microsoft Relevant Products/Services released the first copies of the new operating system to computer makers, technology news site CNET reported Thursday.

The crack will allow fully functional, copied versions of the Ultimate Version of Windows 7 to be distributed over file-sharing sites even before the operating system is released to the public in October.
Read More about this at: http://www.enterprise-security-today.com/story.xhtml?story_id=00200059ERIC

Monday, July 20, 2009

PCI group releases wireless security guide

Merchants who need help in securing their wireless networks to comply with the PCI Data Security Standard now have a step-by-step guide.

The PCI Security Standards Council on Thursday released the wireless security guide, which was developed by its special interest group (SIG) on wireless technologies. The 28-page PCI DSS Wireless Guideline analyzes applicable PCI DSS requirements and provides recommendations for implementation.

Click the below link to download wireless security guide:

https://www.pcisecuritystandards.org/pdfs/PCI_DSS_Wireless_Guidelines.pdf

Source: techtarget

Thursday, July 16, 2009

Maturing cybercriminal economy buoyed by business savvy hackers

Buying and renting tools used by cybercriminals to conduct attacks and steal credentials is becoming much easier for the average person. "For Rent" signs hang on botnets, automated hacking toolkits are sold at bargain prices, and the data reaped by the criminal activity is sold and traded in online forums on a daily basis.

Researchers at networking giant Cisco Systems Inc. are warning of the increasingly sophisticated cybercriminal underground economy and how it could be attractive to those having trouble finding work or facing layoffs in a troubled global economy. Meanwhile, cybercriminals are borrowing some of the best strategies from legitimate companies and forming partnerships with one another to help make their illegal activities more lucrative, according to Cisco.

Mozilla warns of critical Firefox JavaScript vulnerability

Mozilla warned Tuesday that a critical flaw in its new Firefox 3.5 browser could be used to execute malicious code.

The vulnerability is in Firefox 3.5's Just-in-time (JIT) JavaScript compiler, Mozilla reported on its security blog. The flaw, which was disclosed Monday, can be exploited by an attacker who dupes a user into viewing a webpage with the malicious code, according to Mozilla.

Danish vulnerability clearinghouse Secunia rated the vulnerability highly critical in its security advisory.

Mozilla is working on a fix for the flaw, but said it can be mitigated by disabling JIT in the JavaScript engine and provided instructions in its blog post. "Note that disabling the JIT will result in decreased JavaScript performance and is only recommended as a temporary security measure," the organization noted.

Researchers Rate All Six Microsoft Patches as Critical

Microsoft rated three of six Patch Tuesday issues as critical, but security researchers say the other three can quickly escalate. Wolfgang Kandek of Qualys said the ISA, Publisher and virtualization vulnerabilities can give a remote attacker control of a computer. Andrew Storms of nCircle hopes for a more complete ActiveX patch later.

Microsoft on Tuesday released six bulletins as part of its monthly patch cycle. Three of the bulletins cover critical flaws, including two unpatched zero-day vulnerabilities. Three other bulletins address important risks that security researchers said can quickly escalate to critical.

Wolfgang Kandek, CTO of Qualys, said Microsoft's advisories should be addressed immediately because they allow an attacker to take complete control of a victim's computer.

Tuesday, July 14, 2009

Microsoft warns of new Office Web Components vulnerability

Microsoft issued an advisory Monday, warning of a new vulnerability in Office Web Components being actively targeted by attackers.The Office Web Components allow users to view spreadsheets, charts and databases on the Web. Microsoft said the vulnerability is in the Spreadsheet ActiveX Control, which is used by Internet Explorer (IE) to display the data in the browser. It is remotely exploitable when a person browses with IE and visits a malicious website. If successfully exploited, an attacker could gain the same user rights as the local user and gain complete control of a system, Microsoft said.

Cloud-based security services should start private

Many early stage cloud vendors have it backwards when it comes to offering cloud-based services. They implement Software as a Service (SaaS) first to demonstrate their vision and then develop enterprise integration features. But the right way to go about it is to support corporate clouds in early product releases.

IT is typically conservative about business risk and likes to retain control over sensitive data and applications. Security SaaS vendors may be better served by allowing IT to start by hosting its own private cloud service, integrated with existing data repositories and administrative systems and then provide a path to the full cloud application environment.