Symantec: Web Threats 2010

Came across this great report on the state of Web Threats this year. One of the key lessons from this report shows how cybercriminals are now focused on compromising existing web servers rather than bringing their own online. In fact, they found 90% of malicious websites are compromised sites.

Key reason for this, as explained by Symantec analyst Dan Bleaken:

The attraction of knowing that legitimate sites often come fully furnished with regular users and a good level of traffic in general, providing a ready pool of instant victims and eliminating the need to stimulate from scratch a flow of visitors to a newly established domain.

Another key stat: Only 6.9% of  compromised malicious sites had their infection removed within 7 days. Yes, 6.9%...meaning that 93% of these sites are online longer than a week.

You can find the full report at the URL below.

http://downloads.messagelabs.com/dotcom/Whitepaper_web_threats_2010_EMEA_UK_June10.pdf

Read rest of entry

News Storm

Here's some key stories that unfolded this week in security:

YouTube Victim of XSS Attack

On Sunday YouTube fell victim to a XSS attack redirecting users to different sites from fake anti-virus pages to porn to Canadian pharmacy. Google patched up the problem relatively quickly but the backlash on Twitter was tremendous. Here's some great posts by SecTechno, The Register, and the SunBelt Blog.


Adobe Launch Function Still Vulnerable

Adobe fixed the Launch function vulnerability...or did they? Turns out this can still be exploited pretty easily. Check out our blog post on the topic, and also check out the Didier Stevens post to prevent the vulnerability.

Movie Sites Hosting Malware


The Secure Home Networks blog reports on 425 domains leading to malware, all related to illegal movie downloads. While it's risky to download movies illegally anyway, for any number of reasons, it's nice to know the bad guys are still setup in this zone as well.

Other Interesting Posts

Targeted Attacks with Excel Files
Redirect on Event
New SQL Injection Making Rounds?

Read rest of entry

Global Spam Rate 89.3% According to Latest Symantec Report

Symantec recently released their Message Labs Intelligence report, highlighting some key stats in email and web based threats. According to the report the global spam rate is now 89.3%, with 80% of these being pharmaceutical spam. The report also goes into depth on the rash of World Cup threats that amassed in the months before the start of the World Cup.

Check out the full report below...

http://www.messagelabs.com/mlireport/MLI_2010_06_June_FINAL.pdf

Read rest of entry

Firefox 4 Beta 1 Released!

The long awaited Firefox 4 Beta 1 has been released. This includes tons of changes, including tab placement and other enhancements for CSS and HTML5. Download link and release notes are linked below...check it out!

http://www.mozilla.com/en-US/firefox/all-beta.html
http://www.mozilla.com/en-US/firefox/4.0b1/releasenotes/

Read rest of entry

Launch Action Still Vulnerable

Adobe release a patch last week to finally patch to limit the vulnerable Launch action that could be used to run script from Adobe Reader. Turns out the patch is not really complete and the Bkis Blog has found ways around this. 

It took Adobe 3 months to issue a patch for this to begin with, are we going to have to wait another 3 months?

In the meantime Didier Stevens, who originally found the problem has done some research and found why this is taking place. Apparently, Adobe has used a blacklist type method to allow or deny the Launch action. 

Stevens has provided a workaround in his blog, allowing users to go into the registry and add to the "blacklist" of non-allowed commands. Check out his post below for more info on how to do this from the Windows Registry. For those not comfortable fooling around in there, let's hope Adobe is quicker to get a better working patch out this time.

http://blog.didierstevens.com/2010/07/04/quickpost-preventing-the-launch-action-cmd-exe-bypass/

Read rest of entry

Adding Twitter Updates with Style

Getting back into things, some things just weren't lining up in the blog template any longer, so we decided to scrap the whole thing and rebuild using the same template. Strangely enough though, the Twitter widget provided by Blogger doesn't allow any styling, which made the Twitter updates almost impossible to read.

After a while of tinkering with the widgets and trying to find the right one to let me do this I finally found the answer at the post below. This shows exactly the code you need to just add a HTML/JS widget and copy the code in - exactly what I was looking for!

http://www.bloggerbuster.com/2008/04/add-customized-twitter-widget-to-your.html

Now you can style your Twitter updates as you wish, instead of relying on the lame widget to do so. Thanks BloggerBuster!

Read rest of entry

We're Back!

Green Cloud Security is back after a long layoff, mostly working on other projects. It's exciting to dig back into the site, and security in general. You can expect more of the same posts, coverage on the latest threats, threat reports, security tips and more. 

Have a great day everyone!

Read rest of entry