Ok – there are some new variants on the Sober worm circulating. I received one on an address that’s unfiltered (no virus/spam filtering) and must say, I can see people being duped into looking at the attachment. Sans has a post on it.. Sarc is calling it W32sober.x@mm and rates it at a threat level of three. I’ve seen many outlets tag it as sober.y
Category: Computers
-
More on Explorer vulnerability
Among other things… Sans has lowered the infocon to green, NOT that the threat is diminished, but there have been no new developments with regards to the announcement yesterday of a major Internet Explorer security vulnerability. Sans recommends browsing the web with firefox (with the noscript extension, so you can enable/disable javascript where you wish). There has not yet been evidence of an active attempt at exploiting the vulnerability, but the proof of concept code could be relatively easily changed.
-
Cleaning up after the Sony Rootkit
Sunbeltblog has a suggestion (from Ben Edelman) for SONY on how to get the word out to customers that they have the problem laden XCP/ rootkit/ trojan/ drm software that’s been burning up tech news… Distribute an ad through their own rootkit. It does, after all, “phone home” from time to time and…. it looks like a banner can be displayed. Details on Ben Edelman’s site.
-
Google analytics again…
Analytics seems to be churning on a bit better, no a bit over a week since it’s re-launch. There was a rocky start last week, but it looks like for the 4 sites I’m tracking I have data for 3 up to yesterday. One of those, I have data including this morning 10AM. It looks as though they’re catching up a bit then. I’m still puzzled by the one domain that’s missing stats entirely, they say the code is detected properly, but still no data. I think the gaps on the other sites have filled in (at least through yesterday.)
-
Watching Google’s domain registrations
Google has become such a dominant company…. it’s good to know someone is watching where they might be going tomorrow…. searchenginewatch.com has a list of some recent domain name registrations by Google. googlelibrary.org, googlemagazines.com, googlepapers.org, googlemicrofilm.com among others (usually the .net/org/biz variants…) Interesting to see where they may be going. There’s also a list (through the above article) of all domains registered by Google.
-
Mandriva 2006 review
Madpengiun now has a review up of Mandriva 2006. I’m still hoping soon to have time to sit down and upgrade on at least the laptop. The biggest problem the reviewer had was (slow?) performance under KDE which he suspected could be hardware specific. Overall it sounds like things are VERY well done, it looks like a nice interactive firewall, a la zonealarm is in there which the reviewer was pleased with.
-
More Sony lawsuit news… Texas files suit
The security fix is reporting on the latest lawsuit filed against Sony/BMG for the DRM rootkit known as XCP.
“Sony has engaged in a technological version of cloak and dagger deceit against consumers by hiding secret files on their computers,” Abbott is quoted as saying in a press release on his official Web site. “Consumers who purchased a Sony CD thought they were buying music. Instead, they received spyware that can damage a computer, subject it to viruses and expose the consumer to possible identity crime.”
-
More on Sony’s copyright infringement with their DRM Rootkit
“What a tangled web…” there is more today at freedom-to-tinker on the evidence that Sony (and or first4internet), have infringed on copyrighted code in their DRM software XCP which has been at the middle of quite a bit of controversy the last few weeks. Most of the coverage has been on some of the cloaking capabilities, the security vulnerabilities and the uninstaller vulnerabilities… but it looks fairly obvious that at least some GPL or LGPL code has been used without abiding by the terms of the GPL/LGPL
-
Exploit for Unpatched Internet Explorer vulnerability
Well…. buckle your seatbelts it’s going to be a bumpy start to the week.
the securityfix as well as incidents.org are reporting on exploit code that has been released that takes advantage of an unpatched Internet Explorer vulnerability. According to the Sans institute diary entry… they have tested the exploit code and it remotely launched the calculator application, so this is a remote code execution vulnerability and can have SERIOUS consequences.
-
Malicious .biz site and browser vulnerabilities
This from incidents.org as well… A user visited a webpage and got redirected to hxxp://iframebiz.biz/dl/adv443.php (tt changed to xx to protect anyone from getting there…)
(more…)