Guide For Teen-Proofing Facebook Released

If you are a parent and you want your teen to be able to use Facebook without either of you having to worry that your child is sharing too much personal information, there's a new resource that can help.

A "Parents' Guide to Facebook," being unveiled today, offers hands-on, step-by-step instructions and illustrations, as well as information on safety, privacy, and reputation protection; and it covers the use of Facebook on computers and cell phones. It also offers specific recommendations for configuring privacy settings, noting that the default Facebook settings are not as privacy protective as they should be, even for adults.

The guide is being debuted at the fourth annual Family Online Safety Institute conference by the iKeepSafe Coalition and Connect Safely, a project of the nonprofit Tech Parenting Group. (CBS.com contributor Larry Magid of SafeKids.com is a co-director of that group.)

Facebook also has its own Safety Center, launched earlier this year, that provides information geared toward parents and teens.

The guidance will no doubt be a welcome resource for parents who have trouble keeping up with their teens' activities, both online and offline. A recent survey found social networks are not doing enough to protect teens' privacy. The guide may even help teens avoid the mistake one girl made recently when she accidentally invited thousands of strangers to her private house party.


Read more: http://news.cnet.com/8301-27080_3-20021992-245.html?tag=mncol;title#ixzz14jahVRh9

Adobe: Flash, Reader Hole Used In PDF Attacks

A new critical vulnerability in Flash and Adobe Reader and Acrobat 9.x is being exploited to attack computers running the popular PDF viewer software, Adobe warned today.

Adobe is not currently aware of attacks targeting Flash Player, the company said in a blog post.

The bug is in Flash Player 10.1.85.3 and earlier versions for Windows, Mac, Linux, and Solaris, and Flash Player 10.1.95.2 and earlier for Android. It also is in the authplay.dll component in Reader 9.4 and earlier 9.x versions for Windows, Mac, and Unix, and Acrobat 9.4 and earlier 9.x versions for Windows and Mac. The component renders Flash content in the PDF viewer.

Adobe Reader and Acrobat 8.x and Reader for Android are not impacted by the flaw, the company said.

The hole could be used by an attacker to take control of the system. In the existing attacks, a Trojan is being dropped onto victims' computers that steals sensitive data and loads other malware, according to ThreatExpert.

Adobe is working on a fix and expects to provide it in an update for Flash Player by November 9 and an update for Reader and Acrobat 9.x during the week of November 15.
Workarounds are included in this security advisory.

This afternoon, Adobe issued a fix for a hole in Shockwave Player that was disclosed last week. Earlier this month, the company plugged 23 holes in Reader and Acrobat, including two being used in attacks.

The company is adding sandbox technology designed to add more layers of protection to the next version of Adobe Reader, Reader X, which is due out by mid-November.

Updated 12:50 p.m. PDT with Adobe releasing fix for Shockwave Player hole.


Read more: http://news.cnet.com/8301-27080_3-20021055-245.html?tag=mncol;title#ixzz144Imxx00

Report: United States Is World's Top Spammer

The United States is now the top source of spam, accounting for almost 19 percent of all junk e-mail sent throughout the world, according to a new report out today from Sophos.

The security firm's "Dirty Dozen" report highlighted the top 12 countries responsible for the world's supply of spam during the third quarter. With the United States generating almost 2.5 times more spam than second-place India, the country now accounts for almost one in five junk messages. The United States' 18.6 percent share of all global spam also showed a significant jump from its 15.2 percent share in the second quarter.

Among the other top sources of spam, according to Sophos, are India with 7.6 percent of all global junk mail, Brazil with 5.7 percent, France with 5.4 percent, and the U.K. with 5 percent.

The report also highlighted the growth in spam from social-networking sites over the third quarter. Last month, Twitter users were hit by a "MouseOver" exploit that redirected them to third-party spam sites if they simply hovered over a link in a tweet. And over the summer, Facebook users faced their own scams, ones that attempted to trick them into filling out bogus surveys, with the information then used to spam their friends.

Much of the spam now being generated around the world isn't coming from the spammers themselves but from botnets, networks of infected computers directed to send junk mail to other unsuspecting users.

"You should never even be tempted to open a spam message out of curiosity, as it can only take a second to effectively hand over control of your computer to the spammers," Graham Cluley, senior technology consultant at Sophos, explained in a statement. "If your computer does become part of a botnet, you're also inviting further malware infections, which may compromise your personal or banking information."

To protect their PCs from infection by bots and other malware, Cluley advises users to run antispam and anti-malware tools, behave sensibly when online, and stay updated with the latest security patches.


Read more: http://news.cnet.com/8301-1009_3-20019611-83.html?tag=mncol;title#ixzz12qFP4bjw

Microsoft To Fix 49 Holes In Windows, IE, Office, And .NET

Microsoft will fix a record 49 vulnerabilities in its Patch Tuesday release next week that will involve 16 security bulletins affecting Windows, Internet Explorer, Office, and the .NET framework.

Four of the bulletins carry a "critical" rating, 10 are rated "important," and two are "moderate," according to the advisory.

They affect specifically Windows XP, Vista, Windows 7, Windows Server 2003 and 2008, Microsoft Office XP Service Pack 3, Office 2003 Service Pack 3, Office 2007 Service Pack 2, Office 2010, Office 2004 for Mac and 2008 for Mac, Windows SharePoint Services 3.0, SharePoint Server 2007, Groove Server 2010, and Office Web Apps.

Microsoft did not indicate whether two unpatched Windows holes that are being exploited by the Stuxnet worm will be fixed next week. Microsoft previously patched two other zero-day vulnerabilities in Windows the worm was using and said during last month's Patch Tuesday release that two more holes being used by Stuxnet needed to be plugged. Stuxnet spreads through the Windows vulnerabilities but was designed to target industrial control and critical infrastructure systems running Siemens software.

This is the highest number of vulnerabilities fixed in one Patch Tuesday release; the previous record was 34 holes fixed in August.

Meanwhile, in a tacit acknowledgment that after-the-fact patching isn't enough, Microsoft is proposing new ways to address security issues online. Earlier in the week, Microsoft released a paper (PDF) written by Scott Charney, corporate vice president for Microsoft's Trustworthy Computing, in which he proposes applying public health models to the Internet.

He suggests that computers could be given "health certificates" indicating whether they have the latest software patches, their firewalls are installed and correctly configured, antivirus programs are up-to-date, and that they are free of malware. If the health certificate indicates that something is amiss, an ISP could notify the computer user about the problem, and if the computer is being used in an attack, the bandwidth could be throttled to curb that activity, he said.

Comcast is already taking action to alert its Internet-using customers to possible malware on their computers as part of its anti-botnet service. And Brian Krebs reports that the FCC may do more to encourage ISPs to be more proactive in protecting consumer PCs.


Read more: http://news.cnet.com/8301-27080_3-20018933-245.html?tag=mncol;title#ixzz1253q6VPW

Dozens Charged In Use Of Zeus Trojan To Steal $3 Million

The FBI and the U.S. Attorney's office in southern New York announced charges today against 37 people accused of being part of an international crime ring that stole $3 million from bank accounts by infecting computers with the Zeus Trojan and other malware.

Between federal and state charges, more than 60 people total are being charged in the operation, officials said.

Ten people were arrested today by federal and New York law enforcement officers and another 10 were previously arrested in the U.S. as part of a coordinated takedown, authorities said. Seventeen people are still being sought in the U.S. and abroad, officials said. The defendants named in the documents, unsealed by the court today, were all listed as being from Eastern Europe and face federal charges.

Separately, 10 people were charged earlier today in England for similar Zeus-related crimes.

The Zeus Trojan was identified earlier this year as a key factor in the construction of a botnet that infected tens of thousands of computers around the world.

The defendants charged in Manhattan federal court today include alleged managers of the operation as well as alleged money mules recruited to open bank accounts for laundering money and a person accused of obtaining false foreign passports for mules.

The group allegedly recruited mules by placing ads on Russian language Web sites seeking students with J-1 visas, who could open bank accounts in the U.S.

One of the purported victims was identified as a municipal entity in Massachusetts.

Some of the alleged mules are accused of retrieving money from breached brokerage accounts at eTrade and TD Ameritrade. Other defendants allegedly received stolen money from wire transfers to bank accounts in Asia or by withdrawing money from ATMs in New York, the documents indicate.

The investigation appears to have been triggered when New York police detectives went to a Bronx bank in February to investigate a suspicious $44,000 withdrawal, according to a news release issued by the FBI, the U.S. Attorney's office, the New York Police Department, and other agencies.

The charges range from bank fraud and false use of passport to money laundering and conspiracy to commit wire fraud. Maximum prison sentences range from 10 years to 30 years and fines from $250,000 to $1 million per count.


Read more: http://news.cnet.com/8301-27080_3-20018177-245.html?tag=mncol;title#ixzz112wQTfox

Stuxnet Worm Hits Iranian Nuclear Plant

Iran's official news agency said today that a sophisticated computer worm purportedly designed to disrupt power grids and other such industrial facilities had infected computers at the country's first nuclear-power plant but had not caused any serious damage.

The Stuxnet worm, which some see as heralding a new era of cyberwarfare, appeared in July and was already known to be widespread in Iran. In fact, its high concentration there, along with a delay in the opening of the Bushehr plant, led one security researcher to hypothesize that Stuxnet was created to sabotage Iran's nuclear industry.

In addition to emphasizing the threat posed by the worm, which could be used to remotely seize control of industrial systems, today's news could well add to speculation about Stuxnet, the sophistication of which has caused some to suspect that a nation state, such as Israel or the U.S., might be behind its creation.

The worm exploits three holes in Windows, one of which has been patched, and targets computers running Siemens software used in industrial control systems.

Mahmoud Jafari, the project manager at the Bushehr plant, said the worm "has not caused any damage to major systems of the plant" and that a team was working to remove it from several computers, according to Iran's IRNA news agency, which was cited in a report by the Associated Press.

Jafari said the infection involved the personal computers of several staff members working at Bushehr and would not affect plans to open the nuclear plant in October, the AP reported.


Read more: http://news.cnet.com/8301-1009_3-20017651-83.html?tag=mncol;title#ixzz10lUCBP1g

Report: Half Of Apps Have Security Problems

This chart shows the source of application and the failure rate for security acceptance based on how critical the app is to the business.
(Credit: Veracode)


More than half of software used in enterprises has security problems, according to a new report to be released today from Veracode, an application security company.

Veracode looked at more than 2,900 applications over an 18-month period that were used by its cloud-based customers and found that 57 percent of all the apps were found to have unacceptable application security quality.

Eight out of 10 Web apps failed to meet the OWASP (Open Web Application Security Project ) Top 10 requirement that is necessary to achieve PCI (payment card industry) compliance for use in financial and e-commerce sites, Veracode said.

The report finds that third-party code, which is growing in use in enterprises, is often insecure. Third-party suppliers failed to achieve acceptable security standards 81 percent of the time, the report said.

Meanwhile, cross-site scripting remains the most common of all application vulnerabilities, and .NET applications showed "abnormally high" numbers of flaws, Veracode said.

"A lot of work still needs to be done around the work of software security," Sam King, vice president of product marketing at Veracode, told CNET.

Also on Wednesday, WhiteHat Security released a report that found that the average Web site had nearly 13 serious vulnerabilities.