.:[ Jeremy Scott ]:.

Microsoft has released an out-of-cycle patch designed to address a serious flaw in its ASP.Net web application development toolkit.

The vulnerability, which has been under active attack for several weeks, creates a mechanism for attackers to read any file on a web application server. Microsoft rates the flaw as only “important”, while independent security watchers such the the SANS Institute’s Internet Storm Center say that rating underestimates the risk posed by the flaw to online shops built using Microsoft’s developer tools. The ISC has raised the InfoCon status of the flaw from green to yellow.

Read more…

Symantec has released a report on PDF malware titled “The Rise of PDF Malware”. It’s an interesting read with some good statistics and trends on the use of PDF files to exploit vulnerabilities.

Ironically, it is distributed as a PDF file.

Get the report here.

Fake Facebook password reset email leads to fake AV.
Attackers continue to abuse users of social networking sites with spam or malicious emails and posts. Facebook seems to be a favorite for most attackers as it has a huge user base, and attackers are almost guaranteed to get their message propagated quickly. You know how it is. Your wall continues to get littered with posts from all your friends and family to check something out that they should have never check out in the first place.

Any way, this latest campaign is yet another way to end up with a fake AV. The user is presented with an email message which suggests opening the attached zip file, in order to retrieve a newly-created password due to supposed changes made to the user’s Facebook account.

Don’t open it!

Hackers have updated a Trojan virus that bypasses sandbox insecurity on Adobe Air apps like Tweet Deck.

We thought Adobe had learned its lesson with the dependently exploitable Flash but it looks like Trojan attacks on Air say otherwise. Senior tech consultant at Sophos, Graham Cluley blogged yesterday about a fake Tweetdeck update that preys on Twitter users. Hackers used the bank holiday weekend to get users to click on loaded links for the fake critical Tweetdeck update that was a Trojan.

“The tweets are being posted from hacked Twitter accounts, and do not link to a legitimate update for TweetDeck”, said Cluley. “Instead, unsuspecting users are putting themselves at risk of infection by a Trojan horse.”

Twitter sent out a safety update yesterday, warning users not to download anything. “We’re sending password resets to accounts posting a fake TweetDeck update; don’t download that file!”

I know I watch Twitter for all my update news. Not.