Two companies face CAN-SPAM,
other charges
By Grant Gross IDG
News Service
Two alleged "saturation" spammers, one based in Michigan
and the other operating out of Australia and New Zealand, face a
variety of legal charges, including the first charges under a new
U.S. anti-spam law, the Federal Trade Commission (FTC) announced
Thursday.
The two companies, Phoenix Avatar, based in the Detroit area, and
Global Web Promotions, have allegedly violated the Controlling the
Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act,
which went into effect in January. They also face charges of
marketing fraudulent products under the FTC Act. Spam allegedly
sent by the two companies was responsible for more than 889,000
consumer complaints to the FTC between Jan. 1 and April 24, the
largest numbers of complaints about any alleged spammers. More....
Sasser worm exposes patching failures
By Ellen Messmer Network
World,
Organizations that evaded last week's Sasser worm infestation
credited vigilant patching processes and preventative measures
such as installing server-based behavior-blocking software and
worm filtering gateways.
Anti-virus software, on the other hand, was of limited use in
stopping the four known variants of Sasser because the worm could
re-infect machines even with the most up-to-date virus signatures,
says Vincent Gullotto, vice president at Network Associates' Avert
Labs. "If you don't have the [Windows] patch in place, this
can happen," he says.
According to Mikko Hypponen, head of anti-virus research at
F-Secure in Helsinki, Finland, the Sasser worm variants don't
delete files or leave Trojans. This makes it a fairly benign worm
and a lot like the Blaster worm of last August. Like Blaster,
damage stems from Sasser's intense network scanning, which can
paralyze networks. More....
Sasser worm suspect confesses to German
police
News Story by James Mackenzie, Computerworld
MAY 08, 2004 (REUTERS) - German police have arrested an
18-year-old man who confessed to creating the "Sasser"
computer worm, believed to be one of the costliest Internet
attacks. In what police called the largest case of its kind, the
computer science student was arrested on yesterday after software
giant Microsoft gave German authorities a tip-off, police said.
"We are absolutely certain that this really is the creator
of the Internet worm because Microsoft experts were involved in
the inquiry and confirmed our suspicions and because the suspect
admitted to it," said Frank Federau from Lower Saxony police.
Microsoft, the FBI and German police had worked together to
find the suspect. More....
Common Security
Vulnerabilities in e-commerce systems
by K.
K. Mookhey, Security
Focus
1. Introduction
The tremendous increase in online transactions has been
accompanied by an equal rise in the number and type of attacks
against the security of online payment systems. Some of these
attacks have utilized vulnerabilities that have been published in
reusable third-party components utilized by websites, such as
shopping cart software. Other attacks have used vulnerabilities
that are common in any web application, such as SQL injection or
cross-site scripting. This article discusses these vulnerabilities
with examples, either from the set of known vulnerabilities, or
those discovered during the author's penetration testing
assignments. The different types of vulnerabilities discussed here
are SQL injection, cross-site scripting, information disclosure,
path disclosure, price manipulation, and buffer overflows.
Successful exploitation of these vulnerabilities
can lead to a wide range of results. Information and path
disclosure vulnerabilities will typically act as initial stages
leading to further exploitation. SQL injection or price
manipulation attacks could cripple the website, compromise
confidentiality, and in worst cases cause the e-commerce business
to shut down completely.
Wherever examples of such vulnerabilities are
given in advisories published by Bugtraq, we have given the
Bugtraq ID in square brackets. Details of the vulnerability may be
viewed by navigating to http://www.securityfocus.com/bid/<bid_number>
More....
Customers won't tolerate security breaches
Graeme Wearden
ZDNet UK
May 06, 2004 Latest research shows that firms who fall victim to hacking, viruses or phishing may have to worry about more than just patching up their systems
A survey, which was carried out by telecoms firm Energis, found the rate of customer attrition in the business-to-business sector rose by 47 per cent after a firm fell victim to hacking, a virus, a denial of service attack or a phishing fraud.
Energis spoke to more than 100 large companies or government agencies, and found nearly all of them had suffered a security breach in the last year. These organisations reported many of their existing customers had taken their business elsewhere because of these breaches and the customers that remained were spending on average four per cent less with them.
More....
More....
Vulnerabilities
