This Blog
Syndication
Recent Posts
Tags
Calendar
Archives
CA Security Advisor Research Blog
Find out what our research team is saying about the latest security threats in the CA Security Advisor blog
Browse by Tags
All Tags » Vulnerabilities (RSS)- advertising
- Anti-Spyware
- Anti-Virus
- attack
- CA
- codec
- fake codec
- fake updates
- internet
- jsp
- paypal
- phishing
- rogue security software
- Rossano Ferraris
- security
- spyware
- user permission
- video codec
- vulnerability
-
Compromised websites: a real danger for Internet users
It seems Internet users do not have any peace anymore. We have witnessed a lot of security issues on the Internet to date but never like this latest period, which can be named -to my personal perspective- as “the age of compromised websites”. The Anti... -
PayPal Closes a Phishing Vulnerability
Take a close look at this image. You can click to enlarge it. It looks like the PayPal login page, but some things are off. For one, the title is "Login - PayPal Phishing Proof of Concept". That is because this isn't the PayPal login page... -
Internet searches under attack: next in series
by Rossano Ferraris Another interesting case I would like to bring to your attention is the effect of the so-called “fake-codec” trojans. Here is what I figured out after searching the phrase “daily dawn” on the Google search engine. The screenshot reflects... -
Be aware of fake Microsoft Updates
by Rossano Ferraris The other day spammers spread two interesting emails to users throughout the Internet and attempted to make users believe these emails originated from Microsoft. The emails contained an alert that advised users of an undiscovered vulnerability... -
Ghosts and Ghouls
A famous quotation from the The Art of War is "If you know both yourself and your enemy, you will come out of one hundred battles with one hundred victories." A malware author following the principles of Sun Tzu might say "If you know both... -
The Culprit Isn’t Always a Trojan
The day after I got back from a 16 day trip to Europe, I opened a letter from an unknown company who informed me that information about my bank account had been removed by one of their employees. The employee sold the information to a data broker who... -
Robbery, is your data prepared?
A chill ran up my spine when I came to my front door and it was already open. A USB cable lay strewn across the doorway. I could hear a stereo speaker eerily buzzing inside. I pushed the swinging door aside and confirmed my fear. I was robbed! After a... -
The Security Risk of WiFi Networks
After trials, US operator T-Mobile USA has released two new handsets that enable users to communicate either over its cellular infrastructure or over WiFi. The technology behind this new service called HotSpot@Home is Generic Access Network (GAN), formerly... -
PocketPCMag Promotes Online Gaming...Just Not The Way You'd Think
It appears that the website pocketpcmag.com has been hijacked. At the time this article is written, webpages for articles dated June 2006 and May 2005 contain JavaScript code that lead to another page and script. The script uses an iFrame to redirect... -
Super Bowl XLI Password Stealer
A few days shy of one of the most important days of the year for sports fans across America, the website for the venue of Super Bowl XLI had a little surprise for its visitors. Earlier today, dolphinstadium.com, dolphinsstadium.com and proplayerstadium... -
Microsoft December Bulletin Release
The last monthly Microsoft security bulletin release for 2006 is out today, bringing the total number of bulletins for 2006 to 78. Microsoft published 45 bulletins in 2004, and 58 in 2005, so the upward trend is clear. Open issues Two recently reported... -
Microsoft November Bulletin Release
For this month's release, Microsoft has issued 6 bulletins addressing 13 vulnerabilities. Five of the six bulletins have a cumulative rating of Critical and one has a rating of Important. 11 days vs 2 months Patches for the XMLHTTP 4.0 ActiveX Control... -
Oracle October Quarterly Patch Release
For their quarterly October release, Oracle issued patches for a large number of vulnerabilities affecting a wide range of Oracle products. Oracle Database, Oracle Application Express, and Oracle Application Server are a few of the products being patched... -
Microsoft October Bulletin Release
On Tuesday, October 10, 2006 Microsoft released 10 bulletins addressing 26 vulnerabilities in Microsoft Windows, Office technologies, XML Core Services, and ASP.NET. Six bulletins are rated as critical, one important, two moderate, and one low. Office... -
WebViewFolderIcon SetSlice Exploited!
A recent vulnerability within the Windows shell is being exploited in the wild. The vulnerability is made accessible to attackers via ActiveX controls in Microsoft Internet Explorer and allows the arbitrary execution of code. Reports have surfaced that...
Print
Email
Rate