Zack Whittaker

Zack Whittaker is a security writer-editor for ZDNet. He can be found on sister sites CNET and CBS News. He is based in the New York newsroom. You can send him secure email with his PGP key: EB6CEEA5.

Charlie Osborne

Charlie Osborne, a medical anthropologist who studied at the University of Kent, UK, is a journalist, freelance photographer and former teacher. She has spent years travelling and working across Europe and the Middle East as a teacher, and has been involved in the running of businesses ranging from media and events to B2B sales. Charlie currently works as a journalist and photographer -- with the occasional design piece -- and writes for ZDNet, CNET and SmartPlanet. She has particular interests in social media, IP law, social engineering and security.

Latest Posts

Researcher keeps 'carpet bomb' attack alive, despite patch

Researcher keeps 'carpet bomb' attack alive, despite patch

Security research Billy Rios posted an article today about the Apple Safari "Carpet Bomb" attack, discussing a new issue that, despite the patch which prevented a "blended" remote command execution attack when Safari was used in conjunction with IE on a Windows system, keeps the "Carpet Bomb" attack alive and well.

June 20, 2008 by in Security

Apple security team finds code execution holes in Ruby

Apple security team finds code execution holes in Ruby

A member of Apple's security team has discovered multiple serious security vulnerabilities in Ruby, the popular open-source scripting language.According to an advisory on the Ruby project site, Apple's Drew Yao reported at least six of the vulnerabilities, which can be exploited to cause a denial-of-service  condition or the execution of arbitrary code.

June 20, 2008 by in Apple

Phishers targeting Facebook users, fake logins spammed through hacked accounts

Phishers targeting Facebook users, fake logins spammed through hacked accounts

A currently active phishing campaign is circulating across Facebook end users' walls, using already compromised accounts to post the phishing links, tricking the user into thinking it's a legitimate friend sending the message in order to redirect them to a fake login page. The campaign is taking advantage of multiple typosquatted domains which are in a fast-flux state, namely, they respond to multiple IP addresses and change them automatically every three minutes in this particular attack.

June 20, 2008 by in Social Enterprise

Free Sourcefire tool pinpoints hostile MS Office files

Free Sourcefire tool pinpoints hostile MS Office files

Sourcefire, the company behind the popular Snort intrusion detection system, has released a freeware utility to help identify potentially threatening Microsoft Office files.The tool, called OfficeCat, can be used to process Microsoft Office documents -- Word, PowerPoint, Excel and Publisher -- determine if possible exploit conditions exist.

June 20, 2008 by in Microsoft

Microsoft blames 'human issues' for Bluetooth patch hiccup

Microsoft blames 'human issues' for Bluetooth patch hiccup

Microsoft has re-released its critical MS08-030 bulletin for Windows XP SP2 and SP3 users, warning that "two separate human issues" caused a major hiccup with the critical security patch.The original version of the patch, which corrects a remote code execution flaw in the Windows Bluetooth stack, failed to properly fix the vulnerability for Windows XP users, according to Christopher Budd, a program manager in the MSRC (Microsoft Security Response Center).

June 19, 2008 by in Enterprise Software

Security breach hits DivShare, unauthorized access to its database

Security breach hits DivShare, unauthorized access to its database

The popular document and media sharing service DivShare, suffered a security breach according to a security announcement posted by DivShare's support team earlier this week :Late last night we were alerted of a security breach that allowed a malicious user to access our database, which included user e-mail addresses and other basic profile information. No financial information has been accessed by any unauthorized parties.

June 19, 2008 by in Security

2008 Pwnie Awards

2008 Pwnie Awards

Don't forget to go and vote on the Pwnie Awards, which will happen at Black Hat Vegas again this year.  I don't want to campaign for votes, but I wouldn't be pissed if some of my loyal readers out there voted for me, Billy Rios, Rob Carter, and John Heasman and some of our interesting research that I've presented here on the blog.

June 19, 2008 by in Security

China detains web site defacer spreading earthquake rumors

China detains web site defacer spreading earthquake rumors

The Xinhua news agency is reporting that the web site defacer which I mentioned in a previous post regarding the use of web site defacements as tools for psychological operations, has been located and detained in less than a week after he defaced the Seismic Emergency and Public Center of the Guangxi province where he left a fake message on an upcoming earthquake that's going to hit China.

June 18, 2008 by in Security

Finjan uncovers half a gigabyte of stolen data on crimeware servers

Finjan uncovers half a gigabyte of stolen data on crimeware servers

Finjan's Malicious Code Research Center has uncovered a half of gigabyte of stolen data from US Healthcare organizations and from a major airline on crimeware servers in Argentina and Malaysia.A representative of Finjan stated:"Hackers incorporated sophisticated attacks using crimeware toolkits, Trojans, and Command and Control servers to drive traffic from a specific region with specific characteristics.

June 17, 2008 by in Tech & Work

Newsletters

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.
See All
See All

Top Stories