The ongoing Windows animated cursor (.ani) flaw attack just keeps getting worse.
Staying on top of the latest in software/hardware security research, vulnerabilities, threats and computer attacks.
Violet Blue is the author of The Smart Girl's Guide to Privacy. She contributes to ZDNet, CNET, CBS News, and SF Appeal.
Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years
Microsoft's out-of-band update for the critical -- and under attack -- animated cursor (.ani) vulnerability has finally crossed the finish line, one week ahead of Redmond's own schedule but more than three months after it was first reported by a private security research company.
eEye Digital Security has shaken up its top management, firing chief executive officer Ross Brown less than six months after promoting him to the top slot.Kamal Arafeh, who previously managed eEye's sales operations, will be the new CEO.
Sana Security has scooped up $12 million in a fifth round of funding and hired telco crash survivor Don Listwin to take over the corner office. Sana, which excels at behavior blocking software, is banking on the new CEO to find new customers for its Active Malware Defense Technology and figure out an exit strategy in a very tricky security market.
Microsoft plans to release an emergency, out-of-cycle Windows update on Tuesday, April 3, 2006 to patch the animated cursor (.ani) vulnerability currently being used in widespread malware attacks.
On the Full Disclosure mailing list comes this announcement from a group of anonymous security researchers: During one week (2007-04-02/08), new undisclosed vulnerabilities / flaws / exploitation techniques discovered in the latest versions of the Microsoft Windows Vista operating system and softwares will be publicly disclosed on this page. This project is launched as a challenge by an unofficial team of security experts.
A private security research outfit says it notified Microsoft about the animated cursor (.ani) code execution vulnerability since December 2006, a full four months ahead of yesterday's discovery of Internet Explorer drive-by attacks.
Spammers are using fake Internet Explorer 7 (Beta 2) downloads to lure Windows users into downloading a nasty backdoor Trojan.The fake downloads are part of a massive spam run that includes an official-looking graphic (see image below) linked to Web sites that auto-launch an executable named "ie7.
[UPDATE: March 29, 2007 @ 1:15 PM Eastern] Microsoft has confirmed that this is indeed a zero-day flaw that will require a security update. Although Internet Explorer is the primary attack vector, this is a vulnerability in the way Windows handles animated cursor (.