The U.K's Dedicated Cheque and Plastic Crime Unit (DCPU) have recently uncovered state of the art social engineering scheme, where once backdoored, chip and PIN terminals were installed at retailers and petrol stations in an attempt to steal the credit card details passing through.
A currently active malware campaign taking advantage of a known social engineering tactic, namely, to entice the spammed user into clicking on a site with a fake news item in order to trick them into installing a fake Flash player (flashupdate.exe; get_flash_update.
Right after the U.S Independence Day fireworks, Storm Worm latest campaign launched a couple of hours ago, is back online this time attempting to once again exploit client-side vulnerabilities, this time serving iran_occupation.
What would the perfect phishing attack from a social engineering perspective? The one that compared to using typosquatted domains impersonating the bank's web application directory structure is in fact using the bank's legitimate domain names as redirectors due to XSS flaws within.
With Facebook persistently under attacks from phishers and malware authors, looking for creative ways to efficiently exploit its users base, Facebook's security team has silently introduced a new "security warning feature" alerting its users on the potential maliciousness of the third-party site they are about to visit. Is the newly introduced featured a PR move, and how applicable is this approach during an ongoing attack?
A XSS worm was crawling across Justin.tv, the popular lifecasting platform at the end of June, details of the incident emerged in the middle of last week.
In a security bulletin issued two days ago, Skype's latest version fixes a File URI Security Bypass Code Execution Vulnerability originally reported by Ismael Briones : Remote exploitation of a security policy bypass in Skype could allow an attacker to execute arbitrary code in the context of the user.The "file:" URI handler in Skype performs checks upon the URL to verify that the link does not contain certain file extensions related to executable file formats.
A Storm Worm's Independence Day campaign is circulating online using email as propagation vector, attempting to trick users into visiting a Storm Worm infected host, where a multitude of what looks like over five different exploits attempt to automatically infect the visitors next to the malware binary fireworks.exe.
Facebook, the second most popular social networking site in the U.S according to Nielsen, is currently vulnerable to a critical XSS, allowing the injection and execution of malicious scripts within the popular site.
How realistic is an attack that successfully hijacks a domain by social engineering the domain's registrar? Pretty realistic according to ICANN's recently released advisory on preventing Registrar Impersonation Phishing Attacks :In this Advisory, SSAC describes generic forms of this type of attack.