Core Security Patterns Weblog

Looks like another malware storm…my buddy Microsoft Windows user is itching the head with a burning stick and cleaning up his entire data/malware center..as it is suspected that Conficker Worm (Conficker Version C and D) might have infected million of computers running MS Windows environment – not sure it affects both server and desktops. The worm is programmed to modify and hit on April Fool’s Day (tomorrow) – .  Everybody is yet to know, what kind of damage this worm will cause ! Seriously it is not a April fool joke.

The US-CERT suggests that all Microsoft Windows users must apply Microsoft security patch MS08-067 , and Microsoft provided some nice guidelines on how you can protect against the Conficker worm. It is also interesting to note, Microsoft announced a $250,000 bounty to identify those who implemented the Conficker worm. Not sure, they may be punishing or interested in hiring them !

The Register exposed this !  Cross-site Scripting (XSS) vulnerabilities allow attackers to steal user authentication cookies from AmericanExpress.com – According to an independent vulnerability assessment firm… the XSS bug still remains unfixed !! To read more…follow this link:

AMEX XSS Bug (Source: http://www.theregister.co.uk)

Last week, one of my friend attended Web 2.0 conference at Boston…who came back with this hilarious story.  One of the presentation he attended was all about how to gain and retain Web customers  (interesting preso..delivered by FatWire CEO) – towards the end of the presentation, the CEO wanted to drag the attention of the audience showing a “way” cool commercial for analyzing Web statistics. To his bad luck, the demo called to pull statistics from an adult Web site…”Playboy’s Cyber XXX”.   You may guess the rest of the story now….ofcourse it was a bit offensive to many of the audience and raised some heated conversations.

Not sure, where and what went wrong ? What poisoned the demo ? Is it due to an XSS attack or HTTP response spiliting or intentional half-naked packaging in hopes to hook the attendees   For those curious….here is the tail bit of story.

Looks like a real pic…not sure it is from Year 1884 ! To my surprise, this pic came through one of my Google search ! I did’nt post to offend our DHS folks