Security News

The value of security certifications continued to increase in Q1 2009, proving that certs could be a worthwhile investment for those looking to boost their salaries.

Adobe Reader and Acrobat contain memory corruption errors that could be exploited by an attacker to execute arbitrary code.

From The Daily WTF: Johnny was what you might call a “gym rat.” In incredible shape from almost-daily gym visits, a tight Lycra tank top, iPod strapped to his sizable bicep, underneath which was a large black tribal tattoo. He scanned his finger on his way out, but the turnstile wouldn’t budge. “Uh, just a second,” the receptionist furiously typed…

Half of information security professionals are intending to put plans for collaboration on hold over security concerns, according to a survey by Webroot.

Organisations do not know enough about the source, reason and frequency of data leaks, and more incentives need to be put in place to encourage better data protection, according to a panel discussion at the Infosecurity Europe show in London.

In one of its first major moves in acquiring virtual security technology firms, Trend Micro has bought Third Brigade, a virtualisation security and compliance software company based in Canada.

The level of spam flooding inboxes is at its highest level in more than a year, according to researchers.

Microsoft has announced that it will close off a component in Windows which is notorious for allowing covert malware attacks.

OpenDNS blogged about a new feature called SmartCache

If you ask for a DNS resolution, and it can’t contact the authoritative DNS server or the server returns a SERVFAIL they will respond with the last known good IP address. They dub this “one of the most significant DNS innovations of the last 25 years.” It is a opt-in setting.

Hmmm.

Image spam up, flu keywords take off

I remember several years ago learning about how CAPTCHAs work. Companies were developing exciting, interesting, cute and fuzzy new types of CAPTCHAs using animal faces and other images, in order to outsmart the captcha crackers.

The fact is that many common captchas that show numbers and letters can be hacked by computer programs. And another problem is that the better captchas are often illegible even to humans–mostly because the captcha itself is illegible, not because the humans aren’t up to snuff.

Clearly the CAPTCHA system in place now is a highly flawed system. Not only is it ineffective, but it also blocks people who genuinely are human and want to use a site. I can’t say how many comments I’ve been about to leave on articles or blogs, which I’ve abandoned cuz I didn’t want to jump through the captcha hoop. Ridiculous.

So why haven’t they been replaced by more effective, smarter captcha types, the ones I was studying about years ago? Well, it’s because those really aren’t any better. Many captchas get broken by human scammers as much as super intelligent computer crackers.

There really is a human on the other end breaking the captcha, laborers getting paid a penny or less per catpcha they crack, hired by scammers. Even if the job requires robot-like and monotonous tasks, the hired hands are still smarter than the captcha programs.

Once cheap labor with human intelligence starts being employed to overcome the security programs we have in place, the game is pretty much over. We’ll still need captchas and security programs to catch the bulk of the problem, but no computer program for security in the world is going to be able to overcome the real zombie army. The real zombie army isn’t made of computer bot programs secretly infesting unwary grannies’ computers–just the automatons willing to work for next to nothing for scammers.

Why do they do this? Well, the money isn’t very good, but it’s there. Everyone needs a job. So, I would have to conclude the real problem is poverty that would drive people to that kind of work.

We can’t build a security program that will overcome that kind of scam system, or root out the cause of the problem. It’s something we have to do socially, and globally, instead.

On-Demand Webinar > Watch Now!>>SPONSORED BY: NortelWatch this FREE on-demand webinar to learn how to build a recession-proof network on a limited IT budget! Watch it now!>>Build a cost…