Security Response

It is so great to now have the opportunity to choose how to receive your adware. In the past, drive-by downloads were targeted exclusively towards Internet Explorer (IE) users and indeed, many people changed to Firefox or Safari browsers specifically because of this fact. But now you can choose which browser you want to use to be hit with your least favourite adware!

When people contemplated moving from IE to Firefox, it didn’t matter if Firefox was measurably safer than IE or not, the simple fact that the bad guys weren’t targeting it made it far more secure in practice. Those heydays have long since disappeared. In the Symantec labs we still see a greater number of drive-by downloads solely targeting IE; however, we often see sites that will detect which browser you are using and then serve you your specific poison. Moreover, there have been several vulnerabilities discovered that can affect applications that are common across all Internet browsers (such...

Phishing is an attempt by a third party to solicit confidential information from an individual, group, or organization, often for financial gain. The phishers may then use the information to conduct criminal activities for profit. A typical phishing email may ask the recipient to click on a URL that appears to belong to a well known Web site, but the link actually directs the user to a malicious site with the fraudulent intent to steal information.

In a recent twist, phishers have replaced malicious URLs with malicious “1-800” phone numbers. The brand name targeted in one particular instance was Chase Bank. The Chase Bank scam was initiated when users were enticed to dial a rogue 1-800 number listed in a phishing email. When they connected to the number, they were greeted by a warm voice asking for their account number, expiration date, and last four digits of their social security number [1]. The message ended by acknowledging that the account details had...

So, it's started. We are starting to see the arrival of Linux in the cellular device/handset market (to be honest, it's been a year or two since they first emerged, but they are now starting to become more prevalent) and along with them the attendant security issues.

While I wish to avoid a war in regards to different operating systems and security (I don't want to antagonize the Slashdot crowd again), the following is true: the vendors who are gaining direct benefits from the adoption of open source software (OSS) within their devices and products (such as low cost and quicker product development) are not addressing the security with the same aggression. If Symantec were a non-OSS company, people (myself for one) would be quick to point this out and remind them of their obligations to end-user security.

Let me explain what I mean. Currently we expect big OS vendors like Microsoft, Apple, and Sun to typically provide an easy way to implement...