If you're sick of the unmanageable onslaught of spy ware ad ware and other nasties such as browser hijacks, then you should try Microsoft’s latest software acquisition.

Formerly known as GIANT AntiSpyware, this version of the award winning software is free to Windows users while in Beta.While the current version appears to have no difference to its originator other than re-branding, Microsoft is releasing regular signature updates.

Where can I get Microsoft Windows AntiSpyware?
http://www.microsoft.com/athome/security/spyware/software/default.mspx

Recently a flaw in two of Microsoft Office’s applications was revealed by a researcher Hongjun Wu from the Institute for Infocomm Research, Singapore. Microsoft’s response to the issue has been rather inadequate; the so called 'RC4 flaw' could allow data to be recovered from files that have version history.

Interview at Techworld.com with Phil Zimmermann:
http://www.techworld.com/security/news/index.cfm?NewsID=3027

Following a report on the Australian whirlpool forums, there is a new possible worm in the wild. Similar to ‘Slammer’ and ‘SQLSnake’ in that it targets vulnerable MySQL servers, there is potential for this new worm to wreak havoc.

 SANS Internet Storm Center is suggesting that a rise in port 3306 scans could be a result of this new worm. Apparently the worm creates a file called ‘spoolcll.exe’.

Recommendation:

Until this worm has been identified and a hotfix or solution provided, it is recommended that Admin’s of Windows MySQL systems keep a close eye on their boxes and the above file appearing on their machines.

Symantec, one of the world’s largest security software firms famous for the Norton brand name is expected to announce a plug-and-pay email security email appliance in conjunction with its partner IronPort.

IronPort looks to be part of a four year deal to bundle Symantec software with its appliances.

As information security becomes a more and more lucrative market, analysts are suggesting that a long term relationship to be unlikely. For now though, Symantec will be increasing their user base and strengthening their market share.

Developers of the Mozilla Thunderbird project say they have developed an anti-phishing tool that will be included in the next release of their popular open source email application.

This new virus is reportedly utilizing the latest CNN headlines to make its email subject lines appear more legitimate.

The attachment with the email, when executed will install a back door Trojan and a keystroke logger could also snare a victim's log-in information.

Sophos who has identified the virus is classifying it as a worm.

This is not the first worm to use the concept of dynamic content to appear legitimate.

Financial services companies remain the most frequent targets of online phishing schemes, according to the latest figures released by an organisation working to fight the scams.

The Anti-Phishing Working Group (APWG) is reporting 9,019 unique scams just over the course of December 2004. This equates to a 6 percent increase over the previous month. Compared with the 2,625 reported attacks during July 2004, this number indicates a 38 percent increase in six months.

Netcraft a British web monitoring firm has released a toolbar for Internet Explorer that can help people avoid Phishing scams.

Called the Netcraft Toolbar, the free-of-charge plug-in to Microsoft's popular IE browser uses Netcraft's database of web site information to show several attributes of any visited site, including its country location, longevity, and popularity.

Apple Computer released its first security patch of 2005 this week in order to plug some holes in its Mac OS X operating system.

Security Update 2005-001 for Mac OS X addresses issues with Apple's "at" commands, library (libxml2), ColorSync, Safari and Mail programs as well as specific problems found in PHP and third-party supplied "SquirrelMail."

According to the SpamHaus Project--a U.K.-based antispam compiler of blacklists that block 8 billion messages a day -- a new piece of malicious software has been created that takes over a PC for the purpose of sending spam.

’Bluesnarfing’ is the theft of information from a wireless device through a Bluetooth connection. Bluetooth is a high-speed but very short-range wireless technology for exchanging data between desktop and mobile computers, personal digital assistants (PDAs), and other devices. By exploiting a vulnerability in the way Bluetooth is implemented on a mobile phone, an attacker can access information -- such as the user's calendar, contact list and e-mail and text messages -- without leaving any evidence of the attack.

A Miami businessman is suing Bank of America over $90,000 he says was stolen from his online banking account in a case that highlights the thorny question of who is responsible when a customer's computer is hacked into.

Joe Lopez, 42, said in a complaint filed Thursday in Circuit Court in Miami that Bank of America was negligent and failed to protect him from online banking risks it knew about.

From the SAM website:
SAM is a program to monitor (in real-time) the number of alerts generated by Snort. Having recently set up Snort and ACID I felt like there was something missing.

Snort was great for identifying suspicious traffic and ACID was great for digging in to the details but I needed something that was a little higher overview and able to sounds alarms if certain conditions were met.

For instance if I was attacked 100 times in a 5 minutes period. SAM does not replace Snort or ACID but rather it compliments them.

Where can I get SAM and SNORT?:
SAM - http://freesoftware.lookandfeel.com/sam/
SNORT - http://www.snort.org/

Microsoft on Thursday gave early warning that next week's monthly dose of security bulletins and patches will be among its biggest ever.

According to the Advance Notification service, which pre-announces upcoming patches but limits the information disclosed, next Tuesday's roundup will include 13 security bulletins, at least three of which will be marked "Critical" the Redmond, Wash.-based developer's most dire warning.

Scammers are taking advantage of recent news that Microsoft is asking users to verify that they have a legitimate copy of Windows, a security firm said Friday.

According to Websense Security Labs, e-mails bearing the spoofed address of security@microsoft.com and with the heading "Microsoft Windows Update" ask recipients to update and/or validate both the Windows' serial number and the customer's credit card information on a Web site.

A 24-year-old former American Online software engineer pleaded guilty Friday to stealing 92 million screen names and e-mail addresses and selling them to spammers, setting off an avalanche of up to seven billion unsolicited e-mails.

The soft-spoken Jason Smathers of Harpers Ferry, W. Va., entered the plea to conspiracy charges in U.S. District Court in Manhattan, where he was likely to face from 18 months to two years in prison at a May 20 sentencing.

The FBI said Friday it has shut down an e-mail system that it uses to communicate with the public because of a possible security breach.

The bureau is investigating whether someone hacked into the www.fbi.gov e-mail system, which is run by a private company, officials said.

A worm spreading via the MSN Messenger instant messaging client carries a piggyback payload that's even more dangerous: a second worm that opens a backdoor and lets hackers hijack the PC.

The newest variant of the Bropia worm -- tagged as Bropia.f, Bropia.g, Bropia.e, or Bropia.j by various anti-virus firms in an unusual display of naming chaos -- spreads through MSN Messenger. Users who receive the file and open it see a mildly-funny .jpg of a roasted chicken posed to resemble a naked sunbather, complete with tan lines.

Hacker group "Shmoo" demonstrated an amazing new browser exploit to the audience of Shmoocon.
The exploit allows ANY domain name to be hi-jacked from a link, including its SSL secure addresses.

Their example showed a joke page being masked by eBays address. Surprisingly enough its not Microsoft Internet Explorer this time that is venerable. All other browsers however are currently susceptible to the attack.

RSA Security is preparing to deliver a powerful authentication solution for the long-neglected small to medium-sized business (SMB) market. Called the RSA SecurIDR Appliance, the two-factor authentication appliance will be formally announced Thursday. It will be demonstrated at next week's RSA Conference, in San Francisco.

More than half of 2,000 European consumers surveyed in a recent Capgemini study say they had privacy worries about radio-frequency identification tags. European consumers participating in the study by the business and IT consulting firm consider legislation on privacy protection as the key that would make them more likely buy RFID-enabled products.

Other factors survey respondents considered crucial: the ability to disable RFID tags at the store after purchase, a customer opt-in/opt-out choice regarding information collected via the tags, and clear labels that state the tag is RFID-enabled.

About 80% of mobile phone users worldwide have received spam, according to a study of consumers and mobile operators released Wednesday. That's bad news for mobile operators because most of the users who have received mobile spam blame the operators, according to the study. More specifically, the study found that users are more likely to change operators than mobile phone numbers to fight mobile spam.

Symantec on Tuesday released patches for a vulnerability found in a large number of its products, including flagship titles such as BrightMail AntiSpam, AntiVirus Corporate Edition, and its 2004 consumer slate.

According to rival Internet Security Systems' X-Force research group, which discovered the flaw, the bug is in the DEC2EXE module of the Symantec Antivirus Library, a part of the scanning engine that's able to peek into compressed executable files squeezed with the UPX (Ultimate Packer for eXecutables) format.

Pfizer Inc. and Microsoft Corp. said on Thursday they filed parallel lawsuits against Web site operators and spam advertisers that sell illegal versions of Pfizer's Viagra.

The companies said the lawsuits follow a seven-month investigation to discover the identity of two Web site operators together with those advertising them via spam e-mails.

It didn't take hackers long to start banging hard on the vulnerabilities Microsoft disseminated Tuesday.
Just a day after the Redmond, Wash.-based developer rolled out a dozen advisories containing 16 vulnerabilities, 10 of them tagged as "Critical," exploit code has gone public for one, Microsoft said late Wednesday.

Malware aimed at disabling Microsoft Corp.'s anti-spyware product has been discovered by security experts who expect the virus to be the first of many to follow.

The Trojan horse, which is also designed to steal online banking passwords from Windows computers, was discovered by security experts at Sophos Plc and Symantec Corp.

Along with the plethora of patches released Tuesday, Microsoft also revised its free Windows Malicious Software Removal Tool for the first time, and as promised earlier, automatically added it to Windows XP users' download lists when they accessed Windows Update.

The tool, which debuted last month, has been enhanced so it now detects and deletes -- or tries to -- all instances of the Korgo, Netsky, Zafi, and Randex worm families.

Sutter, California, the only grade school in this rural town, is requiring students to wear radio frequency identification badges that can track their every move. Some parents are outraged, fearing it will take away their children's privacy.

The badges introduced at Brittan Elementary School on Jan. 18 rely on the same radio frequency and scanner technology that companies use to track livestock and product inventory. Similar devices have recently been used to monitor youngsters in some parts of Japan.

The days running up to Feb. 14 are when employees are at the greatest risk of running afoul of company e-mail policies, a message firm said Tuesday.

Clearswift warned workers not to fall for the e-mail and Web security pitfalls that are prevalent around Valentine's Day.

As part of an aggressive drive to expand channel sales, security vendor McAfee this week will launch a deal registration program for eligible channel partners selling certain high-end products.

The deal registration program applies to some 500 solution providers selling the company's intrusion prevention solution (IPS) and antivirus appliances.

The Liberty Alliance Project on Friday unveiled the public draft release of a framework for identity-based web services.

The latest release of ID-WSF 2.0 is the first of three that will each add greater depth to the identity-management framework. The final specification including all three releases is expected to be available by end of the year.

Security vendor McAfee, Inc. this week launched an on-line Wi-Fi security scanning service and said that it is developing a standalone WLAN security product that will be released later this year.
 
The company's free online WiFiScan product was launched this week on the company's Web site. It downloads an ActiveX control that scans your wireless network and warns about potential security breaches and describes how to fix them. It can detect, for instance, the presence of an Evil Twin threat, as well as what networks and network-enabled devices are near-by.

Computer hackers captured the names, Social Security numbers and other information of more than 30,000 students and staff at George Mason University earlier this month, school officials said Monday.

The university, which is in Fairfax, near Washington D.C., discovered on Jan. 3 that intruders had hacked into a server containing the protected information, school spokesman Daniel Walsch said. He said the university notified all students and staff.

Technology executives from some of the U.S.'s biggest computer software and hardware companies on Thursday urged the Bush administration to create a national commission on organized cybercrime.

The 15 chief technology officers -- from companies such as Adobe, Dell, HP, Microsoft, IBM, Veritas, Symantec, and McAfee -- met with members of Congress, White House officials, and their counterparts in federal agencies to plead their case.

Virus makers will push into the virgin territories of cell phones, handhelds, and embedded computers, perhaps even those used in cars, IBM's annual security report said this week.

IBM's 2004 Global Business Security Index both summarizes the year past -- something virtually every major security vendor has done during December and January -- and puts the spotlight on the trends it sees for 2005.

Hewlett-Packard on Friday rolled out a software add-on for its ProLiant servers and HP BladeSystem that shuts down the inside-the-network spread of worms or viruses within milliseconds.

With the catchy name of Virus Throttle, the software eschews the traditional anti-virus technique of comparing possible malicious code against a database of signatures, and instead watches for virus-like behavior and then quarantines the infected machine until an administrator can figure out what's going on.

Security vendor Symantec Monday unveiled a new version of its flagship anti-virus software that includes tools to remove spyware and repair any resulting damage. The product, Symantec AntiVirus Corporate Edition 10.0, was launched at the RSA Conference in San Francisco.

While Symantec's anti-spyware capabilities come months after competitors McAfee and Check Point Software Technologies launched their own wares, the Symantec product is the first to feature spyware repair tools. According to Kevin Haley, group product manager, this is precisely what sets the Symantec product apart.

Netcraft has the story that Mozilla has decided to drop support for international domain names in future versions of its Firefox Web browser. The decision comes after demonstrations by the Schmoo Group that the feature can be used to aid in phishing scams and other browser naughtiness.

The attack can be disabled in Firefox and Mozilla by setting 'network.enableIDN' to false in the browser's configuration (enter about:config in the address bar to access the configuration functions). The Mozilla development team today made this the default setting. Users who want IDN support will be able to turn it on, but will be warned about the risks involved.

At the 14th annual RSA Conference in San Francisco on Tuesday, Microsoft chairman and chief software architect Bill Gates highlighted some of the company's progress toward its Trustworthy Computing initiative, which began more than three years ago. Before a standing-room-only crowd, Gates also outlined some of the company's short-term plans to help its customers bolster their security.

In the opening keynote, Gates said Microsoft will release Internet Explorer 7 later this year with improved security capabilities, including anti-phishing technology. The new version of IE had been slated to be released as part of the next version of Windows, not due until next year, but the company decided to release it sooner to improve security.

The Los Angeles Times is reporting that the good folks at Macrovision have unveiled a new system that will thwart 97% of existing DVD copying software while maintaining compatibility with existing DVD players.

Macrovision claims that DVD copying results in $1 billion loss for studios out of $27.5 billion in sales. With piracy resulting in only 4% loss, why are the studios making such a big deal? The article also reports (mistakenly) that the market is pressing 100s of billions of DVD annually.

Who's buying all those DVDs?" I'm skeptical of their claims, since historically Macrovision's anti-copying measures have been little more than easily circumvented snake oil, but maybe this time they've got their plan down.

SAN JOSE, Calif. (AP) -- Unwanted programs that spy on PC users, deliver pop-up ads and track Web surfing habits will be a hot topic at a security conference that's usually more focused on viruses, hackers and the encryption of sensitive information. So-called spyware and adware have been around for years but have largely been viewed as more of an annoyance than a security threat.

Symantec and McAfee leveraged the RSA Conference Monday to launch enterprise-wide battles against spyware. Both major security vendors touted new enterprise anti-spyware solutions.

As recently as a year ago, attention to spyware was low on the enterprise totem pole, said David Friedlander, a senior analyst with Forrester. Not so now. In 2005, he predicted, 65 percent of U.S. companies will purchase or upgrade anti-spyware software, making the category the most-purchased security technology for the year.

A Louisianan has pleaded guilty to sending an email virus that caused WebTV users' computers to dial the 911 emergency service without their knowledge.

David Jeansonne of Metairie, Louisiana admitted he sent email to 20 WebTV subscribers carrying a virus in an attachment in July 2002. Once opened, the attachment changed the dial-in telephone number in the user's WebTV box to 911. The next time the user attempted to log in to WebTV, the computer dialled 911 instead of the local modem telephone number supplied to the user by WebTV to access its servers in Santa Clara.

"This prompted unnecessary emergency police dispatches at numerous locations around the country in July 2002," said the U.S. Attorney's office for the Northern District of California in a statement.

"At least 10 WebTV users reported that the local police either called or visited their residences in response to the unnecessary 9-1-1 calls."

The 44-year-old man faces up to 10 years in prison and a fine of $250,000.

During his keynote speech at the at the RSA Security Conference Bill Gates announced that the Microsoft AntiSpyware will be offered for free.

'We've looked hard at the nature of this problem, and made a decision that this anti-spyware capability will become something that's available at no additional charge for Windows users -- both the blocking capability, and the scanning and removal capabilities.'

A HITHERTO OBSCURE security expert and software colossus, based in Redmond and called Microsoft has warned of a new generation of spyware that is almost impossible to detect.

According to Computerworld, Volish experts told the RSA security conference that system monitoring programs, or "kernel rootkits", are undergoing a transformation at the moment.

Security experts have raised the risk assessment to medium on the recently discovered Mydoom.bb@MM worm, also known as Mydoom.bb, after receiving reports that the infection is spreading in the wild.

According to McAfee's Avert antivirus team, more than 50 reports of the virus being stopped or infecting users from the field have been recorded. Most of these reports have arrived from the US, though Avert has also received reports from Australia and the UK.

RUSTON, La. (AP) -- The way you type is as unique as your eye color or speech patterns and can be used instead of a password to protect your computer, researchers at Louisiana Tech and Penn State say.

Their discovery will bring Louisiana Tech its first direct royalty income, university president Daniel D. Reneau said in signing a joint licensing agreement with BioPassword Inc. of Issaquah, Wash.

Microsoft has begun reminding users who last year blocked the installation of Windows XP Service Pack 2 (SP2) that a deadline is fast approaching. On April 12, all blocking mechanisms will expire and Windows XP and XP SP1 systems will automatically download and update to SP2.

"The intent of this alert is to provide you with a reminder about the upcoming deadline around the date on which Automatic Update (AU) and Windows Update (WU) will deliver Windows XP SP2 regardless of the presence of the blocking mechanism," said Microsoft.

Microsoft will start beta testing its all-in-one Microsoft Update in mid-March, according to an e-mail to potential beta testers. Microsoft is looking for a cross-section of users familiar with not only Windows, but also Office, SQL Server, and Exchange.

Tuesday, Microsoft's chairman and chief technologist announced Microsoft Update, a consolidated update service that would blend now-separate sites and services for the company's operating systems and applications.

A variation of the infamous Nigerian scam starring Saddam Hussein and various henchmen is circulating via e-mail, said a U.K. security firm Friday.

According to BlackSpider Technologies, spam hitting the U.K. is offering a share in the private fortunes of Hussein and his closest aids in return for hiding large amounts of money in British bank accounts.

"Cabir" is the name of the first Mobile Phone Virus in the U.S. 8 Months ago, it was first discovered in the Philippines. So far the virus has spread to twelve countries, and could pose as a threat to 1.5 billion cell phone users.  
 Mikko Hypponen, the director of "Finish Anti-Virus" Stated that the main problem occurring from the virus is damage to the battery.

It is thought that the very first transfer of the virus was in an gadget store. Two cell phones in a window were infected by a passer-by. Using Bluetooth to make the transfer, It's possible that other cell phones in the area could have been infected.

Build a big user base and the malicious-code writers will come. That's the logic that analysts and security software companies alike are following as they warn that smartphones and other mobile devices will become significant targets for security threats in 2005. In response, antivirus company Trend Micro is offering a free download and updates for one of the first software products for protecting smartphones and other handheld devices.

Trend Micro Mobile Security software is available at www.trendmicro.com/ mobilesecurity and will remain free until June 2005. On its initial release, the software supports Microsoft's Windows Mobile 2003 operating system. In January, an update will support the Symbian OS 7.0 with UIQ 2.0/2.1. The software works very much like antivirus software on a PC and also protects against SMS (Short Message Service) spam.

A Microsoft presentation at this week's RSA Conference has some observers concerned about a recurring nightmare of computer security: Rootkits.

A rootkit is a malicious program that uses system hooks to conceal its presence on the system. For instance, it monitors if the user opens the Windows Task Manager in order to keep itself out of the list of processes. It filters directory listings to remove its own files from them. The rootkits could be everywhere, living among us, and we wouldn't know!

With a powerhouse like Microsoft becoming a direct competitor, they could get squeezed out.

Last week, Microsoft Chairman Bill Gates (news - web sites) confirmed plans to sell antivirus products to both consumers and big businesses by the end of the year. But the Redmond company is mum on cost and features.

If Microsoft Corp. doesn't do more to stem Internet attacks, the company risks further alienating customers unhappy with the multitude of threats already facing its ubiquitous software.

Sell its own security products, on the other hand, and Microsoft faces a potential backlash from some of its allies — the companies that now provide an extra layer of security for its Windows operating system, Internet Explorer browser and other products.

Spam accounted for more than 80 percent of business e-mails last year, and the arms race against it continues this year. Of particular interest to enterprises is the SMTP gateway, or edge protection, to stop not only spam but also spam precursors such as directory harvest attacks.

Microsoft Corp., of Redmond, Wash., earlier this month acquired e-mail security vendor Sybari Software Inc. with plans to add Sybari's anti-spam and anti-virus software to its server products, including Exchange.

Microsoft Corp.'s Belgian subsidiary has launched an electronic ID card pilot program and is looking to integrate authentication for e-ID cards into future versions of the MSN Messenger instant messaging service.

Microsoft Belgium on Monday announced a new Electronic ID Early Adopter program. Under the program, Microsoft will be working with local software vendors to develop e-ID-based applications. Microsoft's MSN division will develop one such application—an authentication service for MSN, according to Microsoft officials.

T-Mobile commented on their security. Apparently someone might have knew her account password and gain access to her data. Maybe her PC is hacked?

T-Mobile is investigating the reported disclosure of Paris Hilton's information.

T-Mobile's computer forensics and security team is actively investigating to determine how Ms. Hilton's information was obtained. This includes the possibility that someone had access to one of Ms. Hilton’s devices and/or knew her account password.

Given the sensitivity of the situation, and to protect our customers' information, we are not able to provide specific details of the investigation at this point.

The merged Symantec Corp. and Veritas Software Corp. will become a leader in more than a half-dozen product categories. The post-merger Symantec will be not only a dominant security vendor but also a front-runner in backup, recovery and utility computing.

To capitalize on that opportunity, the merged company must integrate two disparate product portfolios, ease investor worries and convince enterprise customers that bringing security and backup together will help them manage their networks more efficiently.

The FBI reports that unsolicited e-mails which look like they come from fbi.gov contain attachments with a computer virus in them. The FBI is investigating this matter. It says its unrelated to a security breach that happened earlier this month.

The e-mails state that recipients have been to illegal web sites and that "Internet Fraud Complaint Center" is monitoring how they use the internet.

The FBI states: "Recipients of this or similar solicitations should know that the FBI does not engage in the practice of sending unsolicited e-mails to the public in this manner."

A critical vulnerability was spotted Thursday in the anti-virus engine used by Trend Micro's entire line of client, server, and gateway security products, the third such disclosure this month of flaws in major security firms' software.

As in the other two instances with Symantec and F-Secure, the Trend Micro vulnerability was discovered by Internet Security Systems, an Atlanta-based security provider, and revolved around the processing of a compressed file format.

Opera Software ASA on Friday released the second beta version of the next release of its desktop browser, which includes a new anti-spoofing feature.

The latest beta, available for download through the Opera site, displays security information inside the address bar that can help the user determine