SecurityFocus

New Variants of W32.Downadup.B Find New Ways to Propagate
Symantec Security Response, 2009-01-09
Symantec has observed an increase in infections relating to W32.Downadup over the holiday period and is urging organizations to apply the patch for Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability as soon as possible.

Downadup Blocklist
F-Secure, 2009-01-09
Our post on Tuesday included a list of domains used by the Downadup worm. Today's list includes 1,500 additional sites used by the worm.

New Year Brings New Spam Attacks
Symantec Security Response - By: Dermot Harnett, 2009-01-08
Spam levels are slowly creeping back up to their pre-McColo shutdown levels and spammers have come back fighting.

MS08-067 Worm, Downadup/Conflicker
F-Secure, 2009-01-08
Downadup has "old school" worm functionality (no user interaction required), the likes of which we haven't really seen for a while now.

My Pentest Secret: Password Guessing
Matasano - By: Dave G., 2009-01-08
Password guessing on administrative interfaces isn’t glamorous, it isn’t exciting, but it is unbelievably effective.

A Spammer Has Sent You a Message
Symantec Security Response - By: Amanda Grady, 2009-01-07
Symantec has observed at least two major social networking sites being spoofed in spam attacks this week. The spam is likely hitching a ride on the back of a recent phishing scam, as discussed on our Norton Protection Blog.

When is AUTORUN.INF really an AUTORUN.INF?
F-Secure, 2009-01-07
Malware authors are using neat tricks to hide programs designed to autorun.

Not-For-Profit Phishing
Symantec Security Response - By: Tao Adams, 2009-01-07
A recent phishing scheme that targets users of Twitter may be related to a string of Web attacks against several high-profile celebrities and no doubt many other users.

W32.Downadup Infection Statistics
Symantec Security Response - By: Security Intel Analysis Team, 2009-01-06
The W32.Downadup.A worm was the first worm discovered in the wild that was successfully leveraging MS08-067 in a widespread fashion. Symantec carried out an in-depth analysis of this threat and discovered that infected hosts will generate 250 pseudo-random domain addresses each day, in preparation of attempting to contact them later on to download and execute an update binary.

MS08-067 worms
F-Secure, 2009-01-06
A number of worms have started using a flaw fixed by Microsoft late last year.