Google and Microsoft are butting heads over the disclosure of vulnerabilities. On Monday, Google revealed a critical flaw in Windows after it gave Microsoft a ten-day window to warn the public about it.

Google posted about the zero-day vulnerability on its security blog, saying Microsoft had yet to publish a fix or issue an advisory about the software flaw.

“This vulnerability is particularly serious because we know it is being actively exploited,” Google said. It lets hackers exploit a bug in the Windows kernel, via a win32k.sys system call, to bypass the security sandbox.

To read this article in full or to leave a comment, please click here

An online hackers’ forum has deleted a section that allegedly offered paid distributed denial-of-service attacks, following last Friday’s massive internet disruption.

HackForums.net will be shutting down the “Server Stress Testing” section, the site’s admin Jesse “Omniscient” LaBrocca said in a Friday posting.

“I do need to make sure that we continue to exist and given the recent events I think it’s more important that the section be permanently shut down,” he wrote.

The section was designed to let members offer so-called stress testing services for websites as a way to check their resiliency. However, security firms claim Hack Forums was actually promoting DDoS-for-hire services that anyone can use to launch cyber attacks.

To read this article in full or to leave a comment, please click here

A U.S. banking regulator says an employee downloaded a large amount of data from its computer system a week before he retired and is now unable to locate the thumb drives he stored it on.

The Office of the Comptroller of the Currency, which is a part of the Department of the Treasury, said the loss represented “a major information security incident” as it reported the case to Congress on Friday.

The data was taken in November 2015, but its loss was only discovered in September this year as the agency reviewed downloads to removable media devices in the last two years.

The employee in question used two thumb drives to store the information, both of which he is unable to locate, the agency said.

To read this article in full or to leave a comment, please click here

It’s still unclear who pulled off Friday’s massive internet disruption, but the malware largely responsible for the cyber attack has since assaulted new targets — possibly including video gamers.

Since last Friday, botnets created by the Mirai malware have been launching distributed denial-of-service attacks at seemingly random targets, in short bursts, according to a security researcher who goes by the name MalwareTech.

He has tracked Mirai-powered botnets and helped produce a Twitter feed that monitors their DDoS attacks. On Wednesday alone, the feed posted close to 60 attacks, many of them lasting from 30 seconds to over a minute long.

To read this article in full or to leave a comment, please click here

Dyn says that the DDoS attack that swamped its DNS resolution service last week was backed by far fewer internet of things (IoT) devices than it thought before.

Previously it said it was hit by traffic from tens of millions of IP addresses, some of which were likely spoofed, making the actual number of bots involved far fewer. “We are still working on analyzing the data but the estimate at the time of this report is up to 100,000 malicious endpoints,” the company says in a status update.

The attacks, which knocked out access to some high-profile Web sites, threw as many packets at Dyn’s infrastructure as it could and the company responded with its own mitigation actions as well as cooperation from upstream internet providers who blocked some of the attack flow. “These techniques included traffic-shaping incoming traffic, rebalancing of that traffic by manipulation of [DNS querying] anycast policies, application of internal filtering and deployment of scrubbing services,” the company says.

To read this article in full or to leave a comment, please click here