Microsoft broke with its monthly patch cycle Tuesday to repair a bug in the way Windows handles animated cursors. Cybercrooks had been using the hole since last week to attack Windows PCs. But the fix is not compatible with software that runs audio and networking components from Realtek Semiconductor, some Windows users have found.
"Apparently the update is not compatible with Realtek," CNET News.com reader Dave House wrote in an e-mail. "We lost all Ethernet and audio functions. Removing the update and doing system restores brought the systems back." ZdNet has more.

A new worm was spammed out this weekend purporting to be a beta version of Microsoft's Internet Explorer 7 browser.
Emails with spoofed headers such as admin@microsoft.com contain a file that claims to be a beta version of the browser, despite the fact that the full code was released in October 2006. The 'ie7.0.exe' file contains the Grum-A worm. Vnunet has more.

Microsoft has decided to rush out a fix for a flaw in its Windows operating system, saying that the problem has become too serious to ignore.
The flaw, which will be patched on Tuesday, was originally disclosed to Microsoft in December, but it was not publicly reported until Wednesday of last week. The bug lies in the way Windows processes .ani Animated Cursor files, which are used to create cartoon-like cursors in Windows.
Since the first attacks based on this flaw were reported, security experts say that more than 100 Web sites are now serving up malicious Web pages that take advantage of the bug, and a new worm , has begun spreading in China, according to by Symantec Corp. InfoWorld has more.

Romanian hackers, eat your hearts out: The United States has far and away the most malicious code, spam, phishing, attack and botnetwork activity on the planet, according to Symantec's most recent semi-annual Internet Security Threat Report.
In this, its 11th edition of the report, Symantec has for the first time ranked countries as far as their Internet malfeasance is concerned. Tapping into its global intelligence network, Symantec found that the United States spawned 31 percent of the worldwide total for malicious activity. China came in second with 10 percent, and Germany came in third with 7 percent.... E-Week has more.

Security company Symantec says new research supports fears that Windows Vista's use of the IP tunneling protocol Teredo is potentially insecure. Microsoft is using Teredo to enable a transition from IPv4, which is the traditional version of the network layer protocol for packet-switched networks now used as the Internet's background, to IPv6, an updated protocol whose biggest benefit is the exponential increase it will bring in the number of IP addresses available for networked devices. ExtremeTech has more.

A vulnerability in the way OpenBSD handles IPv6 data packets exposes systems running the traditionally secure open-source operating system to serious attack. A memory corruption vulnerability error exists in the OpenBSD code that handles IPv6 packets, Core Security Technologies said in an alert published Tuesday. Exploiting the flaw could let an attacker commandeer a vulnerable system, according to Core, which said it discovered the issue and crafted sample exploit code. ZdNet Downunder has more.

Yahoo reports:A vulnerability in Microsoft Corp.'s Internet Explorer (IE) browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday.
The flaw lies in the way IE7 processes a locally stored HTML (Hypertext Markup Language) error message page that is typically shown when the user cancels the loading of a Web page, said Aviv Raff, a security researcher based in Israel.

The megapatch is the seventh Apple security patch release in three months. It deals with vulnerabilities in Apple's own software, as well as third-party components such as Adobe Systems' Flash Player, OpenSSH and MySQL. Sixteen of the vulnerabilities addressed by the update were previously released as part of two high-profile bug-hunting campaigns. The vulnerabilities pose varying risks to Macs. Several of the flaws could be exploited to gain full control over a Mac running the vulnerable component, according to Apple's advisory. Other holes are limited and could only be exploited to crash a Mac or used by somebody who already has access to a machine to elevate privileges, for example. More at ZdNet

Researchers are fuzzy about the impact of a flaw discovered in Microsoft Windows Explorer, but US-CERT's advisory said there's exploit code out there for it.
At issue is Windows Explorer's failure to properly handle malformed Office documents. Although researchers aren't clear about the implications, the advisory said that it may allow an attacker to take over a system and execute arbitrary code. Crashing Windows Explorer is the least of the woes the flaw could cause, US-CERT says. EWeek has more.

The rate of identity theft-related fraud in the US has risen sharply since 2003, a report from research firm Gartner suggests. And the story is somewhat similar in Australia.
Gartner's study, released Tuesday in the US, shows that from mid-2005 until mid-2006, about 15 million Americans were victims of fraud that stemmed from identity theft, an increase of more than 50 percent from the estimated 9.9 million in 2003.
According to the Australian Competition and Consumer Commission, identity theft costs billions of dollars.
"On identity theft alone, losses to the Australian community are estimated to be in excess of $1 billion annually." ZdNet Downunder has more.

As you may know, Microsoft has updated their WGA - notification tool. But what you don´t know is that this tool will phone home when you try to cancel the installation of the WGA tool.
If you haven´t installed a desktop firewall you will get no notice from this homecall.
Heise.de has checked the content of the packages which are sended back to Microsoft and they include a lot of cryptic stuff, the version of the WGA and a GUID which could be used as a unique identification mark. The language of the system and if the machine is part of a domain was also submitted to Microsoft.
Redmond told Heise.de that they collect the datas for quality reasons without identifying the users. To prevent the home call it´s higly recommended to install a desktop firewall. Roughly translated source by Google

A security expert has cracked one of the U.K.'s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration.
The attack, which uses a common RFID (radio frequency identification) reader and customized code, siphoned data off an RFID chip from a passport in a sealed envelope, said Adam Laurie, a security consultant who has worked with RFID and Bluetooth technology. The attack would be invisible to victims, he said.
"That's the really scary thing," said Laurie, whose work was detailed in the Sunday edition of the Daily Mail newspaper. "There's no evidence of tampering. They're not going to report something has happened because they don't know." InfoWorld has more.

Mozilla Foundation on Monday issued a critical fix designed to address vulnerabilities in a recent security update for the Firefox browser and SeaMonkey application suite.
The security flaws were discovered in Firefox 1.5.0.9 and 2.0.0.1, as well as in SeaMonkey 1.0.7, according to a security advisory posted by Mozilla. More at News.com

Apple has issued eight security updates for the Mac OS X and Windows versions of its QuickTime multimedia software.
The French Security Incident Response Team issued its most severe security rating of 'critical' for all the flaws.
All eight vulnerabilities affect current versions of QuickTime for Windows Vista, XP and 2000. Seven also affect Mac OS X versions 10.3.9 and later. More here

Bit older but i know that a lot of my colleagues using this system Version 2.11 of WordPress contains some exploitable code placed there by a cracker. An excerpt of the note posted to the WordPress blog this afternoon:It was determined that a cracker had gained user-level access to one of the servers that powers wordpress.org, and had used that access to modify the download file. We have locked down that server for further forensics, but at this time it appears that the 2.1.1 download was the only thing touched by the attack. They modified two files in WP to include code that would allow for remote PHP execution.If you downloaded version 2.1.1 of WordPress within the last week, you should put down the ice cream nachos and upgrade to 2.1.2 right now. Be sure to totally wipe the old files, including the wp-includes. More at WordPress Source: Wired

A variant of the Storm worm is able to analyze network traffic and insert a link to a malicious Web site into text posted in blogs, webmail and bulletin boards. A variant of the well-known and troublesome worm is being used in a spam attack that is luring blog, bulletin board and webmail (Internet-based e-mail) users to connect to a malicious Web site, according to Dmitri Alperovitch, a principal research scientist at Secure Computing Corp.
Alperovitch explains that there is a new component in the variant that enables it to analyze network traffic on the infected computer and dynamically insert a link to the malicious site into text -- whether it's a blog post, a bulletin board entry or an e-mail sent through a webmail system. The users' text will contain their own content, along with the link and a note that lures readers to check out a Web site with "fun" videos or e-card. .... I-Week has more.

....Marc Maiffret, founder and chief hacking officer of eEye Digital Security said hackers were starting to look at how to turn over Vista and have already found five or six different Vista-specific vulnerabilities.... Whole story at Inq

VuNet reports: Firefox users are now receiving automatic updates that fix serious bugs in the open source browser.
The update, which started being sent out at the weekend, fixes flaws that security firm Secunia described as 'highly critical'.
The flaws affect Firefox 1.5 and 2.0 for Windows, Mac and Linux systems.
"Due to the security fixes, we strongly recommend that all Firefox users upgrade to these latest releases," said Mozilla in a statement. The fixes include a location.hostname vulnerability that independent Polish coder Michal Zalewski found a few weeks ago, and a critical memory corruption bug that can cause the browser to crash.
This could be the last security fix for Firefox 1.5, since the organisation will stop supporting the old browser on 24 April.

Microsoft is investigating two recently disclosed security vulnerabilities that affect Internet Explorer 7 and Windows Vista, the company said Monday.
The vulnerabilities aren't considered high-risk, yet they affect the latest releases of Microsoft's Web browser and operating system software. Microsoft has promoted the security of both IE 7 and Windows Vista. The flaws could let attackers get their hands on sensitive user information, security experts have warned.
The French Security Incident Response Team said in an alert that the IE vulnerability, which also affects IE 6, could be exploited in phishing attacks, scams that try to trick people into giving up sensitive information such as credit card data and Social Security numbers. The problem exists because of an error in the way the browser handles certain "onunload" events, the security monitoring company said. Attackers could exploit the issue to spoof the browser address bar, FrSirt said. News.Com has more.

Think the new built-in phishing filters in Internet Explorer 7 and Firefox 2 will protect your private data? Think again. The number of sites devoted to phishing skyrocketed last year, and the number of Americans taken in by phishing schemes has nearly doubled. In November 2006, the last month for which data is available, the Anti-Phishing Working Group found 37,439 new sites, up an astounding 709 percent from the 4630 sites in November of 2005.
Last October, both Mozilla and Microsoft released new versions of their browsers that use blacklists to block access to known phishing sites. In response, resourceful phishers are flooding new fake Web sites onto the Internet too quickly for them all to be shut down or blacklisted. Again Yahoo has more.