CookieJacking

There is a ‘0-day’ vulnerability in Microsoft Internet Explorer popularly called the ‘cookiejacking’ vulnerability. Trend Micro's Deep Security Lab has issued a rule that looks for web pages containing local(file://) links to the cookies folder.

If you have any customers or propects who are seeking a higher level of security in a physical environment, or who have virtualised, or are looking to virtualise Deep Security is a very strong product in these areas


There is some news around the vulnerability and a little controversy about Microsoft having downplayed it but media and security companies saying that the vulnerability is much more severe than what Microsoft says.

Below is the link to Trend blog on the issue.
http://blog.trendmicro.com/contrary-to-reports-cookiejacking-presents-a-major-risk/

apologies

Hi there everyone.
You may have noticed that the regularity of my post has reduced significantly this year.  My apologies.  I am no longer tasked with supporting channel partners.  This privilege has been passed on to my very capable colleague, George Alexandridis - who I am sure a lot of you are familiar with already.
I will continue to post here when I can!
regs
Kieran

SafeSync for Business Beta

Beta testing started on the 11th March and ends on the 7th April 2011
Sign up for the SafeSync for Business Beta Test and receive a 12 month NFR on the launch.


Subscription Model = Yearly revenue for you!


SafeSync for Business is a complete online solution that lets you manage, backup, and share all your electronic data - securely, easily, and inexpensively. It redefines file management, allowing you to eliminate on-premise file server equipment. You can store, synchronize, and secure your files in a single safe place. It allows you to quickly access all your irreplaceable files to share and collaborate in real time via a web browser.


SafeSync for Business:
· Is a simple file management solution
· Automatically backups in an online location, protected by an industry leader with 20+ years of Internet security expertise
· Synchronizes your devices automatically with the most current business data
· Works silently in the background
· Provides easy access to your business files online anytime via a web browser


====================


My experience of the home based version has been very good.  I had maxed out my monthly data limit a couple of months... but that is only a part of the initial upload process... and also a by-product of the fact I chose to sync pretty much everything on my machine.

The Android client is pretty cool on my Galaxy as well. (Yes, iPhone users- you get an app as well!)

The consumer/home version has a number of positive reviews
mobilewhack
smallcloudbuilder
zawya
var guy

Give the business version a go, and as I always say... if you don't participate in the beta... you cannot complain about the end product!! :)

enjoy your weekend everyone!

Trend Micro's Official Response: "Massive" Lizamoon SQL Injection Attack

Just in case anyone was concerned, or have customers who are concerned about this recent Attack vector...

 

 Recent “Lizamoon” Mass SQL Injection Attack.

Reports have suggested the recent SQL Injection Attack included a compromised domain – “lizamoon.com”. To clarify, this was actually not compromised, rather it was set up with fake domain registration, and created on March 25,2011.

Some of the other domains involved in this incident, may indeed have been compromised, however they are also to be viewed as suspicious, owing to having a one year expiration and gmail and hotmailbox accounts were used in the registration of the domains. Certain of these pages are still active today, though the majority are not.

Trend Micro already blocks access to all the compromised pages involved in this attack, and customers with Web Reputation enabled would not be impacted by this incident. Additionally, Deep Security can proactively block SQL injection attacks on databases.

 

As is frequently the case in such attacks, the criminals methods resulted in instances of FAKEAV, a prolific scam regularly used to defraud users as well as silently deliver additional malware. In particular the site, “defender-uqko . in”, has previously been linked to other FAKEAV attacks in relation to other malware such as Koobface. And, the domain – “Alisa-carter . com” - housing the FAKEAV, was registered March 12, 2011.

Other compromised sites impacted by the incident included “koreandvds . com” and “thailandmedicaltourismcluster . org.”

It should be noted that SQL Injection Attacks are not new, in fact, they are arguably now as common as malware scams targeting users of social networking sites.

UPDATED SURVEY LINK: WF7.0 APAC channel survey - NEED YOUR HELP!

To better understand our resellers’ experience with Worry Free 7.0, APAC regional team has designed a survey to roll out next week.



This survey will be open for participation for 3 weeks, from Monday 24th of January.


Please see the initial invite SURVEY

We need your help – in order to gain maximum participation, we need you to encourage resellers to participate.


The results of the survey will help the APAC regional marketing team to provide feedback to global team, as a learning reference for future product launches.

Thanks & Regards,


APAC Regional Marketing Team

Published with Blogger-droid v1.6.5