2007.11.05 Daily Security Reading
by Rodney Campbell on Nov.05, 2007, under Security
When AntiVirus Products (and Internet Explorer) Fail you
Didier Stevens recently took a closer look at some Internet Explorer malware that he had uncovered and found that most antivirus products that it was tested against failed to identify the malware through one of the most basic and straight forward obfuscation techniques — the null-byte. With enough null-bytes between each character of code, it is possible to fool all antivirus products (though additional software will trap it), yet Internet Explorer was quite happy to render the code.
OSX.RSPlug.A Trojan Horse Changes Local DNS Settings to Redirect to Malicious DNS Servers
A malicious Trojan Horse has been found on several pornography web sites, claiming to install a video codec necessary to view free pornographic videos on Macs. A great deal of spam has been posted to many Mac forums, in an attempt to lead users to these sites.
One-Third of Employees Violate Company IT Policies
A national survey of U.S. white-collar workers commissioned by the nonprofit, independent organization ISACA (formerly the Information Systems Audit and Control Association) has found that more than one-third (35%) of employees have violated their company’s IT policies at least once and that nearly one-sixth (15%) of employees have used peer-to-peer file sharing at least once at their place of business, opening the door to security breaches and placing sensitive business and personal information at risk.
Employee Monitoring: Highlighting the Issues
While there is no doubt that employee monitoring is becoming standard practice, companies need to ensure that it complies with legal requirements and does not unduly affect the employment relationship. This feature outlines the law governing employee monitoring in various jurisdictions in Europe, the US and Asia-Pacific and provides some practical guidance on achieving compliance.