Spyware, viruses, & security forum: NEWS - June 12, 2012

The Justice Department on Monday trumpeted the arrest of a Dutch man wanted for coordinating the theft of roughly 44,000 credit card numbers. The government hasn't released many details about the accused, but data from a variety of sources indicates he may have run a large, recently-shuttered forum dedicated to cyber fraud, and that he actively hacked into and absconded with stolen card data taken from other fraud forums.

This much the government is saying: David Benjamin Schrooten, 21, appeared in Seattle federal court on Monday and pleaded not guilty to charges of bank fraud, access device fraud and conspiracy. Schrooten was accused of running Web sites that sold stolen credit card numbers in bulk. Authorities said Schrooten was extradited to the United States after being arrested in Romania, and that another man — 21-year-old Christopher A. Schroebel of Maryland — was an accomplice and also was charged.

The government also mentioned one other detail: Schrooten was allegedly known in the hacking community as "Fortezza." This last detail caught my attention, because for several months members of the cybercrime underground have been inquiring about Fortezza's whereabouts, and what would become of his hacker forum — an exclusive English language "carding" site aptly named Kurupt.su. [Screenshot]

Continued : http://krebsonsecurity.com/2012/06/feds-arrest-kurupt-carding-kingpin/

The latest draft proposal from the W3C working group developing the Do Not Track (DNT) privacy setting says that setting the Do Not Track signal on, or off, by default will not be allowed in compliant clients. The latest draft is the result of the creation of a "compromise proposal" for the various interested parties by Peter Eckersley of the EFF, Tom Lowenthal of Mozilla, and Jonathan Mayer of Stanford University.

The change in the draft was partly triggered when Microsoft said it had turned Do Not Track on by default in Internet Explorer 10. This announcement triggered debate within the standards group as it works with publishers, social networks, advertisers and browser makers to try and establish the Do Not Track standard. Mozilla was concerned that a browser maker, by setting DNT on by default, would be removing the option for the user to make a choice.

The proposal adds a line - "An ordinary user agent must not send a Tracking Preference signal without a user's explicit consent" - to the start of the User Agents section of the DNT proposal, though it is currently preceded by a disclaimer that it has not "been extensively discussed with stakeholders". It also notes that it should be considered a preliminary position on the issue. The requirement for explicit consent does allow for users to be prompted on first run of an application and asked if they want to enable Do Not Track. The proposal change potentially places Internet Explorer 10 in the position of, if unchanged, being non-compliant with the final specification.

Continued : http://www.h-online.com/security/news/item/Do-Not-Track-should-not-be-enabled-by-default-says-W3C-proposal-1615978.html

UK ISPs may have to unmask Internet trolls, as politicians debate overhauling defamation laws

It's taken time for defamation to go digital it seems. The UK's defamation laws are more comfortably set in times for print and television than they are suited to the fast pace and activity we see online.

A defamation bill [PDF] is to be debated in the House of Commons today that could lead to the protection of website owners if they help to unveil Internet trolls.

The bill will more generally look at reforming aspects of the law of defamation. Currently this is governed by common law and the balance of course is whether changes would affect freedom of speech.

A draft Bill was published in March 2011 and subject to pre-legislative scrutiny. The Defamation Bill was presented on 10 May 2012. It extends to England and Wales only, today should see the second reading.

Proposed changes, if the bills is passed, mean that claimants would have to show they have suffered serious harm before suing for defamation. Under the law as it currently stands, a claimant does not have to prove the words they are complaining about have caused them actual damage.

Continued : http://thenextweb.com/uk/2012/06/12/uk-isps-may-have-to-unmask-internet-trolls-as-politicians-debate-overhauling-defamation-laws/

Also:
MPs debate new measures to identify internet trolls
Websites Will Be Forced To Identify Trolls

Same Operation, Diversification of Targets Being Spoofed: Current Black Hole Exploit Kit Spam Runs

From TrendLabs Malware Blog:

Recent Changes in Black Hole Exploit Kit Spam Runs

As a continuation of our efforts to protect customers as outlined in our previous post, this post is an update on the current Black Hole Exploit Kit spam run activity. We've been identifying Black Hole Exploit Kit spam runs for a while and so far, it continues to have high activity. These spam runs remain a concern for organizations spoofed by spammers, owners of compromised websites, and the number of users receiving these phishing emails. The solutions we've released for these spam runs with unique insight from big data analysis and the power of Trend Micro Smart Protection Network are still effectively detecting and addressing email sent by spammers.

Changes in Black Hole Exploit Kit Spam Runs

We've noticed recently that while the same strategy is still being used, the spammers have now added new legitimate organizations to spoof. Specifically, they mimic legitimate emails from these entities in phishing email to lure users into clicking the URL in the message. The attack starts with spam containing a link to a compromised website which redirects users to the website where malware is hosted. As mentioned, the difference is that the organizations that are spoofed in the attack have diversified.

Recent Activity with Diversified Organizations

The following table includes the dates of activity and some of the new organizations being spoofed by Black Hole Exploit Kit spammers: [Table]

Continued : http://blog.trendmicro.com/same-operation-diversification-of-targets-being-spoofed-current-black-hole-exploit-kit-spam-runs/