Facebook Data Harvested to Build List of Likely Logins

A researcher published a torrent file containing the name of every Facebook user that hasn't specifically opted out. The list was obtained by harvesting a public directory that Facebook maintains.

This list was then used to determine the likely variations of "first initial last name", "first name last initial" and so on, which could be helpful at increasing the success of users attempting to log in to systems using brute-force tactics.

The details of how this was done are available at: http://www.skullsecurity.org/blog/?p=887

Security Secrets the Bad Guys Don't Want You to Know

PC World has a nice easy read on safer Internet browsing.

From the article:

"You already know the basics of internet security, right?

You know to keep your antivirus program and patches up to date, to be careful where you go on the Internet, and to exercise online street-smarts to resist being tricked into visiting a phishing site or downloading a Trojan horse.

But when you've got the basics covered, but you still don't feel secure, what can you do? Here are a few advanced security tips to help you thwart some of today's most common attacks.

Remember, however, that security is all about trade-offs. With most of these tips, what you gain in security, you lose in convenience. But hey, it's your computer. Be as paranoid as you want to be."

http://www.pcworld.com/article/201309/security_secrets_the_bad_guys_dont_want_you_to_know.html?tk=hp_new

Scareware/Rougeware Propogation Tactics

If this article doesn't make you uncomfortable, you may need to re-read it.

The infection routines being used by some scareware and rogue AV gangs are much more comprehensive and far-reaching than many current analysis have shown

Quote from SANS -
""Once the site has been compromised, the attackers install their script in any directory, preferably in a directory that is not accessible directly from the web since they will not need to access it directly. The next step the attackers do is to infect all (and I mean all!) PHP files on the compromised web site. If it's a shared web site, and the permissions are not setup correctly, they will actually infect absolutely every web site hosted on that machine," 

Read the full article and Threatpost