MySpace users are being tricked with a pop up that resembles a Windows Update screen, this happens when you visit specific, specially crafted, friend’s pages.

After clicking it, it will start downloading malware right to their PCs.

More info here.

An attacker sending a specially crafted (signed) email could make you automatically load a page upon receiving it, at least this seems to be the case with Outlook and some other Office applications, according to this paper by Alexander Klink.

He also provides a proof of concept, send a blank email to smime-http@klink.name and you will receive an example email demonstrating this vulnerability.

From time to time I get asked about BitLocker, the Windows Vista tool for drive encryption.

I found these two guides quite useful. Hope you will find them useful too. This one is from Microsoft, the other one from TechRepublic (requires free registration).

Today I want to talk about ISP injected adverts. It’s an increasing trend for ISPs to use transparent web proxies to inject their own Javascript and HTML code with their own ads to the pages their users request.

I know this has been around for some time now, and while I haven’t seen it in any ISP, I have experimented it myself in the free Internet connection provided at some venues, thus my post about it.

You can find more information and do some tests here.

subatomico security has been around for 1 year now. Time goes by quickly!

During this period I have been writing about a myriad of different security topics and also a little bit about technology. I have earned a constant and decent amount of readers, which is not that bad, and far beyond my expectations when I started all this out.

So I just have to thank all of you for your interest in subatomico. So let’s go for another year, hopefully even better!

The blockbuster of the week: Microsoft has made public today an offer to acquire Yahoo!

More info can be found in their press release here.

I’d bet the deal is going to happen. A huge battle between Microsoft and Google is about to start!

attrition.org is an interesting, non-profit webpage with news about IT security.

The most interesting part for me is their Data Loss Archive and Database. It contains reports about sites that collect personal information and have suffered data loss or data theft, therefore exposing all or part of the personal, valuable information they kept.

Happy 2008!

Now that 2007 is over, it’s a good time to take a look back at last year’s security highlights, a good place to start is the 2007 Security Hall of Shame.

Enjoy.

Para cambiar un poco de tercio, vía pixfans.com, versiones especiales de diferentes consolas comerciales, desde la mítica SNES hasta la malograda Dreamcast.

Aunque a mí la que más me gusta es la PSX Desr, merece mención especial la Sega “cafetera”

It’s been around for some time now, but I learned today about this site: the Zero Day Initiative, founded by Tipping Point, which in turn belongs to 3Com.

At first it looks interesting: A site that basically promotes responsible disclosure, and they even seem to reward submissions. Interesting.

Did you submit anything over there? Can you share your experience?