BBC Click: Net scams and jobseekers

You may have gathered from some of the blogs published here last year that i'm not biggest fan of the BBC's "Click" programme. I regard the Beeb's forays into buying botnets and stolen credit card details and making active use of them as at best naive. I agree that people need to be aware of such issues,

Today We Have Naming of… err, Malware… [1]

Sunbelt have responded to an article in Infosecurity about what I described way back in the early 90s (when putting together the alt.comp.virus FAQ) as the “thorny issue of malware naming”. Well, I’ve been banging the drum about educating users and pretty much everyone else away from the concept that malware naming is useful for quite

UK National Identity Database

The Register reports that "Home Secretary Alan Johnson has confirmed that the National Identity Register contains National Insurance numbers and answers to 'shared secrets'." See: Johnson was responding to a parliamentary question about "what information will be held on the National Identity Register which is not held on the UK Passport Database." Inevitably, there

Millennium Falcon: Crash & Burn Revisited

I originally posted this on the AVIEN blog site at, but in view of the increasing volume of "Y2.10k" date-related bug reports, I'll re-post it here with an updated list. (Thanks to Mikko Hypponen for posting a couple of links I hadn't seen.) Windows Mobile/SMS bug (Welcome to 2016!) Bank Bugs:]

Dark Reading and Crystal Balls

Apparently it's not just me that's sceptical about the value of security crystal ball-gazing. Tim Wilson of Dark Reading takes us (the security industry) to task for being "subjective" and inconsistent in our predictions for the coming year. Strangely, although he does quote an ESET blog (an observation of Randy's) in his selection of predictions he

Ten Ways to Dodge Cyber-Bullets (Part 3)

[Part 3 of an occasional series, updating a blog series I ran in early 2009 to reflect changes in the threat landscape. This series will also be available shortly as a white paper.] Do You Need Administrative Privileges? Included for completists, though I don't think I've added anything here to the original blog. I think it's

Adobe, Javascript, and the CVE-2009-4324 Exploit

There has been quite a lot of traffic in the last few weeks about the vulnerability referenced in the CVE database as CVE-2009-4324. The following Adobe articles refer: Today's article at the Internet Storm Center by Bojan Zdrnja ( gives a lot of detail on a particularly inventive exploit of the

Advance Fee Fraud: Another Aspect

When we think Advance Fee Fraud (AFF) we usually think in terms of the 419-type scams often associated with Nigeria, though similar frauds actually come from all over. You know the sort of thing: the banker, or the wife or son or daughter of a defunct dictator or benevolently inclined millionaire plane-crash victim wants to share their

Ten Ways to Dodge Cyber-Bullets (Part 2)

[Part 2 of an occasional series, updating a blog series I ran in early 2009 to reflect changes in the threat landscape. This series will also be available shortly as a white paper.] Catch the Patch Batch Keep applications and operating system components up-to-date with automated updates and patches, and by regularly reviewing the vendors’ product

The out-of-control decade

We interrupt our – well, my – scheduled programming to bring to your attention an article in "The Register" that I think deserves your attention. I put up what was intended to be a brief pointer on the AVIEN blog (, but I found myself kind of warming to the subject, to the extent that I

Top Ten Trite Security Predictions

1. Every security blogger in the world will mark the transition from 2009 to 2010 with at least one top ten something-or-other article. Except me, of course.  2. There will be headlines about the death of anti-virus, and a famous security guru will state that anti-malware only catches malware that's already been identified and analysed, that

Party Line – GSM Eavesdropping

The BBC has reported ( that Karsten Nohl has published details of the encryption algorithm used to encrypt mobile phonecalls made using GSM technology. The topic has inspired much discussion following a talk at the Chaos Computer Congress in Berlin. The GSM Association seems, according to the BBC report, to be a little ambivalent about the

Ten Years A-Spamming

Well, I'm pretty sure I've been seeing spam for a bit more than ten years, as has CAUCE (Coalition Against Unsolicited Commercial Email) in its various incarnations. However, the blog by Neil Schwartzman that was put up yesterday at covered only the notable events of the last decade. Which was indeed eventful enough. In fact, it turns

A Thought or Two about Testing

The Hype-free blog at yesterday mentioned the latest AV-Comparatives round of test reports, including: The whole product dynamic test at The December 2009 performance test at The summary reports at I have a pretty jaundiced view of testing organizations in general: after all, I see some pretty awful tests proclaimed by the

Anniversaries Galore

Following my blog at, I came across a blog by Kurt Wismer that picked up the theme. As it happens, though I don't think we've ever met, Kurt and I have corresponded from time to time for quite a few years (fourteen, apparently), so I guess it's not so surprising that he also dates

A Trojan Anniversary

I don't suppose anyone remembers my mentioning this before, or cares much anyway, but the 19th of December marks what I consider to be the 20th official anniversary of my entry into the anti-virus/security field. Nowadays, viruses (and, in general, worms) have declined in importance and now constitute a fairly small proportion of the totality

(Fake) Videos of Berlusconi attack

It is public knowledge that the Italian Prime Minister Silvio Berlusconi was hit in the face which left him with facial injuries, a broken nose and several broken teeth. The video of the attack is circulating on the Internet but at this time, if you search for them on any search engine it is possible

Your Data and Your Credit Card

[Update: I had a couple of machine crashes while I was writing this, and only just realized that a pointer to Allan Dyer's excellent article at hadn't survived to the final version. Which is a pity, because it's very relevant, and well worth reading.] Over the weekend, I posted a blog on the AVIEN site

The Internet Book of the Dead

This blog is a bit of an oddity. ESET UK were approached by Dan Damon, a reporter putting together a piece about “the complications of a digital world when someone passes away”, asking if there was someone at ESET who would be interested in being interviewed for BBC1 radio on the subject. The request got

Droid Avoids with an AppleJackHack

Will the Motorola Droid be the next malware-victimized smartphone? Well, it's a bit early to make a claim like that, but the fact that it's been rooted (an analogous process to jailbreaking on the iPhone and iPod Touch) in order to allow end-users to install unapproved applications, puts the platform one step nearer. See the

Follow us

Copyright © 2017 ESET, All Rights Reserved.