Phishers target corporations and corporate executives for the same reason that bank robbers target banks – because that’s where the money is.

With that in mind, Alex Eckelberry, Sunbelt Software president, has the details on his company’s blog about a new scheme that claims to be a Better Business Bureau notification.

It’s similar to other BBB-copied schemes seen in recent months, but instead of carrying an attached document, it points the user to a malicious website.

Go here for more details and images.

News flash – Microsoft employs ethical hackers - researchers who test the company’s software for holes.

Well maybe that’s not news. But, somewhat surprisingly, Redmond has given its white hats a soapbox.

The hackers@microsoft blog kicked off Saturday with a short lesson on what hackers at the company do, and how they’ll be presenting information on the blog in the weeks and months to come. It’s worth a look.

Here’s a peek at what they had to say:

“Of course, there is controversy even in the word ‘hacker,’ but I don’t think that should stop us from using it in the manner I think is the most appropriate. At his or her core, a true hacker is someone who is curious and wants to learn how systems work. This can, and of course at Microsoft, is done in an ethical, legal manner. We employ ‘white hat hackers’ who spend their time pentesting and code reviewing applications and software looking for weaknesses and vulnerabilities so that others don’t once we’ve released that code into the wild. We employ many, many smart testers who know more about some of our software then perhaps the architects who designed it. We also employ some of the top researchers in their industry, dedicated people working on the bleeding edge of what’s going to be common place in the next five or 10 years of computing. So yes, Microsoft does have hackers, and its time to introduce you to some of them and show you what it is exactly that they do.”

- techjunkie, hackers@microsoft, Aug. 25, “welcome to a different kind of blog from microsoft”

More news to report form the Wall Street Journal, and it’s not about Karl Rove.

Earlier this month, we let you know about this article that appeared in the newspaper advising corporate end-users on how to get around IT regulations to use instant messaging, install applications, etc.

As you might’ve guessed, the piece didn’t draw the best response from IT pros, who probably flooded more than one email box at the Journal’s offices.

So here’s the follow-up article, printed on Tuesday, “Helping the IT department help you,” courtesy of this post at Andy, IT guy’s blog.

Spam hasn’t just been an IT security topic of late, it’s been the topic.

Why? Although most spam messages are harmless as long as the end-user knows how to use his or her delete button, spammers are showing quite a bit of innovation in crafting the junk email messages – more so that many virus-writers.

Lately, the most prominent trend has been spammers’ use of attachments to spread messages – mostly, in the past month, PDF attachments.

But those may now be giving way to another type: FDF files.

PDF spam, we hardly knew ye’…

Pedro Bueno, researcher at McAfee Avert Labs, has a rundown posted on the lab’s blog.

“Yes, say goodbye to the PDF spam wave and welcome the FDF stock spam wave! And yes, you will be able to open it with the regular Acrobat reader! Maybe to bypass filters based on file extension, the spam now is using the file extension .FDF, which is the format used by the data exported from a PDF form fields. The new spam will usually follow the format: -UserEmail.FDF, like GlobalTrading-pbueno.fdf.”

- Pedro Bueno, McAfee Avert Labs Blog, Aug. 10, “Goodbye PDF spam…welcome FDF!”

Don’t let anyone tell you that nothing ever happens at Black Hat anymore.

Researcher Robert Hansen has a recap on his blog of a conversation he had at the Las Vegas conference with a number of Mozilla officials. What began as a debate ended with Mike Shaver, Mozilla director of ecosystem development, using some colorful language to describe how quickly Mozilla can push out patches for Firefox.

“We showed up and nearly immediately I was surrounded by the bulk of the Mozilla QA and security team that was attending Black Hat. They asked me lots of questions and gave me lots of info. It was a pretty equitable trade of information. Clearly, they acknowledge that they need help from the community, but they also feel confident that once things come to their attention it’s simply a matter of days to close their holes. They said the recent rollouts were actually slower than they would have liked them to be, even though they were only a week and a half apart. Further, they said that they could roll out any critical patches within 10 days. Not one to let challenges go untested I called BS.

I told him I would post his card — and he didn’t flinch. No, he wasn’t drunk. He’s serious. I’ve always been a fan of Mozilla and Firefox. However, this is a pretty bold claim for a company of any shape or size. I shopped the business card around to various people while I was at the Microsoft party the next day to get people’s reaction. The consensus was that it was funny, very difficult to achieve and in one case, one of the head guys of security at Amazon simply doubted that the patches would be of sufficient quality. I’m not going to comment on my personal feelings on this matter except to say that I’d love to see Mozilla back up their promise.”

So was this a guarantee that Mozilla can patch anything and everything within 10 days? Mozilla clarified any statements, official or otherwise, on Monday with a few blog posts of its own.

From the blog of Window Snyder, chief security something-or-other:

“When I asked [Shaver] about it, he said he meant to communicate to Robert that since Mozilla got a recent security update out in only 10 days, that there was no reason for Robert to post details of vulnerabilities publicly before a patch was available. Since we’re among the most responsive software vendors, security researchers do not have to resort to full disclosure to get us to patch bugs quickly.

This is the official Mozilla word: This is not our policy. We do not think security is a game, nor do we issue challenges or ultimatums. We are proud of our track record of quickly releasing critical security patches, often in days. We work hard to ship fixes as fast as possible because it keeps people safe. We hope these comments do not overshadow the tremendous efforts of the Mozilla community to keep the internet secure.”

And an apology from Shaver himself:

“I was intending to express my confidence in our ability to turn around a fix quickly if we needed to by giving him a sort of ‘admit one’ ticket for a disclosure that he thought needed an especially fast response due to extreme risk or some such. That was a bit overzealous in the cold light of hindsight, but at no point did I intend to indicate that Mozilla policy was a 10-day turnaround on all disclosed vulnerabilities. People are reading the conversation and Robert’s post that way, but that’s not our situation, and it certainly wasn’t my intent to give that impression.

I apologize, and hope that nobody will think less of Mozilla because of my error. We don’t issue challenges, and nobody here thinks that security response is a game. This was a personal bargain and overwrought showmanship from a late-night Black Hat party that has now taken on a life of its own, and I hope the fracas about my overzealous comments to Robert don’t overshadow the great work that people on the Mozilla project do to keep our users secure.”

An article on the Wall Street Journal’s online edition caught our eyes – and apparently the eyes of more than a few security pros.

Handler Lenny Zeltser of the SANS Internet Storm Center detailed “Ten things your IT department won’t tell you” on the organization’s dairy today. As a result, quite a few IT pros may call the Journal to cancel their subscriptions.

The article details ways to use your work PC with some of the comforts of home, distributing advice on risqué practices from the somewhat harmless (how to look like you’re working) to potentially dangerous (how to get software your company won’t let you download).

One ISC reader claimed that the article “ultimately tries to convince our users that forwarding sensitive company information to free web-based storage solutions, installing any application, surfing porn or forwarding your email to a free third-party service is perfectly acceptable.”

I’ll leave it up to you to decide if that’s true or not. Here’s a link to the article.

My two cents is that it did, intentionally or not, portray IT professionals as dumb and insensitive gatekeepers, trying to block off employees from their friends and families in the outside world. Most employees would disagree, and rest assured, the average IT pro has known about these freshly declassified shortcuts for quite a while.

It’s also a surprising opinion in the pages of the Journal, whose opinion pages are known to be, as Lowell Bergman pointed out in the motion picture The Insider, “not exactly a bastion of anti-capitalist sentiment.”

The ISC handlers make a great point, noting that the article may be less than up-front about the potential risks for putting the article to use:

“ISC handler Swa Frantzen mentioned that the article left out one big risk: Violating the company’s policy may be a reason for dismissal. He pointed out that IT staff can use the article as a way of raising awareness for the policies that exist at the companies, and the sanctions associated with violating the policies. He also emphasized the need to develop IT practices that support the mobile nature of the modern workforce. “We will need to evolve from the medieval walled city model we all build with our current security technology to a modern grid pattern city, where the people live in the suburbs and are mobile.”

His point in short: if the human resources office calls, don’t blame Rupert Murdoch.