It’s getting pretty easy to forget what month it is, and not on account of the inconsistent weather.

Is it the Month of Apple Bugs? Or is it MySpace Bugs? Or PHP Bugs?

It turns out next month might be the Month of Search Engine Bugs, at least if you believe one Ukrainian hacker who has promised a new vulnerability for every day of June.

There’s plenty of reason to be skeptical that this will pan out. And if it does, will only the major search engines such as Google and Yahoo be targeted?

And after that, what’s next? Here are two other perspectives on the project from McAfee’s Avert Labs and the Security Protocols blog.

Here’s one blog post worth revisiting.

On Monday, Rahul Kashyap took TippingPoint’s ZeroDay Initiative to task for paying researcher Dino Dai Zovi $10,000 for a flaw he disclosed at CanSecWest.

That incident reached its zenith when Gartner analysts made their feelings clear on hacking contests and vendor association with them.

What’s more interesting than the post is the discussion it set off between Kashyap and Terri from TippingPoint – two opposing sides of the debate on vulnerability disclosure ethics. And don’t overlook Thomas Ptacek’s challenge to McAfee to link to its own code of conduct.

It’s also worth clarifying that the nCircle commentary - the one slamming ZDI - quoted in the post is from August 2005. In relation to the flaw purchased at CanSecWest, nCircle has been supportive of TippingPoint’s efforts.

It seems like every week there’s a new IT security blog. We at SC Magazine know all about this, since last week it was us.

But Microsoft’s new Security Development Lifecycle team blog is especially noteworthy. Michael Howard, senior security program manager in the Security Engineering Group, kicked off this week by explaining what the company has learned from the ANI cursor vulnerability.

Howard, who’s been penning his own blog for a few years now, gives a better explanation of the situation in Redmond than I can, so please check it out for yourself.

It’s no secret that Microsoft is everyone’s favorite punching bag, whether the software empire deserves it or not. But give them credit for adding another layer of disclosure with this blog.

It’s not unusual for an IT security story to have twists and turns. With the ever-changing technology on both sides of the good guy/bad guy divide, that’s inevitable.

The story of the CanSecWest “hack-a-Mac” contest is a good example. It started as two researchers exploiting a MacBook Pro vulnerability to win a contest at a Vancouver conference.

It became an assumed flaw in Apple’s Safari web browser.

After some information from TippingPoint, which sponsored the contests, it was clarified to be a flaw in QuickTime that affects all Java-based browsers, which evolved later in the week into a flaw affecting Internet Explorer on Windows operating systems, including Vista.

But today’s big question was, “Did the exploit become public through the wireless network at CanSecWest?” The answer now looks like, “probably not.”

Thomas Ptacek at Matasano Security’s blog followed the reports, closing with an ominous hunch that the vulnerability could turn into something big and a conclusion that blogs may not be the best place for exploit disclosure.

The Roundup came across a thoughtful take on the QuickTime flaw revealed at CanSecWest last week, now found to affect numerous web browsers.

Information Security Sell Out brought up a lightning rod topic this week: vulnerability management ethics.

The Sell Out questions whether a firm, in this case TippingPoint, is engaging in bad business by allegedly using the discovery of a flaw as a marketing opportunity. Did TippingPoint put Mac users at risk by offering $10,000 for discovery of a Mac flaw, thus practically ensuring one would be disclosed? And what if TippingPoint mishandles the newly purchased vulnerability?

Scroll down to the discussion section; a back-and-forth ensues.

Vancouver, British Columbia is a bit off the beaten path for many IT security vendors, but for Mac aficionados, it might’ve been worth the trip to CanSecWest.

To make a long story short, the show offered two MacBook Pros to researchers who could use a fresh zero-day flaw to hack into the Apple laptop.

Researcher Shane Macaulay did, with a little legal help from Dino Dai Zovi, and the team took home both a $10,000 prize provided by TippingPoint and a MacBook.

But what appeared to be the winning vulnerability in Safari is actually much more. The QuickTime flaw actually exists in any Java-enabled browser, meaning Firefox users on Macs are vulnerable, and Firefox users on Windows are most likely vulnerable, as long as QuickTime is installed.

The Matasano Chargen blog has an interesting take on the developing story, if for no other reason because Dai Zovi, like Mozilla security bigwig Window Snyder, is a Matasano emeritus.

Technology news is sort of like food; if you leave it out too long, it’s only a matter of time until it goes bad.

If breaking news isn’t covered within a few days, it’s going to be passed over for the next juicy steak of a story to come along. And with ever-changing technology, and bad guys who never seem to sleep, nowhere in the media is this as clear as than with tech news.

So with that in mind, here are a few blog items to much on over the weekend.

As if they don’t have enough to worry about…
When doing business overseas, a road warrior is likely to check his or her bank account information via the web instead of running up an expensive phone bill or strolling the streets of Tokyo or London looking for a Chase Bank ATM.

So imagine being stationed in a foreign country for months on end, with few urban centers nearby to check account balances.

That’s the rationale behind a new man-in-the-middle phishing scheme that traps members of the U.S. Armed Forces into visiting a website that logs their keystrokes. F-Secure’s research team has a good description on its blog.

Warning: The scam websites, which pretend to be official Bank of America pages and require check card numbers, expiration dates and PIN numbers, look quite real.

Keep it classified
Here’s an another scary item.
Privacy blog PogoWasRight.org, named after a cartoon character famous for saying, “We have met the enemy and he is us,” (must’ve been before my time) has picked up an Associated Press story on Los Alamos workers being warned about identity theft.

Moving towards disclosure
Finally, patch distribution is a tricky business. Most months, Microsoft can’t seem to make anyone happy, no matter what it fixes or how many patches it releases.

With Oracle’s latest patch release just in the rearview mirror, Eric Maurice, the company’s manager for security in the Business Technology Unit, blogged about the latest distribution.

It’s worth reading because public disclosure about patch distributions is an even trickier business than releasing the fixes. It’s a tightrope walk above malicious users and IT pros, and both groups want as much information as possible.

It’s also worth noting that Oracle has made strides in recent months to release patches on a more selective basis and rank vulnerabilities on a clearer scale.