Flaw Exposed in Photo Uploader for Social Sites

 Symantec discovered and exposed a flaw in photo uploader software used by social networking sites such as Facebook and MySpace.  This ActiveX exploit is essentially a buffer overflow attack that allows an attacker to place a Trojan on the exploited computer.  This Trojan can then be used to collect usernames and passwords, and other corporate and personal information.

It's very likely that a software firewall would notice the new Trojan, but it's likely that the Trojan would be placed on the PC coincident with some user action, like installing photo uploader software so the user would be likely to accept whatever vague message the software firewall generated.

It's not that social networking sites are to blame.  That's not my point.  My point is, that by visiting sites that aren't work related your employees are exposing you to additional risk.  I recently had a discussion with Tom Clare of Blue Coat Systems, an enterprise gateway security and WAN acceleration company, and he described this in an interesting way.  He said, "You're more likely to find bad things in bad neighborhoods." 

Try to get employees to understand that if they have a responsibility to your company not to expose corporate resources and information to unnecessary threats.