Source: WaPo

The report says Treasury bypassed rules under the 2008 bailout that limited pay. Treasury approved raises that exceeded pay limits and in some cases failed to link compensation to performance, it notes.

Christy Romero, the special inspector general for TARP, said the guidelines say compensation should not exceed the 50th percentile of pay for executives in similar positions at other financially distressed companies.

But pay surpassed that level for 63 percent of the executives whose pay was approved, according to the report.

The report also said Treasury officials had been warned a year ago that the department needed to reform its procedures to ensure that the pay guidelines are followed.

Read more: http://www.washingtonpost.com/business/report-treasury-approved-excessive-pay-for-executives-at-bailed-out-aig-gm-and-ally/2013/01/28/7e9f52ba-697d-11e2-9a0b-db931670f35d_story.html

---

Critical Java zero-day bug is being “massively exploited in the wild”
http://arstechnica.com/security/2013/01/critical-java-zero-day-bug-is-being-massively-exploited-in-the-wild/

Attack code that exploits vulnerability in Java's browser plugin has been added to the Blackhole, Cool, Nuclear Pack, and Redkit exploit kits, according to the Malware Don't Need Coffee blog, prompting its author to say that the bug is being "massively exploited in the wild." Miscreants use these products to turn compromised websites into platforms for silently installing keyloggers and other types of malicious software on the computers of unsuspecting visitors. KrebsOnSecurity reporter Brian Krebs said the curators of both Blackhole and Nuclear Pack have taken to the underweb to boast of the addition to their wares. It's not yet clear how many websites have been outfitted with the exploits.

snip

"There appears to be multiple ad networks redirecting to Blackhole sites, amplifying the mass exploitation problem," Kaspersky Lab expert Kurt Baumgartner wrote. "We have seen ads from legitimate sites, especially in the UK, Brazil, and Russia, redirecting to domains hosting the current Blackhole implementation delivering the Java 0day. These sites include weather sites, news sites, and of course, adult sites."

Java 7 Update 10 ships with a feature that makes it far simpler to unplug Java from the browser than in previous versions. Oracle’s instructions for using that feature are here: http://www.java.com/en/download/help/disable_browser.xml

Setting the Security Level of the Java Client: http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html