Best Of Web
Best Of The Web
GREEN TECH
FBI Finds Smart Meter Hacking Surprisingly Easy
Smart meters reduce theft in some countries, but introduce new hacking opportunities in others
MICROSOFT SECURITY RESPONSE CENTER
Microsoft Releases Six Security Patches
Two critical updates released on Patch Tuesday
HACKER NEWS
Anonymous Plans To Take Down Great Firewall Of China
Hacktivist group plans to launch more attacks against Chinese government websites
MICROSOFT WINDOWS BLOG
Upgrade Today: Two-Year Countdown To End Of Support For Windows XP And Office 2003
Phaseout of older software will increase security, software giant says
HELP NET SECURITY
An Unsecured Computer Is Worse Than An Unlocked Home
Using a computer without security is riskier than leaving your home or car unlocked, study says
THE WASHINGTON POST
For Agency, A Loss Of Technology Has Had Down And Upsides
The Economic Development Administration has gone offline in the wake of a targeted attack spotted three months ago that was so invasive that the agency is not using email or other electronic access for now until it�s cleaned up
KREBS ON SECURITY
FBI: Smart Meter Hacks Likely To Spread
The FBI said in a bulletin that a series of hacks against smart meters over the past several years may have cost one U.S. electric utility hundreds of millions of dollars annually, and more attacks could occur against these devices
SECURELIST BLOG
10 Simple Tips For Boosting The Security Of Your Mac
As the Mac OS X Flashback Trojan spreads, there are some ways for Mac users to better secure their machines, including creating a non-admin account for everyday use, using Google Chrome for browsing, and uninstalling the stand-alone Flash Player
CNN
Mystery Surrounds Silencing Of Key Al Qaeda Websites
Some major Al Qaeda online forums have gone dark over the past two weeks, but no one has claimed responsibility for the outages and U.S. officials are not commenting on it
BANK INFOSECURITY
Chase Hit In ATM Skimming Attacks
Some 13 California residents have been indicted by a grand jury in Las Vegas for an alleged ATM card-skimming scam via vestibule entry doors of ATMs at multiple Chase Bank branches in the region
THE NEW YORK TIMES
Spam Invades A Last Refuge, The Cellphone
Spam is on the rise via text messaging, and while it�s not nearly as widespread as email spam, it carries the same dangers, experts say
CNET
Apple's Security Code Of Silence: A Big Problem
Apple's silence on security isn't helping the increased attacks against its systems, as well as Apple's penchant for controlling patches on its systems, including that of Java, which it doesn't allow Oracle to patch on its systems
SEARCH SECURITY
April 2012 Patch Tuesday: Microsoft To Issue Six Bulletins, Four Critical
Microsoft says it will release six security updates tomorrow, including four critical bulletins that address both server-side flaws and serious vulnerabilities in all versions of Windows, Internet Explorer, and its .NET Framework
CNN
China Admits Sites Hit In Hacking Attack
Chinese officials acknowledged that "certain reports prove again" that Chinese websites had been hacked
TWITTER BLOG
Shutting Down Spammers
Twitter announced that it has filed a suit in federal court in San Francisco against five prolific spam tool providers and spammers and has also beefed up anti-spam features
CYBERWARZONE
Sophos Leaked Partners Data
Malware was discovered on Sophos' Partner Portal server; the antivirus firm has taken the portal offline as it investigates the incident, which could have exposed names, email addresses, hashed passwords
INFOWORLD
Mozilla Blacklists Vulnerable Java Plug-Ins From Firefox
Mozilla automatically disables outdated Java plug-ins in Firefox on Windows in response to ongoing attacks targeting the add-ons
CNET
Facebook Says ID Theft Threat Only On Jailbroken Phones
Facebook is shooting down reports of a researcher finding a vulnerability in the social network's Android and iOS client apps, saying the bug is only associated with jailbroken phones
THREAT POST
Project Basecamp Adds Stuxnet-Type Attack Module To Metasploit
Digital Bond-sponsored Project Basecamp has created new modules for exploiting vulnerabilities in popular programmable logic controllers and submitted them to Metasploit -- including one exploit that wages a Stuxnet-type attack
THE HACKER NEWS
Anonymous Plans 7 April Attack On British government
A U.K. arm of Anonymous is rallying people to help execute a distributed denial-of-service attack against the U.K. Home Office website on Sat., April 7, in protest of the extradition of three U.K. citizens to the U.S.
SOFTPEDIA
Sony Hacker Pleads Guilty, Faces 15-Year Sentence
Cody Kretsinger, former member of the LulzSec crew and a.k.a. "recursion," pleaded guilty in U.S. District Court judge for breaching Sony Pictures Entertainment's computers and could get up to 15 years in prison
INTELNEWS
Why Are Al-Qaeda Websites Going Off-Line?
Al-Qaeda websites began dropping offline late last month in what appears to be coordinated fashion, and security experts say sure looks like a coordinated attack on them
CSO ONLINE
CDT: Cybersecurity Bills Raise Major Civil Liberties Concerns
Four bills on Capitol Hill that would let private companies share threat intelligence could have privacy and civil liberty flaws, according to the Center for Democracy and Technology
ARS TECHNICA
Internet Explorer Market Share Surges, As IE 9 Wins Hearts And Minds
For the second time in three months, Internet Explorer has gained marketshare, with nearly a 1 percent increase
REUTERS
Hacker Claims Breach Of Chinese Defense Contractor
A hacker claiming to be a friend of former LulzSec leader Sabu, who turned FBI informant, says he hacked into a Chinese defense contractor and then posted documents online such as U.S. military transport information
THREAT POST
Google Patches 12 Flaws In Chrome
In the second update for the Chrome browser in the past few days, Google has patched 12 new vulnerabilities in Chrome and added an updated version of Adobe Flash
COMPUTERWORLD
Microsoft Acquires 20 New Windows Security Ideas For $13,400 Each
Security expert says Microsoft's BlueHat Prize contest is a 'cheap way to get someone else to innovate' for Microsoft
THREAT POST
CabinCr3w Hacker Arrested By FBI
Federal authorities have arrested Higinio Ochoa, a resident of Texas, related to his work with the hacking group CabinCr3w that once targeted Goldman Sachs� CEO
PC WORLD
Is Apple To Blame For Size Of Mac Botnet?
Reports of as many as 600,000 Macs infected by the Flashback Trojan raise questions about the security of Macs and Apple's silence over the attacks that had been under way for some time
TECH DIRT
EU Cybercrime Bill Targets Anonymous: Makes It A Criminal Offense To Conduct 'Cyber Attack'
Even "possessing" hacking software and tools can result in arrest, according to newly European Union-approved legislation that appears to be aimed at hacktivism
NAKED SECURITY BLOG
Hacker Jailed For Stealing Millions Of Banking And PayPal Identities
Edward Pearson, 23, from the U.K. is facing prison time for gathering 8 million people's identities, using Zeus and SpyEye to grab PayPal account, bank cards, and other information
THREAT POST
Active Zeus C&Cs Remain Following Microsoft Takedown
Researchers at FireEye say despite Microsoft's recent Zeus takedown, some command-and-control domains remain active as there appeard to evade the sinkhole
INFOSEC ISLAND
Cyber Criminals Top Secret Service Most Wanted List
Among the U.S. Secret Service�s list of most wanted criminals are many alledged cybercriminals, including ones who traffic in stolen and counterfeit credit cards and engage in fraudulent transactions through a consumer credit card service for health consumer
THE REGISTER
Facebook Logins Easily Slurped From iOS, Android Kit
Facebook's iOS and Android clients don't encrypt user credentials but leave them sitting in a folder that other apps or USB connections can reach
ZDNET BLOG
Anonymous Hacks Hundreds Of Chinese Government Sites
The hacktivist group has hit hundreds of Chinese government websites -- some with defacements, others with the leak of administrator accounts, phone numbers, and e-mail addresses
HELP NET SECURITY
Cybercriminals Target Google, LinkedIn And Mass Effect 3 Users
Researchers in March spotted multiple spam attacks and malicious email attacks infecting users under the guise of Google, LinkedIn, Skype, and a video game
QUALYS BLOG
Apple Patches Critical Java Flaw
Apple has issued a critical update for the Java implementation on Mac OS X on both Lion and Snow Leopard -- two months after the release of the corresponding Java version by Oracle, and only a couple of days after attacks were spotted against Macs
DAILY MAIL
Computer Expert Who Stole 8 Million People�s Personal Details Jailed For 2.5 Years
Attack was launched primarily as an 'intellectual challenge,' defendant says
THE INQUIRER
Anonymous Plans An Attack On The UK Home Office
Attack could take place Tuesday night, officials say
COMPUTER BUSINESS REVIEW
Imperva Co-Founder Tells Anonymous To Go Hack Chinese Government
CTO says that if hacktivist group is really in favor of freedom of speech, it should go after China
Best Of Web Archive:
Most Recent | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | 185 | 186 | 187 | 188 | 189 | 190 | 191 | 192 | 193 | 194 | 195 | 196 | 197 | 198 | 199 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216
Free Research and Reports
Whitepapers
- Three Principles to Improve Data Security and Compliance
- Aligning IT with strategic business goals: A proactive approach to managing IT risk to your business
- Connecting the Dots: Are You Seeing the Complete Big Data Picture?
- How crowdsourced testing has changed the game for innovative software companies
- Ensuring Your Apps Work in the Real World
Upcoming Events
Dark Reading Digital Magazine
In This Issue
- The Future Of Web Authentication: Password technology is out of steam. We need safer ways to prove who's who online.
- Rethink ID Management: If the technology continues to improve, it might soon be OK for all of us to be one person on the Web.
Tech Insight
Bugs
Enterprise Vulnerabilities From DHS/US-CERT's National Vulnerability Database
CVE-2013-3562
Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet.
CVE-2013-3561
Multiple integer overflows in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (loop or application crash) via a malformed packet, related to a crash of the Websocket dissector, an infinite loop in the MySQL dissector, and a large loop in the ETCH dissector.
CVE-2013-3560
The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
CVE-2013-3559
epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet.
CVE-2013-3558
The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.