News & Commentary
Content posted in July 2010
|
Be Careful What You Search For
Viruses and malware used to spread and try to find computer users to infect. Today, research released at DefCON 18, shows that increasingly search engines are bringing users are going straight to the malware.
Researcher Intercepts GSM Cell Phones During Defcon Demo
In the wake of pressure from the FCC, security expert demonstrates major GSM hack
Microsoft To Release Emergency Patch For Windows
The "out of band" emergency update addresses a Windows vulnerability that is being exploited by attackers using a "highly virulent strain" of malware.
Real-World Attacks With Social Engineering Tookit
Social engineering has always been a penetration tester's (and hacker's) most effective tool. I would say it's their best weapon, but not everyone is good at the softer, human side of social engineering. However, when it comes to the technical side, the tools are getting better and better, including the latest version of the Social Engineering Toolkit released at BSides Las Vegas on Wednesday.
Most SSL Sites Poorly Configured
Half of all SSL servers run older, insecure version of SSL; attacks against HTTPS browser sessions detailed at Black Hat
Former NSA, CIA Director Says Intelligence-Gathering Isn't Cyberwar
Efforts to crack U.S. cyberdefenses are standard operating procedure, Hayden tells Black Hat audience
New Tool Allows Websites To Keep Serving Pages After Infection
"Mod_antimalware" strips out malware instead of blocking infected pages, Black Hat presenter says
Google Cleared Of UK Street View Privacy Breach
"Meaningful personal details" weren't disclosed when Google's cars collected publicly broadcast Wi-Fi network names and MAC addresses, finds British government authorities.
Rite Aid's $1 Million Settlement: More Good Enforcement News
Rite Aid Corp. having to pay a $1 million settlement to possible Health Insurance Portability and Accountability Act (HIPAA) violations is another right step in the direction of enforcement.
Adobe Joins Microsoft's Advance-Alert Program For Security Vendors
Microsoft's MAPP program will now include advance information on Adobe product vulnerabilities
Smarsh Launches Employee Text Message Archiving
Expanding on its social media, instant message and email archiving offerings, Smarsh has launched a mobile message archiving module for BlackBerry, Android and Windows with iPhone support due later this year.
Malware Authors Leave Their Fingerprints On Their Work, Black Hat Researcher Says
Careful study of malware can help experts recognize its source and protect against it
Predicted Fallout Following WikiLeaks Video
Government agencies could become all the more secretive, says Gartner VP
ATMs At Risk, Researcher Warns At Black Hat
Barnaby Jack demonstrates remote and local exploits that work on popular bank machines
Internet Infrastructure Reaches Long-Awaited Security Milestone
The DNS root is now officially signed with security protocol DNSSEC -- next comes development, penetration-testing of the technology
Four Must-Have SMB Security Tools
Regardless of their size, many SMBs still need to meet strict compliance regulations, such as PCI and HIPAA. In addition to any special requirements, there are a few security technologies every small business should have in place. Here are my four SMB security must-haves.
Black Hat: U.S. Infrastructure Vulnerable To Cyber Attack
This broad variety of platforms and applications provides many holes for hackers to get through, says the US-CERT Director.
Verizon Data Breach Report: Some Big Surprises
One of the most comprehensive data breach reports available found the number of breaches to have declined significantly last year, and significant changes in how attackers are infiltrating companies.
CoreTrace Bouncer Improves Application Whitelisting
The Bouncer client enforces a whitelist of approved applications at the kernel level and provides list administration through a central management application.
Researcher Exposes Massive Automated Check Counterfeiting Operation Out of Russia
'Big Boss' operation used VPN-tunneling botnet, Zeus Trojan, database-hacking, and money mules to help print and cash phony checks
Google, Facebook, Apple Face Privacy Questions From Senators
Lawmakers are concerned about the tech companies' practice of collecting information about people's online activity and sharing it with third parties.
LinkedIn Valued At $2.26 Billion
Business networking site's value has more than doubled in two years.
Alleged Mariposa Botnet Creator Arrested In Slovenia
Law enforcement agencies say they have the 23-year-old writer of "Butterfly"
WikiLeaks Tests Feasibility Of Government Data Security
Governments will always face the twin challenges of balancing the need for secrecy with the need to collaborate, say experts.
Breaches Down, Insider Attacks Up, Verizon Business/Secret Service Study Says
PCI compliance, saturation of black market may have driven decline, investigators say
Black Hat: Microsoft Brings Adobe Into Security Program
Adobe will soon be distributing security information through MAPP, the Microsoft Active Protections Program.
Stolen Records, Data Prices Decline
Verizon's 2010 Data Breach Investigations Report reveals some surprising shifts in cybercrime.
Making Storage Management Easier
As we discussed in our last entry no matter how easy the storage protocol or storage system you select at some point someone is going to have to interact with the storage itself. It may be a problem that needs to be resolved or it may be a need to provision a new server but something will come up. In most mid-sized data centers managing storage is no one's full time job. It is something that is dealt with
Sourcefire Rolls Out Open-Source 'Razorback'
New platform aimed at better detecting and defending against advanced, targeted attacks
Yahoo Japan Selects Google Search
Microsoft's search technology was not strong enough for its needs, according to Yahoo Japan, in announcing Google as the new search partner.
'App Genome Project' Exposes Potential Smartphone Risks
Researchers from Lookout will present their findings thus far in study of freebie Android, iPhone apps
McCain: Wikileaks Is Anti-U.S.
Arizona senator says Julian Assange's underground organization is operating with a biased agenda.
Sophos Blocks Windows Shell Attacks
Malware protection tool doesn't blank out shortcut icons like Microsoft's proposed workaround for the active exploit.
DoD Report Details Illicit Content Probe
An Inspector General report reveals that Pentagon employees and contractors were investigated, and some prosecuted, as part of an Immigration and Customs Enforcement probe into child pornography.
Third-Party Content Could Threaten Websites, Study Says
Widgets, ads, and applications from third parties could give hackers an in, Dasient warns
Google Apps Fitted With Government Controls
To accelerate adoption of cloud computing in the public sector, Google has launched a version of Google Apps that meets government regulatory requirements.
Report: British Ministry Of Defense Lost More Than 1,000 Storage Devices In Two Years
Many of the devices were unencrypted; other agencies also at risk
Citibank Warns Of iPhone App Security Flaw
Mobile banking customers in the U.S. who use Citibank's Citi Mobile app have been advised to update the app.
Zeus Malware Anti Piracy Measures Thwarts Competitors, Researchers
Zbot financial malware only works when executed on one specific machine and from one specific path, similar to hardware-based licensing systems employed by major software companies.
One Breach = $1 Million To $53 Million In Damages Per Year, Report Says
New Ponemon report studies real attack cases and their financial fallout; new Digital Forensics Association study tallies five-year public breach data
ZTE $1.5 Billion Development Hits Snags
The contract manufacturer is addressing concerns about its planned manufacturing, research, and training base in southern China.
What You Should Know About Tokenization
A week ago Visa released a set of best practices and recommendations for tokenization. Unfortunately, "best practices" leaves plenty of room for poor implementations.
Mozilla Patches Critical Firefox Security Patch
Just a few days after issuing more than a dozen security updates, many of them critical, the foundation that published the popular Firefox web browser issues a patch to fix its patch.
Killed By Code: The FDA And Implantable Devices Security
A new report from the Software Freedom Law Center deals with the security implications of bionic medical devices being implanted into the human body.
Texas Firm Says It Holds A Patent On Spam Filtering
Lanier Law Firm files suit against 36 companies, including top security tool vendors
Security BSides Grows, But Not Too Much
The security "unconference" is back in Vegas, and this time the setting is a gated private resort with multiple swimming pools and a sand beach, and the number of attendees signed up so far for the free -- yes, free -- event has doubled. But that doesn't mean Security BSides will lose the intimate vibe that its organizers envisioned and encouraged when they first launched it in Las Vegas a year ago.
Black Hat USA 2010: Complete Coverage
A round-up of articles leading up to and live coverage from Black Hat USA 2010, July 24 to 29, Las Vegas
Tech Insight: How To Cut Security Costs Without A Lot Of Pain
Everything from trading costly training for local conferences to outsourcing some security tasks can save money --- but first carefully consider the options
Imperva Identifies Cloud Based Phishing Kit
Cybercriminals can create attacks spoofing 16 sites, including Facebook, RapidShare and Skype, using the next-generation phishing toolkit.
Windows Shell Attacks Increase
Microsoft and Siemens released tools to combat the zero-day exploits which autorun malicious code from USB drives.
|
White Papers
Video
3 Comments
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database CVE-2018-19349
PUBLISHED: 2018-11-17
PUBLISHED: 2018-11-17
PUBLISHED: 2018-11-17
PUBLISHED: 2018-11-17
PUBLISHED: 2018-11-17
From DHS/US-CERT's National Vulnerability Database CVE-2018-19349
PUBLISHED: 2018-11-17
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php.
CVE-2018-19350PUBLISHED: 2018-11-17
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.
CVE-2018-19341PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation near NULL starting at FoxitReader...
CVE-2018-19342PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information via a U3D sample because of a "Read Access Violation starting at U3DBrowser+0x00000000...
CVE-2018-19343PUBLISHED: 2018-11-17
The u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0.10826 allows remote attackers to cause a denial of service (out-of-bounds read), obtain sensitive information, or possibly have unspecified other impact via a U3D sample because of a "Data from Faul...
- Terms of Service
- Privacy Statement
- Legal Entities
- Copyright © 2018 UBM, All rights reserved
Tweet This