A significant flaw in the Face.com mobile application KLIK has been fixed to prevent Facebook and Twitter users from having their accounts hijacked.KLIK is a camera app that uses face recognition to tag friends in Facebook photos in real time. It also apparently granted access to KLIK users’ private authentication tokens for Facebook and Twitter accounts, allowing them to be taken over by another user.
The company sent an important e-mail notification with special coding (DKIM) and addressed the recipient by name. It also didn’t include any links in the actual message.
The Finland-based security firm F-Secure is warning companies to beware of Siri, the voice-activated personal assistant app that last month was banned by IBM for security purposes.The potential for Siri-based data disclosures was cited at a Helsinki press conference, in which F-Secure’s vice president, Maria Bordgren, said that Apple’s lack of known corporate security policies leave enterprises vulnerable. Siri queries and other information are stored as text in Apple’s data centers.
Microsoft’s warning of a vulnerability in its XML Core Services 3.0, 4.0, 5.0 and 6.0 that allows remote code to be executed if a victim is convinced to visit a malicous Web site using Internet Explorer. The actively exploited security hole affects all supported Windows releases and all supported editions of Office 2003 and 2007.
Privileged accounts have become an important attack vector, and if a recent survey of mostly IT managers and executives is any indication that threat will continue to grow.
According to results of ID management provider Cyber-Ark’s sixth annual global “Trust, Security and Passwords Survey,” just under half of 820 respondents admitted if they were fired tomorrow, they’d walk out with proprietary data such as privileged password lists, company databases, R&D plans and financial r
Two researchers say they’ve found a security hole in Tumblr, one of the most popular sites on the Internet, that could steal users’ authentication cookies to break into their accounts.
Aditya Gupta and Subho Halder say they’ve tried to contact Tumblr about the vulnerability by using mail and Twitter, but so far no one has responded. The social sharing site hosts 59.4 million micro blogs and has published almost 25 billion posts.
If a newly released survey is any indication, publicized data breaches aren’t enough to prompt small businesses to better protect their customer or employee data.
A survey released this week by The Hartford found 85 percent of small business owners believe a data breach is unlikely and often lacked even basic measures to secure sensitive data.
A once flawed DDoS attack targeting the world’s most widely used Web servers has improved its cryptography and attack capabilities to become a more serious threat.
MP-DDoser, also known as “IP-Killer,” uses a relatively new low-bandwidth, “asymmetrical” HTTP attack to inflict a denial-of-service attack against Apache Web servers by sending a very long HTTP header. This forces the web servers to do a great deal of server-side work for a relatively small request. Additionally, the malware now incorporates multiple layers of encryption.
A new survey conducted by a credit card comparison Web site indicates consumers continue to be lax when it comes to guarding against identity theft.
Members of the hacktivist collective Anonymous resurfaced this week with a new campaign to expose suspected pedophiles on Twitter and get the site and its users to help root out other accounts linked to child pornography.In a Pastebin post, someone using the hashtag #Anonymous posted the Twitter handles for about 100 Twitter users, some with names like @Daddysinfulgirl and @lolitahussy.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
