About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
A security researcher has found several serious vulnerabilities in a widely deployed point-of-sale system that enables an attacker to change transactions, steal card data and take other malicious actions. The attacks could be executed remotely under certain circumstances or done through a local interface.
They just do not stop having targeted malware attacks in Syria. Just a few days after the author of the Dark Comet RAT announced he was shutting down development and sales of the tool, partly because it was used in attacks by the Syrian government, experts have found that pro-government attackers are using the Blackshades RAT for similar attacks on anti-government activists.
Passwords as a defensive measure are complete rubbish. There’s no two ways about that. The fact that high-value services such as online banking, corporate email and data storage use simple passwords as the only real security mechanism is a sad commentary on the state of defensive technologies. But, as the continued parade of password leaks of late proves on a daily basis, users who believe these companies are protecting their passwords are sadly mistaken.
If it’s a day ending in Y, then there must be another password leak. And today it’s Yahoo’s turn in the spotlight, as the company is investigating claims that more than 400,000 plaintext passwords were stolen from the company and posted online. Security researchers who have looked at the data say that it appears that the passwords came from the company’s VoIP service.
Google has released an updated version of Chrome 20, fixing three high-risk security vulnerabilities. The update comes just two weeks after Google released Chrome 20, which included patches for 20 bugs.
Hackers broke into a development server at Formspring, a social Q&A site, and made off with the password hashes for 420,000 users and later posted them online. The company has reset all of the users’ passwords and said it also has changed the way that it handles passwords.Formspring officials said on Tuesday that they had discovered the incident that morning and later discovered that some of the hashes had been posted online. The company decided to reset the passwords for all of its users.
Attackers have spent the last few years learning the ins and outs of Adobe Flash, looking for all of its weak spots, unintended behaviors and any other oddities that will enable them to exploit it. That’s been a profitable investment for them, but browser manufacturers and Adobe have been taking steps to change that, with the latest one being Google’s decision to place Flash in a full sandbox inside of Chrome.
UPDATED–In the wake of the Flame malware attack, which involved the use of a fraudulent Microsoft digital certificate, the software giant has reviewed its certificates and found nearly 30 that aren’t as secure as the company would like and has revoked them. Microsoft also released its new updater for certificates as a critical update for Windows Vista and later versions as part of today’s July Patch Tuesday.
The FTC is nearing completion of its investigation into allegations that Google used a special technique to circumvent the privacy settings on Safari to enable better tracking of users, even when tracking was disabled by the user. The decision may cost Google millions of dollars in fines, but it’s not clear whether that will serve as any kind of deterrent for a company that brings in tens of billions of dollars in revenue each year.
You know things have gone sideways when NPR and local TV news are talking about the “Internet doomsday” or “Black Monday”. We have DNSChanger to thank for this latest bout of Internet paranoia, and there’s a ton of misinformation and craziness circulating about the malware. We’re here to provide some actual information, luckily for you.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
