Dennis Fisher

About

Dennis Fisher is a journalist with more than 13 years of experience covering information security.

Researchers Find Methods for Bypassing Google’s Bouncer Android Security

Google’s Android platform has become the most popular mobile operating system both among consumers and malware writers, and the company earlier this year introduced the Bouncer system to look for malicious apps in the Google Play market. Bouncer, which checks for malicious apps and known malware, is a good first step, but as new work from researchers Jon Oberheide and Charlie Miller shows, it can be bypassed quite easily and in ways that will be difficult for Google to address in the long term.

Flame Malware Uses Forged Microsoft Certificate to Validate Components

Microsoft has found that some components of the Flame malware were signed using a forged digital certificate that the attackers were able to create by exploiting a weakness in the way that Microsoft’s Terminal Services allows customers to sign code with Microsoft certificates. The company has sent out an update that will remove three untrusted certificates from the Microsoft Trusted Certificate Store and has made a change to the way Terminal Services handles code signing.

Flame Malware Raises Need for Open Talk on Use of Cyberweapons

The discovery of the Flame malware has raised a number of questions, some mundane, some interesting and many unanswerable at this point. But the point that’s most interesting also is the one that likely will go unaddressed for the foreseeable future, and that is, the need for a serious, open discussion on the use of cyber weapons.

Apple Details iOS Security Features in New Guide

by Dennis Fisher
3

Apple has released a detailed security guide for its iOS operating system, an unprecedented move for a company known for not discussing the technical details of its products, let alone the security architecture. The document lays out the system architecture, data protection capabilities and network security features in iOS, most of which had been known before but hadn’t been publicly discussed by Apple.

Behind the Flame Malware

by Dennis Fisher
1

The Flame malware has garnered a lot of attention in the last few days, but there’s also been quite a lot of confusion about what it can do and what its implications are. In this video from PBS Newshour, Dave Shackleford of IANS and Catherine Lotrionte of Georgetown University discuss the worm’s capabilities and its target base.

Tiny New Tinba Banker Trojan Found Stealing Financial Data

by Dennis Fisher
1

Security researchers have discovered a tiny new banking Trojan that comprises just 20 KB of code and uses a number of well-word man-in-the-browser tricks in an attempt to defeat two-factor authentication. Known as Tinba, the new malware doesn’t bother with any encryption or packing and yet is slipping past a lot of desktop defenses.

FBI Warns Users of New ‘Reveton’ Scareware Scam

by Dennis Fisher
3

The FBI is warning consumers about a new scam that’s using a piece of malware called Citadel to redirect users to a scam site that installs scareware on their machines and demands a $100 payment to unlock them. The twist in this scam is that it uses the threat of prosecution by the Department of Justice as the prompt to get victims to pay.

Moxie Marlinspike on TACK, Convergence and Trust Agility

by Dennis Fisher

Dennis Fisher talks with Moxie Marlinspike about his new IETF proposal, TACK, which lays out a way for sites to assert the authenticity of their public keys. They also discuss the Convergence system for replacing the CA infrastructure and the ways in which browser vendors can help enable better trust agility for users.

Flame Malware: Boring, Bloated and Yet Still Effective

by Dennis Fisher
2

Let us stipulate that governments of all political affiliations are trying to steal information from one another. This is called espionage and it has been happening for thousands of years and the only things that have changed are the tactics and the technology. The discovery of the Flame malware–which looks to be the digital equivalent of a spy’s black bag–doesn’t change any of this, but it does raise one big question, and that is not who is writing tools like Flame, but who isn’t?

What’s the Meaning of This: Flame Malware

by Dennis Fisher
2

From all indications, it would appear that attackers are continuing to attack and malware authors are carrying on writing malware. The latest bit of evidence to support these conclusions is the discovery of the Flame malware, which, initial analyses show, is an advanced data-stealing tool that is being used in targeted attacks against organizations in Iran, Syria and Palestine, and has experts speculating that Flame was built by a Western intelligence agency or military.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.