About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
Attackers are using a some new schemes that combine old phishing tactics with some newer techniques in order to steal or disable the SIM cards in victims’ mobile phones and then take them over for use in bank fraud transactions.
VANCOUVER–If there’s one thing that emerged from all of the craziness that was CanSecWest, Pwn2Own and Pwnium, it’s that life is becoming more difficult for researchers and attackers looking to exploit modern browsers. It’s not impossible, of course, but it’s certainly not the warm-up exercise that it was four or five years ago.
Google has pushed out a patch for the second full sandbox escape exploit used in the Pwnium contest at CanSecWest. The Chrome vulnerabilities that the exploit targeted were discovered by an anonymous researcher who used the name PinkiePie and claimed a $60,000 reward from Google.
VANCOUVER–Say what you will about Chaouki Bekrar, but the man is nothing if not frank. Bekrar, who is the public face of the VUPEN team that has been toying with the Pwn2Own contest this week, has become a lightning rod in the debate over exploit sales, and from all outward appearances, he couldn’t be happier about it.
The same team from VUPEN that took down Google Chrome on Wednesday has succeeded in compromising Internet Explorer 9 on Windows 7, using two separate bugs. The success at the Pwn2Own contest was the result of a heap overflow bug in IE as well as a separate bug in the browser’s protected mode.
VANCOUVER–The shift to mobile computing platforms in recent years has made life much easier for many users, but it’s also made life a lot more difficult for security researchers. Working on any software or hardware product carries with it a number of potential legal challenges, but mobile and embedded devices have their own special set of pitfalls that are beginning to present problems for researchers.
VANCOUVER–Google has already patched the bugs used by researcher Sergey Glazunov to compromise Chrome on Wednesday as part of the company’s Pwnium contest at the CanSecWest conference here.
VANCOUVER–One of the first things we’re taught as kids is that sharing is good. If you have two Chocodiles and Billy has none, you give him one. Sharing once was the norm in the security community–or, more specifically, certain sections of it–as well, but if the atmosphere at the CanSecWest conference this year are any indication, those days are quickly coming to an end.
VANCOUVER–Authentication is one of the thornier problems in security and it’s one that’s never been solved to any real degree, despite decades of research, technological advances and trial and error. For companies such as Facebook that have to deal with authentication on a massive scale, the problem is even more difficult. Facebook is trying a number of different “social” authentication methods right now, and while some are innovative, they all come with serious drawbacks and weaknesses.
VANCOUVER–A group of researchers from VUPEN, a French security firm, was able to compromise Google Chrome in the initial stages of the Pwn2Own contest. But because of the new rules this year, that doesn’t guarantee them a win in the contest. Rather, it just gives them a nice head start.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
