About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
VANCOUVER–Well, that didn’t take long. Before the first session of the CanSecWest conference here even started on Wednesday, a researcher had already succeeded in scoring a full compromise of Google Chrome, using two distinct bugs, and earning himself a $60,000 reward as part of the company’s Pwnium contest.
As the privacy and tracking debate rages in the desktop arena, Mozilla has made a jump to the mobile world by announcing its new Boot to Gecko project, which will include an implementation of the Do Not Track technology on mobile devices. This is the first such implementation and it will give users the ability to tell mobile sites that they don’t want to be tracked persistently while using the Web from their phones.
Many industries tend to run in identifiable cycles. Financial services, the auto industry, entertainment–they all have cycles. Because the security industry isn’t nearly as old as any of these, it hasn’t had much of a chance to establish such cycles. But one seems to be appearing now in the form of renewed criticism and distaste for offensive security research.
An Adobe Flash vulnerability fixed last month is being used in targeted attacks right now, with attackers attempting to persuade victims to open a malicious Word document that contains the payload for the Flash bug. The vulnerability has been patched for nearly a month, but history has shown that flaws that have been patched for several months or even years are still quite valuable for targeted attacks.
Dennis Fisher talks with Paul Judge of Barracuda Labs about his new project, which uses data on the vendors and products on display at the RSA Conference to determine which topics and technologies are the hottest at the moment.
Just two days before the annual Pwn2Own contest is set to begin at CanSecWest, Google has patched a huge set of serious vulnerabilities in its Chrome browser. In addition to the 14 high-risk flaws fixed in Chrome, the company also handed out rewards of $10,000 each to three researchers who regularly submit bugs to Google and have taken home quite a bit of cash in the past as part of the company’s reward program.
SAN FRANCISCO–The PCI DSS standard has taken a beating from critics, security experts and CSOs virtually since the day it appeared in its earliest form in 2004. It’s evolved quite a bit in the intervening years, but it hasn’t shaken any of that criticism, and security folks say there’s a good reason for that: a PCI-compliant network is no real hurdle to exploitation.
The EFF has released a new version of its HTTPS Everywhere browser extension, and users can now turn on a feature that will send the EFF copies of digital certificates that the browser encounters, allowing the organization to look for flawed, fake or expired certificates.
SAN FRANCISCO–You don’t need to look too hard or talk to too many people at the RSA Conference here this week to realize that there is one subtle but persistent signal amid all of the noise: security is failing.
SAN FRANCISCO–The growing stream of attacks in recent years against government agencies, critical infrastructure, utilities and other vital networks has led to an increasingly heated debate around the concept of active defense and targeting the people and groups behind those attacks. That debate has been going on behind closed doors in Washington for years, but it spilled out into the public during a forum on the ethics and legality of active defense at the RSA Conference here Tuesday.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
