Google Fixes High-Risk Flaw in Chrome
Google has updated its Chrome browser yet again, this time fixing a high-risk vulnerability in the V8 JavaScript engine. That flaw is the only one that Google fixed in this update.
Dennis Fisher
About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
New Flaw in BIND Causing Server Crashes
There’s a new vulnerability in the popular BIND name server software that is causing various versions of the application to crash unexpectedly after logging a certain kind of error. The Internet Software Consortium, which maintains BIND, is investigating the issue and trying to determine the severity of the problem.
Costin Raiu on Duqu, Stuxnet and Targeted Attacks
Dennis Fisher talks with malware researcher Costin Raiu about the investigation into Duqu, the likelihood that it was written by the same team as Stuxnet, whether a government is behind its development and what mistakes the authors made.
Researchers are fairly confident now that whoever wrote the Duqu malware also was involved in some way in developing the Stuxnet worm. They’re also confident that they have not yet identified all of the individual components of Duqu, meaning that there are potentially some other capabilities that haven’t been documented yet.
All eyes will be on Capitol Hill this morning when the House Judiciary Committee holds a key hearing on the controversial Stop Online Piracy Act, which has drawn wide opposition from a variety of groups and companies for its broad language supposedly designed to prevent copyright infringement. The bill, which has been revised a number of times, could have wide-ranging effects on the way the Internet works.
The W3C has proposed a standard for implementing the Do Not Track mechanism for both users and site owners, wading into what has become a contentious and fractious debate. The proposed standard, known as the Tracking Preference Expression, is designed to give users the ability to tell sites what data they can collect, and allow those sites to inform users what they collect, in turn.
Google, which has faced a pile of criticism over its privacy policies and practices, especially as they relate to wireless and mobile devices, says it is changing the way that it maps people’s wireless access points in its efforts to provide accurate location information. The company said it is now encouraging users to add a “_nomap” extension to the SSID of their access points if they don’t want Google to map them.
Apple has issued a fix for a flaw in iTunes that could enable an attacker to perform man-in-the-middle attacks against users. The vulnerability is fixed in iTunes 10.5.1.
The TDSS rootkit has proven to be more pliable and adaptable than a campaigning politician, and attackers have used it in various forms for the last three or four years for all sorts of different attacks. It shows up in drive-by downloads, targeted attacks and just about everything in between, and one of the newer jobs it’s been assigned is to deliver the DNSchanger Trojan.
As the analysis of the Duqu malware continues to evolve, the picture that’s emerging is becoming more and more intriguing. The latest bits of evidence uncovered show that not only do the attackers create custom files for each individual attack, there is evidence indicating that they might have been working on Duqu in some form since 2007.
