About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
SAN FRANCISCO–There are dozens of new bugs discovered every week in popular applications, and many of them are painted as critical flaws that need to be patched immediately lest you risk the wrath of the attackers. However, in many cases, it’s not necessarily those highly publicized flaws that will end up leading to a major data theft, it’s the problems lurking underneath the top layer that are the real killers.
SAN FRANCISCO–A panel of cloud providers and enterprise security professionals said that in order to make enterprise security teams feel more comfortable giving up their data, cloud providers need to be more transparent and open about the security measures and processes they have in place to protect that data. Those assurances , they said, need to go beyond the current point-in-time assessments and move to more meaningful continuous monitoring processes.
Two researchers have developed a new attack on TLS 1.0/SSL 3.0 that enables them to decrypt client requests on the fly and hijack supposedly confidential sessions with sensitive sites such as online banking, e-commerce and payment sites. The attack breaks the confidentiality model of the protocol and is the first known exploitation of a long-known flaw in TLS, potentially affecting the security of transactions on millions of sites.
Michael Kaplan presents his proposal for authenticating every MTA on the web and identifying every spam message.
Google has fixed more than 30 security vulnerabilities in its Chrome browser with a new version the company released on Friday. The company also paid out more than $14,000 in rewards to the various researchers who reported bugs that were fixed with Chrome 14.0.835.163.
Searching on the Internet is fun. You can find videos of cats making meatloaf, cats playing the hammer dulcimer and cats reading Shakespeare while juggling eggs. Oh, and you can find malware, too. Lots of malware. Researchers at GFI Labs are good at finding that malware, and they’ve come across a number of advertisements in Yahoo and Bing search results that are pointing users who searched for Firefox, Skype or other popular software to malicious sites that instead serve up rootkits and other malware.
Cisco has issued patches for a series of vulnerabilities in its Cisco Unified Service Monitor and Cisco Unified Operations Manager and CiscoWorks LAN Management Solution products, all of which can lead to remote code execution.
A Dutch agency that regulates the actions of telecommunications providers has revoked DigiNotar’s ability to issue certificates for digital signatures. The agency said that because of the way that DigiNotar behaved during the attack on its certificate authority infrastructure, the company no longer has the authority to issued so-called qualified certificates.
Two weeks after releasing a fix for the range-header denial-of-service flaw that was much-discussed on security forums and mailing lists, the Apache Software Foundation has pushed out another version of its popular Web server that includes a further fix for the same flaw.
Attackers on Tuesday hacked the uTorrent.com service, replacing the uTorrent software download with a rogue antivirus program that demanded payment from users in order to remove non-existent malware from their machines.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
