About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
If you somehow needed further evidence after the run we’ve been on with WikiLeaks, Anonymous and LulzSec that security and hacking have invaded the mainstream consciousness, that evidence has arrived in the form of a philosophical question from none other than Kim Kardashian.
Dennis Fisher talks with Josh Shaul of AppSec about the current run of targeted attacks and data breaches, the state of denial among some security and IT staffs about the extent of the problem and what can be done to address the issues.
Researchers have found a new black hat SEO campaign that is being used to redirect users to links that will install the Black Hole exploit kit. The attack is based on searches for, of all things, Shia Labeouf, and leads users through a forest of redirects before plopping them on the compromised site.
There is a large scale spam campaign underway right now in which attackers are using fairly well-crafted emails that appear to come from the IRS to infect victims with the Zeus bot. The attack has been ongoing for a couple of weeks now, and researchers say that although the attackers have taken some precautions to prevent analysis of the sites and malware being used, they also made some key mistakes.
Apple has released a patch for a number of critical flaws in its Java implementation in Mac OS X, and users are being encouraged to update their machines as soon as possible. The most serious of the 11 vulnerabilities fixed in the Java update can allow an attacker to bypass the sandbox and run arbitrary code.
Google has fixed seven security vulnerabilities in its Chrome browser, including six high-priority flaws. The new release of Chrome is version 12.0.742.112 and also includes an updated version of Flash.
There is an ongoing phishing attack playing out right now on the Tumblr network and it already has succeeded in stealing the login credentials of several thousand users, according to researchers who have been following the activity. The attack relies on a fake login page and some promises of free adult content, which have proven to be more than enough incentive for thousands of victims to give up their usernames and passwords.
The long string of attacks against popular Web sites, high-profile companies such as Sony, and government networks has brought the problem of common and easily exploitable vulnerabilities into the public eye, and the Department of Homeland Security today is unveiling a new effort to help address the issue. The plan, which is in conjunction with MITRE, involves identifying the introduction of a new scoring system to help evaluate software projects against a list of common programming errors.
If the events of the last few months have served any purpose, it’s to illustrate once again that security is broken. This isn’t a new sentiment and few of the problems plaguing users and enterprises today are new, either. In this video, longtime security consultant and writer Rik Farrow outlines the missteps that got us into this situation and what can be done to alleviate it. Oh, and this talk was created in 2006.
Pavel Vrublevsky, the head of a prominent Russian payment-processing company, ChronoPay, was arrested in Russia on suspicion of hiring someone to launch a denial-of-service attack against one of his company’s main competitors. The arrest is the latest in a series of high-profile actions against people and groups around the world suspected of being involved in the global cybercrime ecosystem.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
