About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
A popular wireless access point made by Cisco Systems’ Linksys unit has a vulnerability that enables a remote attacker to gain root access and execute arbitrary commands on the device. The bug is several months old and Linksys has not issued a patch for it yet.
As malware authors and attackers have continued to employ the Windows AutoRun functionality to help spread their malicious creations–culminating famously in the Stuxnet worm–Microsoft has been making gradual changes to help prevent these attacks. This week the company took the major step of putting an optional fix into Windows Update that will disable Autorun.
When Barracuda Networks started its bug bounty program about three months ago, company officials weren’t exactly sure what to expect. They didn’t know whether there’d be an onslaught of submissions or the sound of crickets chirping. The reality turned out to be somewhere in the middle.
Adobe has released a massive set of patches that fix vulnerabilities in most of its more popular applications, including a number of critical bugs in Flash, Reader and Shockwave.
The creator of the infamous Eleonore exploit pack has released a new version of the attack toolkit, adding some new exploits, including one for a zero day vulnerability. The new version of Eleonore is selling for $2,000, a premium price even in the world of high-level exploit kits.
Malware is big business. Malware writers and attackers are just the most visible parts of the ecosystem; there are many invisible moving parts behind the scenes that are rarely seen or described. Now, a complete picture of the business model and inner workings of the malware industrial complex is emerging.
A group of academic researchers at the University of Cambridge has developed a new technique for making JPEG images copy-evident, so that users can tell whether an image has been recompressed and copied.
Researchers have discovered that the gang behind the once-and-future botnet Waledac has gathered nearly 500,000 stolen passwords for email accounts, along with close to 125,000 sets of pilfered credentials for FTP accounts.
Researchers are tracking a new bot that originated in China and is being used by various associated botnets that are hammering away with DDoS attacks aimed at several dozen targets around the world, including a number of telecom companies and specialized manufacturers.
Cross-site scripting bugs have been a major problem for Web site operators for years now, and while their causes and their solutions are both well-understood, they’re still quite pervasive. But a new free service is aiming to help site owners avoid the serious compromises that can follow an attack on an XSS flaw.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
