About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
Security researcher Jon Oberheide wrote a fake extension to the popular Angry Birds mobile game and put it in the Android Market as a demonstration of how an attacker could exploit a vulnerability he’d found in Android. The phony app didn’t do anything malicious, but it had permissions on Android handsets that enabled it to send toll SMS messages, steal contacts and take other actions, without the user’s knowledge.
The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access to compromised machines.
There is a series of vulnerabilities in Cisco’s Unified Videoconferencing product, including a hardcoded password for several powerful accounts that can’t be changed or deleted. That bug and others disclosed Wednesday can be used to gain complete control of the device and possibly compromise other parts of the internal network.
For some time now, the browser has been the most dangerous piece of software on the Web, and to hear researchers tell it, the climate it likely to get far worse before it gets any better.
Dennis Fisher talks with Alex Hutton of Verizon Business about the company’s release of the VERIS Community Application and the need for better data in the security community on attacks and incidents.
Adobe on Tuesday released an emergency patch for several critical vulnerabilities in Adobe Reader, including the recent Adobe Flash bug and a separate flaw that was disclosed earlier this month.
In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass the Windows driver-signing protection.
As part of its continuing focus on collecting information on data breaches and thefts, Verizon Business has released VERIS Community application, a new application that enables security professionals to enter anonymous information about an incident and receive a detailed report in return.
There’s a weakness in the Android operating system that could enable an attacker to install a malicious third-party application on Android devices without the user’s knowledge. A researcher has developed a proof-of-concept app that’s in the Android Market now.
WASHINGTON–Despite its reputation for secrecy and technical expertise, the National Security Agency doesn’t have a set of secret coding practices or testing methods that magically make their applications and systems bulletproof. In fact, one of the agency’s top technical experts said that virtually all of the methods the NSA uses for development and information assurance are publicly known.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
