About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
HP has released a free static-analysis tool designed to find vulnerabilities in applications developed on the Adobe Flash platform. But HP SWFScan is no security geek plaything.
It’s meant specifically for developers without much in the way of security training.
It appears that the free ride is over for software vendors.
For years, software makers have benefited from the work done by the community of security researchers who spend days or weeks looking for vulnerabilities and novel ways to break the vendors’ products. This work is virtually always done pro bono by researchers who either have day jobs and do their research as a sideline or by experts at security companies who do the work as a way to promote their research teams. Either way, until recently, most of these bug reports were given to the affected vendors for free.
The Conficker worm has been wreaking havoc on the Internet for several months now, and despite the concerted efforts of dozens of security organizations around the world, it is showing no signs of fading. A new analysis of Conficker by SRI International shows that the worm’s authors have added further code obfuscation and other mechanisms to avoid analysis and removal.
By Elinor Mills, CNET
Presenters at the CanSecWest security conference detailed on Thursday how they can sniff data by analyzing keystroke vibrations using a laser trained on a shiny laptop or through electrical signals coming from a PC connected to a PS/2 keyboard and plugged into a socket.
Apply all of the browser, application and OS patches you want, your machine still can be completely and silently compromised at the lowest level–without the use of any vulnerability.
The rumored acquisition of Sun Microsystems by IBM could have far-reaching consequences for the identity-management market. Both companies have long histories in the IAM market, but have taken different paths over the years, with Sun focusing on open-source development and IBM sticking with the commercial model. So integrating the two portfolios could prove to be a major challenge, writes Steve Coplan of The 451 Group.
A parade of security researchers spent the better part of Wednesday at the CanSecWest conference putting the lie to the notion that iPhones, Windows Mobile devices and other smartphones are not really targets for attackers.
At the Workshop on the Economics of Information Security at Dartmouth College, experts discussed the drivers of the underground cybercrime economy, how the security story has changed in the media in recent years and what can be done to address the malware pandemic.
Microsoft’s initial move into the security products market, the ISA Server, has evolved well beyond its firewall roots. Now known as the Threat Management Gateway, the product is being positioned as a comprehensive Web security gateway. But as Eric Ogren writes in his review of the Threat Management Gateway [SearchSecurity.com], the beta release offers enterprise IT shops some solid capabilities, but also has some considerable drawbacks.
PDFs containing exploits for the recent 0-day vulnerability in Acrobat Reader are now being actively sent out through spambots. The folks at the IBM ISS X-Force say they’re seeing infected PDFs being spammed out and that it looks like the traffic is mainly coming from Taiwan, though those may be spoofed addresses.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
