About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
With a key election in Iran looming on Friday, Google officials say they have seen a major uptick in the volume of phishing attacks against users in Iran, possibly coming from the same group that was using fake Google certificates to attack Iranian targets in 2011 after the compromise of DigiNotar.
A group of eight senators from both parties have introduced a new bill that would require the attorney general to declassify as many of the rulings of the secret Foreign Intelligence Surveillance Court as possible as a way of bringing into the sunlight much of the law and opinion that guides the government’s surveillance efforts.
After years of discussion and waiting, Mozilla has finally added Content Security Policy 1.0, a defense against some common attacks such as XSS, to its Firefox browser. CSP already has been implemented in Google Chrome and Internet Explorer and there was a limited implementation of it in Firefox previously, beginning in 2011, but this is the first time the approved 1.0 specification has been implemented in Firefox.
A group of people, including a former federal prosecutor and the parents of a Navy SEAL sniper killed in action, have filed a class-action law suit against the National Security Agency, Verizon and President Obama over the NSA’s collection of cell phone data. The suit says the order that enabled the surveillance program is “the broadest surveillance order to ever have been issued” and enables indiscriminate collection of data.
Java is a security headache, not just for users and Oracle, its provider, but also for other software companies that have to deal with it, as well. Microsoft has taken steps to address this problem by releasing a FixIt tool that is designed to block all of the Web-based Java attack vectors in Internet Explorer, while still leaving the desktop Java functionality intact.
There is a cross-site scripting vulnerability in the Apple Store Web site that is exposing visitors to potential attack. The vulnerability was discovered by a German security researcher who says he informed Apple about the problem in mid-May, but the vulnerability still exists.
The top U.S. intelligence official addressed the recent revelations about the National Security Agency’s covert cell-phone and email data collection surveillance programs on Thursday, saying that the programs have been ongoing for years, are fully authorized under U.S. law and that the leaks regarding the programs are “reprehensible” and could endanger the country’s national security.
Google has one of the older bug bounty programs in existence, and the company often makes changes to its rules in an effort to stay current with the security landscape. The latest change is another increase in the rewards that the company will pay to researchers who report certain bugs, including cross-site scripting in sensitive Web properties, to $7,500.
We were warned. Over and over again. Not just by privacy advocates and by security experts and by civil liberties organizations and by the guy on the corner in the tin foil hat shouting about the government intercepting his brain waves. We were warned by some of the very people charged with overseeing the administration’s efforts to expand its domestic intelligence gathering capabilities. We were warned by politicians.
More than 18 months after a security researcher revealed a long list of vulnerabilities in its SCADA products, Schneider Electric has released patches for a subset of those bugs for a couple of the affected products.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
