Dennis Fisher

About

Dennis Fisher is a journalist with more than 13 years of experience covering information security.

Twitter Bug Allowed Apps to Access Direct Messages Without Permission

Social networking sites such as Twitter and Facebook have become not just communication hubs, but also authentication mechanisms for third-party sites. Many sites and Web applications allow users to sign in with their Facebook or Twitter credentials rather than registering, which is a nice convenience. That is, until, it turns into a security liability. Security researcher Cesar Cerrudo recently discovered a bug in Twitter’s code that enabled third-party apps to access users’ private direct messages under some circumstances, even when users had not explicitly granted those apps that level of access.

It’s Time to Abandon Java

As humans, we have a difficult time letting go of things. Whether it be a favorite pair of jeans, a beloved dog or an old friend who you know is just bringing you down, putting aside things we know well is hard to do. But sometimes things are just too broken to be useful any longer, and that’s the point we’ve reached with Java.

Red October Attackers Shutting Down C&C Infrastructure

It appears that the attackers behind the Red October cyberespionage campaign are taking their ball and going home. Since the attack came to light on Monday, the attackers have begun shutting down their infrastructure and the hosting providers and registrars involved with some of the command-and-control domains are shutting those down, as well.

Pwn2Own Rules Change Again, Flash, Java Now Fair Game for Contestants

by Dennis Fisher

For the second year in row, the organizers of the Pwn2Own hacking contest at the CanSecWest conference have changed up the rules, this time making the browser plug-ins that have been frequent targets for attackers for years fair game for the contestants, as well. Adobe Flash, Reader and Oracle’s Java are all going to be in the crosshairs during the contest, in addition to the classic lineup of Google Chrome, Internet Explorer and Mozilla Firefox.

Costin Raiu on the Red October Cyberespionage Campaign

by Dennis Fisher
1

Dennis Fisher talks with Costin Raiu and Ryan Naraine about the newly uncovered Red October cyberespionage campaign that has targeted embassies, diplomats, research facilities and military targets for more than five years now. Raiu explains the origins of the campaign, where the attackers likely are located, the complexity and scale of the malware tools involved and what other components might be lurking undiscovered out there.

Chrome 25 to Support Unprefixed Content Security Policy

by Dennis Fisher
4

Google is continuing to introduce new security technologies in its Chrome browser, and the latest addition on the horizon is support for unprefixed Content Security Policy, a behind-the-scenes improvement designed to prevent malicious script injections. The technology is included in the beta of Chrome 25, which was released earlier this week, and will soon find its way into the stable channel.

Moxie Marlinspike Leaving Twitter Security Team

by Dennis Fisher
1

Twitter has been collecting a lot of security talent in the last year or so, but now a major piece of the company’s security team is leaving. Moxie Marlinspike, the creative security and privacy researcher who founded Whisper Systems, which was acquired by Twitter in 2011, said on Friday that he is leaving the company.

Attackers Using Fake Chrome Updates to Lure Victims

by Dennis Fisher
2

Google patched nearly two dozen security vulnerabilities in Chrome on Thursday and a day later attackers have begun circulating fake Google Chrome updates that actually are part of a scam related to the Zeus botnet and is designed to steal online banking credentials, among other things.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.