Dennis Fisher

It’s Patch Tuesday, and not just for Microsoft and Adobe. Google also patched a number of security vulnerabilities in its Chrome browser today, including one critical flaw and three high-severity ones.

When the history of cyberwar is written, 2012 may well be marked down as the year that it all began in earnest. Governments have been attacking one another electronically for decades now, but the last 12 months have seen both the concept and reality of cyberwar elbow their way into the consciousness of the general public through attacks such as Flame, Gauss and Shamoon, and also have seen government officials openly discussing offensive operations and calling out other nations for their extensive attacks on U.S. networks. Now, those same U.S. officials are in the process of developing doctrines for cyberwar operations as way of defining how and when military and government teams can act. 

Malicious apps have emerged as perhaps the most serious threat to mobile devices at the moment, and the major players, such as Apple and Google, have tried several different methods of preventing them from getting into their app stores and into the hands of users. Now, Google is taking one more step with the launch of a new service called the Private Channel for Google Apps, which gives enterprises and other organizations the ability to create private app stores and control the apps their users can download.

The FTC has reached a settlement with Epic Marketplace, a large online ad network, related to what the FTC says is the company’s practice of sniffing users’ browser history for the purpose of serving them targeted ads related to a variety of sensitive topics. The settlement bars Epic from performing history sniffing and requires the company to destroy all of the data it’s collected from consumers up to this point through history sniffing.

A new version of the BIND DNS server software is available, fixing six security vulnerabilities and a long list of other bugs. BIND 9.9.2-P1 is mainly a security update and most of the issues it fixes are crashes and not remote code execution flaws.

Twitter officials say that a researcher’s claims that the service is open to an SMS-spoofing vulnerability are not completely accurate, and that Twitter users in the United States are not vulnerable to the attack. Moxie Marlinspike of Twitter’s security team said that the company in August had stopped allowing users to post messages using SMS longcodes in countries, such as the U.S., where posting via a shortcode is available.

There is a bug in the way that Twitter handles a feature that enables users to post messages via SMS and the researcher who discovered the bug says that it allows anyone who knows a user’s mobile number to not only tweet from the user’s account but also modify information in the user’s profile.