Almost 80% of more than 3,000 software security flaws publicly reported
so far this year have been in Web technologies such as Web servers,
applications, plugins and Web browsers.
That number is about 10% higher than the number of flaws reported in
the same period last year — and nine out of 10 of the flaws were found
in commercial code. Read the full article. [Computerworld]
Human error is to blame for the accidental exposure last week of
more than 4,500 Chaminade University student’s Social Security numbers
on the private Catholic college’s official Web site. University officials discovered the snafu Wednesday and quickly removed the obscure but accessible links from the Web site. The students’ Social Security numbers were exposed for about
eight months, according to a statement released by the Honolulu-based
university. Read the full article. [internetnews.com]
As of this morning, an anonymous group hijacked more than 200 Facebook groups and renamed them “Control Your Info”. Pasted on each group’s Wall was a message announcing that it had been “hijacked” and reminding members to be careful about controlling personal information on social networking sites. “This means we control a certain part of the information about you on
Facebook. If we wanted we could make you appear in a bad way which
could damage your image,” the message said. Read the full article. [Computerworld]
Mohamed Abdel-Mottaleb, professor and chair in the UM Department of
Electrical and Computer Engineering has developed state-of-the-art
systems capable of photographing an image of someone’s face and ear and
comparing it against pre-stored images of the same person, with 95-100
percent accuracy. Read the full article. [Science Daily]
Microsoft’s Computer Online Forensic Evidence Extractor (COFEE) has made it into the hands of pirates, and their virtual ships are distributing it. The COFEE application lets officers grab data from password-protected or encrypted sources. That means you can now break the law twice over: download the software and then use it to steal information from other people’s computers.
The new version of the GNU GRUB boot loader, 1.97.1,
closes a security hole in the previous version, 1.97, which allowed
passwords be easily circumvented. The password protection is available
in GRUB to prevent unauthorized modification of the boot parameters. Read the full article. [The H Security]
The security industry lacks a uniform way to title botnets, and the
result is sometimes a long list of names for the same botnet that are
used by different antivirus vendors and that can be confusing to
customers. As it stands now, the infamous Conficker is also known as Downup, Downadup and Kido. The Srizbi botnet is also called Cbeplay and Exchanger. Kracken is also the botnet Bobax.
The latest MySpace attack tries to lure recipients into giving up their
MySpace credentials, and then attempts to trick victims into installing
password-stealing malicious software. Attackers began blasting out the junk e-mails early Monday, according to researchers at the University of Alabama, Birmingham, Researchers at the school so far have tracked more than 30 Web site names associated with this attack, each beginning with “accounts.myspace.com” and ending in a United Kingdom country code domain (.uk). Read the full article. [Washington Post]
Microsoft will release on Tuesday
guidelines for developers building online applications and for those using the Agile code-development process. The Agile guidelines apply principles from Microsoft’s Security
Development Lifecycle (SDL) to Agile, an umbrella term for a
development model frequently used for Web-based applications released
under short deadlines, called “sprints.”ilding online applications and for those
using the Agile code-development process. Read the full article. [Computerworld]
Firefox accounted for 44 percent of all browser vulnerabilities
reported in the first half of 2009. In contrast, Apple’s Safari had 35
percent of all reported browser vulnerability, Microsoft’s Internet
Explorer was third at 15 percent and Opera had just six percent share. The 2009 figures stand in contrast to Cenzic’s Q3/Q4 2008 report, where IE accounted for 43 percent of all reported Web browser vulnerabilities and Firefox followed closely at 39 percent. Read the full article. [internetnews.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
