US-CERT Warns of Adobe Shockwave Xtras Vulnerabilities
UPDATE — US-CERT issued advisories against a trio of Adobe Shockwave vulnerabilities that could allow an attacker to remotely execute code on systems running the vulnerable media player.
Michael Mimoso
Privacy Protests Cause Instagram to Rethink Changes
Instagram cofounder Kevin Systrom responded to a firestorm of protests from users of the photo-sharing social network’s proposed terms of service changes that could impact the privacy of its users.
Instagram Privacy Changes Start Clock Ticking for Users Who Want to Opt-Out
Instagram users have some soul searching to do between now and Jan. 16 when new terms of service kick in that give the photo-sharing social network the right to sell personal photos without the user’s permission or compensating them.
Ang Cui’s “Funtenna” is just the latest eye-opener into the security of embedded networked devices such as printers, VoIP phones, routers and other core, connected infrastructure.
Network-enabled devices such as routers and printers are notoriously insecure and fully exploitable gateways leading attackers toward network resources. A researcher and PhD student at Columbia University recently added VoIP phones to the list of pressing concerns.
Computer systems in Iran are being targeted by a new strain of malware that is capable of wiping disk partitions clean of files. Security researchers are calling the attacks simplistic, yet effective.Researchers at Kaspersky Lab said the malware launches only on pre-determined dates and will delete all files on drives D through I. It also deletes user profiles and will wipe all files on the computer’s desktop.
Finding keen new ways to avoid detection by security systems, malware scanners in particular, seems to be a primary objective for malware writers.Researchers at FireEye have found one of the most ingenious, a Trojan called Upclicker that eludes automated sandbox detection by hooking into a mouse click.
You can say one thing for the underground malware distribution market, there’s certainly never a lack of drama. Weeks after the banning of Aquabox, the keeper of the Citadel banking Trojan, from an underground forum, another player has popped up to fill the market gap, this time with a new version of the Carberp Trojan.
UPDATE — The group that claimed responsibility for large-scale distributed denial-of-service attacks against major U.S. banks in September and October has carried out another flurry of attacks that are still ongoing today.
PayPal patched a zero-day vulnerability this week in its core content management system. Researchers at Vulnerability Laboratory in Germany reported the flaw in June and withheld disclosure of the details until this week when PayPal released a fix.Benjamin Kunz Mejri, a frequent PayPal bug hunter, said his team discovered a persistent input validation vulnerability in the address book module’s search function that would allow an attacker to remotely inject malicious script on the application side.
