Ryan Naraine

From TidBITS (Rich Mogull)

The original iPhone was widely criticized by security professionals for lacking essential security features for the enterprise, the large corporate networks that have special needs because of huge numbers of users and the massive back-end operations to support those users.
The original iPhone was hard to lock down, had only limited secure connectivity options, and lacked both data protection and some way to destroy data remotely if you lost the phone. Those capabilities have continued to improve with every iPhone software release and, combined with the hardware improvements in the iPhone 3GS, even regular users can now enjoy security equivalent to that provided by most corporate environments. Read the full story [tidbits.com]

From Computerworld (Gregg Keizer)
Adobe delivers an out-of-date version of Reader to users who download the popular application from its Web site, a security company warned today.
The edition Adobe currently offers includes at least 14 security vulnerabilities that have been patched by the company in the last two months.  Read the full story [computerworld.com]  See original warning [secunia.com]

Just 48 hours after the release of exploit code targeting a zero-day vulnerability in Firefox 3.5, Mozilla’s security response team has rushed out a patch to protect users from code execution attacks.
With Firefox 3.5.1, rated a “critical” update, the open-source group corrects a browser crash that could result in an exploitable memory corruption problem.

From CNet News (Josh Lowensohn)
Microsoft is bringing out the big guns to combat instant message spam and phishing attacks done to users of its Live Messenger network. The Redmond, Wash.-based software giant filed a civil lawsuit Thursday in King County Superior Court in Seattle against Funmobile, Mobilefunster, and several individuals, who Microsoft says is responsible for the intentional misuse of the service to gain the personal information of its users.
In the suit (which is embedded below), Microsoft cites a multitude of attacks including IMs that appear to be coming from users they know, as well as phishing attacks that mimic the look and feel of an outside service, or an official Microsoft support page. Read the full story [cnet.com]  Also see Microsoft’s explanation [microsoft.com]

Earlier this week, I wrote about a “highly critical” — and unpatched — vulnerability that puts millions of Web surfers at risk of malicious hacker attacks. 
Since then, there has been word that the release of the vulnerability and exploit was “self-inflicted” (Mozilla exposed the bug themselves) and official instructions on how to mitigate the risks until a patch is ready. 

From Computerworld (Jaikumar Vijayan)

Computerworld – Compared to other key corporate executives, CEOs appear to underestimate the IT security risks faced by their own organizations, according to a survey of C-level executives released today by the Ponemon Institute.

The Ponemon survey of 213 CEOs, CIOs, COOs and other senior executives reveals what appears to be a perception gap concerning information security issues between CEOs and other senior managers. For instance, 48% of CEOs surveyed said they believe hackers rarely try to access corporate data. On the other hand, some 53% of other C-level executives believe that their company’s data is under attack on a daily or even hourly basis. Download the survey (PDF).  Read the full story [computerworld.com]

Microsoft today released six bulletins with fixes for at least nine documented security vulnerabilities in a range of products that put users at risk of malicious hacker attacks.

At least two of the vulnerabilities are currently being attacked in the wild so it’s imperative that Windows users and administrators treat these patches with the highest possible priority.