The micro-blogging service rejects 370 passwords when new users sign up if
it thinks they are too easy to guess. However, bloggers recently discovered
that the list of banned passwords is embedded in the source code of the page
itself. Read the full article. [Telegraph UK]
Cryptographers have moved closer to their goal of eavesdropping on
cellphone conversations after cracking the secret code used to prevent
the interception of radio signals as they travel between handsets and
mobile operators’ base stations. Read the full article. [The Register]
Version 2.1 of the Cloud Security Alliance’s “Guidance for Critical Areas of Focus in Cloud Computing” provides more concise and actionable guidance across all
domains, and encompasses knowledge gained from real world deployments
over the past six months. Read the full article. [Help Net Security]
Mark Weatherford, CISO for California, and Dan Kaminsky, finder of last year’s DNS flaw, offer five security predictions for 2010. Read the full article. [CSO]
Fraudsters have started to raid user accounts by beating strong two-factor authentication methods with Trojan-based, man-in-the-browser attacks, said Gartner Research. Read the full article. [Help Net Security]
HSBC Bank says a bug in its imaging software inadvertently exposed
sensitive data about some of its customers going through bankruptcy
proceedings. Read the full article. [Computerworld]
An attacker with access to the target computer simply boots from a USB
flash drive and replaces the BitLocker bootloader with a substitute
bootloader which mimics the BitLocker PIN query process but saves the
PINs entered by the user to disk in unencrypted form. Read the full article. [The H Security]
Microsoft released data collected from an FTP-server
honeypot, showing that attempts to guess passwords continue to focus on
the low-hanging fruit: passwords with an average length of eight
characters, with “password” and “123456” being the most common. Read the full article. [Security Focus]
The free Picviz tool from the Honeynet Project takes data from various log analysis sources and converts them into a multidimensional visual map of events. Read the full article. [Dark Reading]
Clientless SSL VPN products from multiple vendors operate in a way that breaks fundamental browser security mechanisms, according to a warning from the U.S. Computer Emergency Response Team (US-CERT).
This security problem, discussed since at least 2006, could let an attacker could use these devices to bypass authentication or conduct other web-based attacks.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
