Apple Fixes AutoFill Flaw in Massive Safari Update
LAS VEGAS–Apple has released a major update to its Safari browser that includes a number of security fixes, most importantly a patch for the AutoFill vulnerability disclosed recently.
Malware
Three Mariposa Botnet Suspects Arrested
Slovenian police will hold a press conference on Friday to discuss the
arrest of three men in connection the massive Mariposa botnet that was
disabled late last year. Read the full article. [IDG News Service]
Zeus Botnet Using Windows LNK Flaw
Isolated strains of mainstream malware that took advantage of how the
zero-day Windows flaw first exploited by the sophisticated Stuxnet worm
began appearing late last week. The same approach has since been applied
by the dodgy sorts behind Zeus, a family of sophisticated toolkits
frequently used to steal bank login credentials and the like from
compromised systems. Read the full article. [The Register]
Google has released version 5.0.375.125 of Chrome, a security update that
addresses three “high” risk vulnerabilities in its WebKit-based browser.
According to the developers, two of the high risk issues could lead to
memory corruption while SVG handling or rendering code. Read the full article. [The H Security]
Organizations are getting hit by at least one
successful attack per week, and the annualized cost to their bottom
lines from the attacks ranged from $1 million to $53 million per year,
according to a newly published benchmark study of 45 U.S. organizations
hit by data breaches. Read the full article. [Dark Reading]
Citigroup has urged customers conducting mobile banking from their
iPhones to immediately upgrade because a security flaw in the older app
secreted account information on the smartphone. Read the full article. [Computerworld]
For the second time in two months, Mozilla has rushed out a fix
for Firefox to patch a problem with a browser update issued just days
before. Read the full article. [Computerworld]
Researchers who will present at Black Hat have discovered a hole in the WPA2 Wi-Fi security protocol. The security hole was named as Hole 196 after the number of the relevant page in the IEEE 802.11 (2007) standard document. Read the full article. [The H Security]
This week brought us the rare double rainbow of a re-emergence of the disclosure discussion and major security news from Microsoft, all wrapped into one. It truly was a gift from Mother Nature. But Microsoft’s decision to change its disclosure stance–and refusal to pay bug bounties–wasn’t the only big news. The Stuxnet saga continued to widen and weirden, a major privacy leak cropped up in Safari and the roots of the mass SQL injection attacks were exposed. What does it all mean? Read on for the full week in review.
Researchers have found two distinct new malware families that are exploiting the newly discovered Windows shell LNK vulnerability, leading to concerns that the development of a worm could be in the offing.
