Google security engineers announced that Chrome would refuse to run
plug-ins if they were found to be out of date, and thus, potentially
vulnerable to exploitation of known bugs. Read the full article. [Computerworld]
Dennis Fisher talks with Eddie Schwartz, CSO of NetWitness, about a new study the company did on the level of awareness of advanced threats in the enterprise and what organizations are doing to respond to the latest targeted attacks.
Adobe today shipped a critical Reader/Acrobat patch to cover a total of 17 documented vulnerabilities that expose Windows, Mac and UNIX users to malicious hacker attacks.The update, which affects Adobe Reader/Acrobat 9.3.2 (and earlier versions), includes a fix for the outstanding PDF “/Launch” functionality social engineering attack vector that was disclosed by researcher Didier Stevens.
Since April, a son-of-Kraken botnet has infected an estimated 318,058
machines – about half as big as the original Kraken was at its height
in the middle of 2008, according to Paul Royal, a research scientist at
the Georgia Tech Information Security Center. Read the full article. [The Register]
Updates 1.2.44 and 1.4.3 for the official open source reference library libpng have been released to close security holes. Read the full article. [The H Security]
A California escrow firm has been forced to take out a pricey loan to
pay back $465,000 that was stolen when hackers hijacked the company’s
online bank account earlier this year. Read the full article. [KrebsonSecurity]
In the third part of his talk on politically motivated DDoS attacks at the recent Kaspersky Lab Security Analyst Summit, Jose Nazario of Arbor Networks discusses the tactics and motivations for these attacks.
Most of the angst and controversy surrounding Google’s decision to remotely erase a benign application from a couple of hundred Android phones recently has centered just on the fact that Google has that ability–as well as the ability to remotely install apps. But, as one security expert says, that may be a minor piece of the puzzle.
The White House has published a draft of a strategy designed to make the concept of trusted identities and authentication more of a reality in the digital world. Read the full article. [eWEEK]
The scareware and rogue AV problem that initially appeared a few years ago and has since found its way onto thousands and thousands of legitimate Web sites, including The New York Times home page, has now reached epidemic levels. The scams are mostly boilerplate and well-understood, but it’s not often that we get to take a peek behind the curtain and see the inner workings of the schemes. Here’s just such a chance.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
