A prominent security researcher has identified a problem with the way that Mozilla Firefox handles links that are opened in a new browser window or tab, enabling attackers to inject arbitrary code into the new window or tab while still keeping a deceptive URL in the browser’s address bar.
Security researchers have found twelve zero day flaws targeting five of the most common web malware exploitation kits such as Neon, Eleonore, Liberty, Lucky and the Yes exploitation kits. Read the full article. [ZDNet]
Apple has released version 4.0 of its iOS mobile operating system,
formerly know as the iPhone OS, closing a total of 65 vulnerabilities,
some of which could be used by an attacker to take remote control of the
device. Read the full article. [The H Security]
Norwegian vendor Opera has presented
version 10.54 of its browser to close four security holes, one of which
the company rates as extremely severe and as another highly severe. Read the full article. [The H Security]
Man-in-the-browser attacks are increasingly being used to successfully bypass authentication mechanisms used by online banking sites, according
to a security researcher. Read the full article. [eWEEK Security Watch]
Researchers are closely watching the rise of malware on Internet-enabled mobile devices. New mobile malware boasts a broad range of functionality, including the
capability to download other malicious files, detect internet
connections or establish new ones, undertake URL redirection and carry
out phishing attacks. Read the full article. [Infosecurity]
The driver download portal of hardware manufacturer Lenovo temporarily
deployed malicious code. Various virus scanners issued alerts about a
Java-based Trojan downloader or dropper. Read the full article. [The H Security]
A new report found that credit unions continue to be a favorite target of smishing attacks, and that text-to-phone scams used a toll-free number in about half of the lures sent in the first quarter of 2010. Read the full article. [KrebsonSecurity]
Microsoft launched a new Web-based
mechanism for researchers to securely report stolen credentials, bank
and credit card data, or other data they discover, and as a way to
quickly alert the appropriate banks, retailers, or government agencies
of a compromise. Read the full article. [Dark Reading]
Attention-piquing malicious spam emails purportedly coming from the DHS,
the Pentagon or the Transportation Security Administration have
recently been spotted by researchers. Read the full article. [Help Net Security]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
