Hundreds of Top Sites Open to Domain Hijacking
Less than 10% of the top 300 most highly trafficked sites are protected using a registry lock service. Why is that? MarkMonitor attempts to answer that in a Q&A. Read the full article. [ZDNet]
Malware
Google Plugs High-Risk Holes in Chrome Browser
Google has released version 4.1.249.1059 of Chrome for Windows, a security update that addresses four high risk vulnerabilities in its WebKit-based browser. These vulnerabilities are; a memory corruption issue in Chrome’s V8 JavaScript Engine, type confusion errors with forums, cross-site scripting (XSS) vulnerabilities on the Chrome downloads page and HTTP request errors that could lead to possible cross-site request forgeries (XSRF). Read the full article. [The H Security]
Net Solutions’ Hack Heightens Role of ISP in App Layer Security
According to research, the malicious iframe used in the latest Network Solutions attack pointed to corpadsinc.com which then downloads Adobe exploits onto victims’ machines. The hacks raise an issue increasingly being faced by Website owners: what’s the responsibility of the ISP or service or cloud provider to provide more application-layer security?
Google is investigating a growing number of reports that hackers are breaking into legitimate Gmail accounts and then using them to send spam messages. The problem started about a week ago but seems to have escalated over the past few days. Read the full article. [IDG News Service]
Researchers at the Univeristy of Texas at Dallas have developed a method for analyzing the activity log
files of corporate firewalls. Their analysis can determine what rules the firewall is actually applying
to incoming and outgoing network traffic and then compare these with
the original rules to spot errors and omissions. Read the full article. [Science Daily]
The SANS Institute has released critical security controls for cyber defense agreed to by a consortium of agencies including: “NSA, US Cert, DoD, DoD JTF-GNO, the Department of Energy Nuclear Laboratories, Department
of State, DoD Cyber Crime Center plus the top commercial forensics
experts and pen testers that serve the banking and critical
infrastructure communities,” according to the SANS website. Read the SANS Institute consensus audit guidelines.
Mozilla is disabling older versions of the Java Deployment Toolkit plugin for Firefox users, in a bid to block attacks against a newly-discovered Java security hole that attackers have been exploiting of late to install malicious code. Read the full article. [KrebsonSecurity]
Targeted attacks might be tough to prevent, but
what if you could fight back against the attacker once he’s infiltrated
your network? A researcher has come up with a proof-of-concept (PoC)
that does just that by finding vulnerabilities in the attacker’s malware
and using it against him. Read the full article. [Dark Reading]
Amazon.com administrators closed a security vulnerability
that made it possible for attackers to steal user login credentials for
the highly trafficked e-commerce website. Read the full article. [The Register]
Two Belarusian nationals suspected of operating a rent-a-fraudster
service for bank and identity thieves have been arrested overseas,
according to New York authorities, who unsealed an indictment for one of
the suspects. Read the full article. [Wired]
