On the heels of a Black Hat EU presentation that exposed security problems with the cross-site scripting (XSS) filter in Internet Explorer 8, Microsoft plans to ship an update to the filter to fix what is hopefully the last remaining attack scenario.
A week after Web hosting company Network Solutions dealt with a
large-scale infection of WordPress-driven blogs, the company
acknowledged that other sites it hosts have been compromised. Read the full article. [Computerworld]
Forbes reporter Andy Greenberg polled a group of security researchers about the security posture of Apple’s new iPad device and comes away with a simple conclusion: The iPad is just as insecure as the iPhone. Some quotes from the story:
Miscreants have created a Trojan that poses as a Google Chrome
extension. Spammed messages attempt to dupe prospective marks into trying an
add-on that “helps you better organise your documents received in your
email”. Read the full article. [The Register]
The non-profit Open Web Application Security Project (OWASP) has released its latest list of top 10 web application security risks. Read the release statment. [OWASP.org]
A new study from Prof. Avishai Wool of Tel Aviv University’s School of Electrical
Engineering finds serious security drawbacks in chips that are being embedded in credit, debit and “smart” cards. The
vulnerabilities of this electronic approach — and the vulnerability of
the private information contained in the chips — are becoming more
acute. Read the full article. [ScienceDaily]
The Cisco Secure Desktop contains a vulnerable ActiveX control that could allow an attacker to execute arbitrary code with the privileges of the user who is currently logged into the affected system, according to a warning from the networking vendor.
The good news is that Microsoft’s Internet
Explorer 8 browser offers a new set of filters designed to prevent some
cross-site scripting (XSS) attacks. The bad news is that those same
filters could be used to enable XSS attacks. That was the gist of a presentation offered by security
researchers David Lindsay and Eduardo Vela Nava at the Black Hat Europe
conference in Barcelona. Read the full article. [Dark Reading]
The Java Web Start vulnerability that has been getting so much attention of late is being attacked by a number of different sites now, with a relatively simple and easily reproducible exploit, researchers say.
The Zeus botnet is now using an unpatched flaw in Adobe’s PDF document
format to infect users with malicious code, said security researchers. Read the full article. [Computerworld]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
