Amnesty International Website Compromised, Serving Up Gh0st RAT
Amnesty International’s United Kingdom website was compromised and hosting the potent Gh0st RAT Trojan earlier this week, according to research conducted by security firm Websense.
Vulnerabilities
Dutch Government Asks for €8.7 to Reimburse Diginotar Debacle
The Dutch government has asked DigiNotar, the Dutch certificate authority that was broken into last summer, for €8.7 million ($11M USD) to recoup money it spent buying new certificates, according to several Dutch news reports. The Dutch interior ministry asked for €1 million in January, yet the number “has now risen to €8.7 million,” according to the company’s curator Rocco Mulder in an interview with Dutch news site nu.nl.
U.S. Cyber Command Using Classified Intel To Scare CEOs To Action
The U.S.’s Cyber Command is using special, classified briefings with private sector CEOs to scare them into greater vigilance about the threat of cyber attacks, according to an NPR report.
For the second time in less than a week, the developers of PHP have released new versions of the language that include a fix for the remotely exploitable vulnerability that was disclosed last week. The group is encouraging users to upgrade to PHP 5.4.3 or 5.3.13 immediately.
Adobe has released patches for a series of vulnerabilities in its product line, including Photoshop, Illustrator, Flash Professional and Shockwave. Several of the vulnerabilities can be used to take complete control of affected machines.
In an attempt to clear the cybersecurity air, the United States and the People’s Republic of China agreed Monday to work in tandem to prevent future cyber threats. Meeting at the Pentagon, Defense Secretary Leon Panetta and General Liang Guanglie, China’s Minister of National Defense, insisted the two nations should be seen as equals and according to Guanglie, “build a new state-to-state relationship that’s not a stereotype of two major powers predestined for conflict.”
The PHP Group on Tuesday is planning to release another new version of the scripting language that’s designed to address, again, the remotely exploitable flaw that came to light last week. That bug, which requires no authentication, was supposed to have been fixed in new releases pushed out on May 3, but they didn’t completely address the problem.
Dennis Fisher, editor-in-chief, and his guests, Josh Shaul and Jack Daniel, candidly discuss end-user security, where breaches occur and how organizations can fix these problems without causing havoc to their enterprise networks.
Adobe has released a patch for a serious Flash vulnerability that is being used in targeted attacks right now. The updates fix the vulnerability in Windows, Mac, Linux and Android systems.
UPDATE–The developers of PHP have released new versions of the scripting language to fix a remotely exploitable vulnerability announced earlier this week that enables an attacker to pass command-line arguments to the PHP binary. The flaw has been in the code for more than eight years and The PHP Group was working on a patch for it when the bug was disclosed accidentally on Reddit. However, the team that found the bug says the new versions of PHP don’t actually fix the vulnerability.
