DEFCON Kids Returns, Now With 0-Day
DEFCON is inviting the kids back again this year for the second edition of DEFCON Kids, and this time, there’s zero-days involved.
Vulnerabilities
Skype Privacy Bug Sends IMs to Random Recipients
Skype users who are chatting online when their client crashes may later find the last instant message they sent to someone actually ended up with someone else. The privacy bug surfaced after users began reporting strange activity in a community forum.
Android 4.1 Jelly Bean Includes Full ASLR Implementation
Apple’s iOS and Google’s Android have been on opposite ends of the security continuum for the last few years, with iOS remaining resistant to malware and Android becoming a frequent target for attackers and malware authors. Google has been taking steps to change that in recent releases, and the latest version of its mobile operating system, Android 4.1 Jelly Bean, includes several new exploit mitigations and a more extensive implementation of ASLR to help defeat many kinds of exploits.
Vulnerability Lab researchers discovered remotely exploitable cross site scripting vulnerabilities in Blackboard Mobile Learn v9.
A new fork of the Black Hole exploit kit is making quick work of a recently patched Java vulnerability and security researchers say that the attackers are registering new sites quickly to exploit users with vulnerable browsers.
Google says it has taken extra steps to counter the threat posed by malicious extensions to its Chrome Web browser, after incidents in which malicious extensions were used to power online scams.
A security researcher has found several serious vulnerabilities in a widely deployed point-of-sale system that enables an attacker to change transactions, steal card data and take other malicious actions. The attacks could be executed remotely under certain circumstances or done through a local interface.
Instagram has patched a flaw in its photo sharing application that could have allowed anyone to add themselves as friends to accounts and view information and photos that were set to private.
An online forum for Android fans and developers was compromised and user account details stolen, according to a notice posted online on Tuesday.
If it’s a day ending in Y, then there must be another password leak. And today it’s Yahoo’s turn in the spotlight, as the company is investigating claims that more than 400,000 plaintext passwords were stolen from the company and posted online. Security researchers who have looked at the data say that it appears that the passwords came from the company’s VoIP service.
