A new study due for public release Thursday shows vulnerabilities reported in commercial software applications fell significantly last year, but almost a quarter of those found were considered at high risk for exploitation.
Oracle yesterday released 88 security fixes for vulnerabilities — including several that allow for remote access without authentication — across its portfolio as part of its quarterly Critical Patch Update.”Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible,” the company said in its CPU advisory.
The head of Google’s Web spam team says that the company has pushed warning messages to some 20,000 Web site owners that their sites may be compromised and are performing “weird” redirections, possibly to malicious Web sites.
The U.S. and other advanced nations face a drastic cyber security skills gap. Attacks from sophisticated and unsophisticated attackers are on the rise, even as more and more companies and government agencies move more of what they do online to Web based services and the cloud. Of course, the skills gap requires a bottom-up rethink of the way that technology skills are taught at both the primary and secondary level. That’s no easy task in a decentralized and highly regulated education system such as the one that exists in the U.S. where resources are addressed more towards basic skill acquisition than to teaching advanced cyber skills. Still, the Obama Administration has put cyber security at the top of its domestic and military security agendas, and there’s some evidence of positive change.
Researchers at Kaspersky Lab says a new malicious program, dubbed SabPub, exploits the same Java security hole as the Flashback Trojan and enables targeted attacks against Mac users.
Apple has released another fix for Java that also is designed to remove several of the variants of the Flashback Trojan that have been plaguing Mac users for months now. The update, released on Thursday, is the latest in a series of attempts by the company to address the Flashback situation.
Industrial control system vendor Koyo moved to fix vulnerabilities in its ECOM brand programmable logic controllers (PLCs) after researchers, in January, revealed that the devices were vulnerable to brute force password guessing attacks.
Researchers have known for a long time that many users don’t pay much attention to updating the third-party software, browser plugins and extensions, and that lack of care has been to the benefit of attackers for years. Attacks on Flash, Java, QuickTime and various other ubiquitous apps have been a major concern for Windows users for the better part of a decade, and now that same situation is presenting itself to Mac users.
UPDATE: A critical security flaw has been identified in a component of the latest version of Backtrack, a popular version of Linux that is used by security professionals for penetration testing. The flaw is in WICD, an open source utility that can be used to manage networks in Linux operating systems.
We wrote yesterday about research by Paul Brodeur of Leviathan Security Group on security weaknesses that are built into Google’s Android mobile operating system. Brodeur was able to show, using a proof of concept application, that Android applications without any permissions can still access files used by other applications, including which applications are installed and a list of any readable files used by those applications. In this question and answer session, Brodeur corresponds with Threatpost about his ongoing work studying the Android operating system, and how a combination of loose application coding and insecure design makes Google’s Android a boon for advertisers and others who want to harvest data on mobile users.*
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
