The world moves fast, but much of the world of vulnerability research and exploitation has been stuck in stasis for the last few years. Much of the focus has been on memory-corruption vulnerabilities, application-level bugs and using Java and Flash to get around exploit mitigations and other protections. But that seems to be changing now, if the topics and depth of research at this week’s Black Hat conference are any evidence.
The UK’s Metropolitan Police swooped down on the remote, weather beaten Shetland Islands last week to arrrest what the authorities claim is a top ranking member of the international hacker collective Anonymous, which has been terrorizing governments and high profile corporations for most of the last six months. The arrest of Jake Davis, aka “Topiary” capped a busy month for law enforcement in the U.S. and U.K., with raids on dozens of homes and the arrest of reputed leaders of both Anonymous and the affiliated Lulz Security, including Marshall Webb, the Ohio man known online online as “m_nerva,” Ryan Cleary, the alleged botnet operator known as “Ryan,” and a fellow Brit known online as “Tflow.”
Social networking giant Facebook has finally boarded the bug bounty bandwagon. The company announced late last week they’ll award $500 for each bug to those who share information about flaws that could compromise the site’s privacy. The news confirms rumors that began to bubble at a Hack in the Box security conference back in May.
By B.K. DeLongThe ever increasing list of breaches appearing on the Open Security Foundation’s DataLossDB Web site as well as companies being targeted by the AntiSec movement made up of groups including recently-raided Anonymous, AnonOps, TeaMp0isoN, and now-dormant LulzSec continues to show that no organization is immune to successful penetration from cyberthreats.
Stuxnet may have been super sophisticated cyber weapon deployed by state actors, but future generations of the malware will be available to run of the mill script kiddies, a noted expert on security and industrial control systems has warned in a letter to the U.S. Congress ten months ago.
The U.S. Securities and Exchange Commission voted on Tuesday to impose new rules to help oversee what experts warn is a burgeoning and little understood shadow market of ultra high-speed, computer based trading. But one security expert warns that new reporting rules are only part of the problem. High frequency trading systems are also dangerously insecure, with few protections against manipulation by outside actors or rogue insiders.
Officials at the Department of Homeland Security warned lawmakers this week that
we may not have seen the last of Stuxnet, the infamous worm
that wound its way through SCADA systems
just over a year ago.
Nearly six months after first introducing two-step verification for its Gmail service, Google has expanded the security feature to users outside the English-speaking world, opening it up to people in more than 150 countries.
Former HBGary Federal CEO Aaron Barr says he will withdraw from a planned appearance at the DEFCON conference in the face of threatened legal action over his plans to take part in a panel discussion there.
What country serves up the biggest share of online attacks? The U.S., you say? It’s the world’s largest and most advanced economy. China maybe? Its growing fast, with billions of citizens and hundreds of millions of Internet users. How about Russia?
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
