New Version of Chrome Fixes Four Security Bugs
Google on Wednesday pushed out a new version of its Chrome browser to users, a release that fixes four security bugs, including two critical vulnerabilities.
Vulnerabilities
Three Questions for Billy Brumley on the OpenSSL Timing Attack
Timing attacks have been a problem for designers of cryptosystems–as well as for people implementing those systems–for a long time. They’ve plagued just about every popular system, and although practical attacks have been demonstrated many times, the problem and what can be done to defend against it are well understood. As a result, researchers have for the most part focused their efforts on other side-channel attacks on cryptosystems of late. However, a new paper by a pair of researchers at a Finnish university shows that timing attacks still can be used to completely compromise some cryptosystems.
Apple Plans Update to Address MacDefender Malware
Apple is planning to release an update specifically designed to protect users against the MacDefender malware that has been circulating for the last couple of weeks. The update for Mac OS X will automatically find and remove the malware on an infected machine and also will warn users if another infection attempt is detected.
Siemens AG said on Tuesday that it was talking to its customers about what it acknowledged were “security gaps” in its Programmable Logic Controllers (PLCs), after an NSS Labs researcher disclosed the discovery of what he described as serious security holes in the company’s industrial control systems.
Never ones to be left behind as progress marches on, attackers are beginning to develop more and more tools aimed specifically at exploiting 64-bit machines. The latest entry into the field is an x64 version of the ZeroAccess rootkit, a nasty piece of malware that’s been circulating for some time and has a number of interesting capabilities, including anti-forensics and kernel-level monitoring.
Researchers from ULM University have found a security flaw similar to sidejacking in Google’s Android operating system affecting some 99.7% of the platform’s users. The flaw is in the ClientLogin API, and according to the report, it could allow hackers to steal contact lists, calendar events, and other sensitive data.
Dillon Beresford, the NSS Labs researcher who disclosed serious holes in industrial control system software from Siemens says the company is downplaying the seriousness of the vulnerabilities in its public statements, and that a supposed “fix” for the vulnerabilities is inadequate.
Sony’s subsidiary Internet service provider, So-net, was broken into on Friday by an intruder who allegedly made off with some $1200 in virtual tokens, according to a NetworkWorld report.
Social networking giant Facebook will soon begin paying security researchers for information on vulnerabilities in its platform, according to a report from the Hack in the Box security conference in Amsterdam.
Security researcher Dillon Beresford decided not to present a talk at the TakedownCon in Dallas on Thursday, citing concerns about mayhem that could have resulted. But in an e-mail, he told Threatpost that the vulnerabilities could allow remote attackers to start or stop Siemens Programmable Logic Controllers (PLCs) and harvest information from the devices.
