Report: French Ministry of Finance Confirms Hack
The French Ministry of Finance has confirmed a report in a French Magazine on Monday that a widespread hack of computers on its networks occurred.
Vulnerabilities
Android Market XSS Bug Allowed Code Execution on Mobile Devices
A simple, trivially exploitable persistent cross-site scripting bug on the Google Android Web Market allowed anyone to upload an app that could be used to later run arbitrary code on the user’s Android device. The vulnerability, which Google has patched, enabled an attacker to silently install his malicious app and then get any and all permissions on the device.
Apple Fixes Nearly 60 Bugs With iTunes 10.2 Release
Apple has released a new version of its ubiquitous iTunes software that includes fixes for nearly 60 vulnerabilities, including several bugs that could be used to run remote code on vulnerable machines.
A detailed analysis of the DroidDream Trojan that was found in dozens of apps in the Android Market this week shows that the malware has a modular construction that likely was designed to give attackers the ability to monetize infected devices through installations of adware or spyware.
By Ted Julian, Yankee Group Security researchers today pulled more than 20 apps in the Official Android Market after they were found to have been infected with the DroidDream malware. Analysis of the DroidDream malware suggests that it can gather sensitive data like a mobile device’s IMEI (International Mobile Equipment Identity) number and user ID, break out of Android’s application security sandbox and download additional code. Sounds pretty scary, huh? Sure, but to grizzled security pros, it’s a story that’s also sadly familiar – and a sign of what’s to come in the mobile devices market.
While most consumers worry about their credit card or debit card numbers or other valuable data being stolen from their home computers or leaked via a data breach at their banks, a new report shows that the vast majority of attacks that harvest this sensitive data actually target weak software on point-of-sale devices at retail locations.
Google has released version 9.0.597.107 of its Chrome browser, fixing 19 security vulnerabilities and paying $14,000 in rewards to researchers in the process.
China, once one of the worlds’s leading spam-producers, is at long last beginning to curb its spam output. Cisco Systems’ IronPort group ranks the nation 18th on its list of spam-producing countries, according to this piece from the IDG News Service.
There is a severe vulnerability in the widely deployed BIND DNS software that can allow an attacker to force a remote server to freeze and stop processing requests. The bug is in several recent versions of the BIND software.
Today’s image of the day comes from Brian Krebs’s blog, KrebsonSecurity. The image illustrates how Glavmed and other alleged players in the global spam game operate, and is part of a larger exposition of the Spamit operation that was reportedly shut down sometime last year as detailed by Krebs on his blog.
