Authorities in Romania have disrupted a large hacking ring accused of stealing Voice over IP (VoIP) data from hacked servers and using it to place bogus calls to premium rate numbers. Agence France Presse reported on Tuesday that 42 people were arrested in the sting, breaking up a network that was headed by two Romanians and that had caused more than $13.5m in losses to firms in the U.S., Britain, South Africa, Italy and Romania.
This video is a short demo of an attack that researcher Billy Rios developed to exploit a series of bugs in browser plug-ins. By chaining the vulnerabilities together, Rios is able to steal content from a victim’s machine. The slides containing the code for the attack are available on Rios’s blog.
UPDATEOhio State University warned those who have had contact with the University that a server containing personally identifiable data was illegally accessed by a third party and may have exposed data on 760,000 people.
HP has acknowledged a security issue with storage area networking equipment after reports surfaced about a hard-coded “back door” account.
The incredible allegations that developers working under the auspices of the FBI and Justice Department planted a backdoor in the IPSec stack of the OpenBSD operating system are likely just that, experts say: not credible.
Microsoft’s vulnerability Severity Rating System is closing in on its tenth birthday. While the security landscape has been transformed during that time, the Ratings have endured. But do they still work? Threatpost asked prominent vulnerability researchers to give us their opinion. You may be surprised at what they had to say.
By Jeremiah Grossman, CTO, WhiteHat SecurityEveryone sounded the alarms at the Gawker Media attack, which included a security breach of websites such as Gizmodo, Lifehacker, Kotaku, io9, and others. The numbers were impressive: 1.3 million user accounts exposed, 405 megabytes of source code lost, and perhaps more important to some, the identity of those leaving anonymous comments potentially revealed. For Gawker, there is a loss of trust that will be difficult to regain. Users are already clamoring for the ability to delete their accounts. And, on the technical side, all Gawker’s systems will need to painstakingly audited or rebuilt entirely from scratch to prevent the same thing from happening again. Happy Holidays indeed.
Mozilla has decided to follow the lead of Google and expand its bug-bounty program to pay for vulnerabilities found on certain of its Web sites, including the site for Firefox and the main Mozilla site.
Microsoft released its monthly patch Tuesday bulletins fixing more than 40 vulnerabilities in a variety of products including Microsoft Windows, Internet Explorer and Sharepoint Server. The release, the company’s final monthly patch of 2010, brings the total number of security fixes to 106 – the highest total ever for the company.
Security Experts will tell you that one year is a lifetime in the world of online threats and attacks. But eight years after Microsoft introduced its innovative severity rating system for software vulnerability, the company says its original definitions of what makes a software hole important still apply. Security experts aren’t so sure.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
