It’s getting to be that time of year again, when everyone starts looking for ways to do something with all of the data that they’ve accumulated during the last 12 months. That means reports and top tens and lists and rankings and controversy. And, inevitably, it also means more examples of why using bug counts as a measure of an application’s security isn’t of much use.
The news this week revolved around complex and troublesome threats, notably two rootkits, TDL4 and ZeroAccess. Stuxnet reared its head once again as did a new problem with Cisco’s popular videoconferencing software. Read on for the full week in review.
Apple on Thursday issued updates for its Safari Web browser to fix more than two dozen vulnerabilities that left the browser open to Web-based attacks.
Adobe has released the much anticipated new version of its Reader software, Adobe Reader X, which includes the new sandboxing feature meant to prevent exploits against the software from affecting other applications on a PC.
Security researcher Jon Oberheide wrote a fake extension to the popular Angry Birds mobile game and put it in the Android Market as a demonstration of how an attacker could exploit a vulnerability he’d found in Android. The phony app didn’t do anything malicious, but it had permissions on Android handsets that enabled it to send toll SMS messages, steal contacts and take other actions, without the user’s knowledge.
The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access to compromised machines.
There is a series of vulnerabilities in Cisco’s Unified Videoconferencing product, including a hardcoded password for several powerful accounts that can’t be changed or deleted. That bug and others disclosed Wednesday can be used to gain complete control of the device and possibly compromise other parts of the internal network.
For some time now, the browser has been the most dangerous piece of software on the Web, and to hear researchers tell it, the climate it likely to get far worse before it gets any better.
Web based attacks and botnets kept enterprises on the defensive in the third quarter, 2010, according to data released by Cisco Systems.
A bug in an account verification system used by Facebook resulted in a wave of account suspensions Tuesday that had users locked out of the world’s largest social network and scratching their heads over the reason.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
