Just when you thought it was safe to go back in your e-mail…Researchers say a new round of targeted attacks appear to come from the same group responsible for attacks against Google and other top U.S. firms.
Banks and their customers are on opposite ends of a feud over which is responsible when online banking accounts get hacked and pillaged. But where does the fault really lie?
A pair of security researchers have implemented an attack that exploits the way that ASP.NET Web applications handle encrypted session cookies, a weakness that could enable an attacker to hijack users’ online banking sessions and cause other severe problems in vulnerable applications. Experts say that the bug, which will be discussed in detail at the Ekoparty conference in Argentina this week, affects millions of Web applications.
A scan of IT systems at US-CERT, the Homeland Security Department’s
primary operational cybersecurity agency, found hundreds of
vulnerabilities that could allow someone to compromise data, according
to a recent inspector general’s report. Read the full article. [Government Computer News]
The National Science Foundation (NSF) has doled out grants worth up to
$32 million in total to a pack of universities dedicated to rethinking
everything about the Internet from from its core routing system to its
security architecture and addressing the emergence of cloud computing
and an increasingly mobile society. Read the full article. [Computerworld]
There are a number of other file types that can be used in the same kind of attacks that have been used in the DLL-hijacking exploit in recent weeks. Experts say that executable files, Windows INI files and some other file types can be used in these same attacks.
Code that allows Apple customers to circumvent that company’s exclusive content protection features was released on Wednesday, with security researchers warning that the hack could be impossible for Apple to fix on devices that have already been manufactured.
Microsoft’s September batch of security patches will include fixes for 13 documented vulnerabilities affecting Windows, Internet Information Services (IIS), and Microsoft Office.
Attackers are using a previously unknown exploitation technique that bypasses both ASLR and DEP to exploit the unpatched Adobe Reader bug that Adobe warned users about on Wednesday. The exploit works on machines running either Windows Vista or Windows 7 and is also dropping a file on compromised machines that is signed using a stolen, valid digital certificate.
A federal magistrate judge has recommended that Microsoft be given
ownership of 276 internet addresses used to control “Waledac,” a massive
botnet that the software company has been working to bring down. Read the full article. [The Register]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
