New Adobe PDF Zero-Day Flaw Under Attack
Adobe today sounded an alarm for a new zero-day flaw in its PDF Reader/Acrobat software, warning that hackers are actively exploiting the vulnerability in-the-wild.
Vulnerabilities
Mozilla Patches Firefox DLL Load Hijacking Bug
Mozilla has joined Apple in being among the first to fix the DLL load hijacking attack vector that continues to haunt hundreds of Windows applications.
Apple Plugs Safari Drive-by Download Security Holes
Apple has shipped Safari 5.0.2 and Safari 4.1.2 with patches for three gaping holes that expose Web surfers to drive-by download attacks.
Microsoft is warning of a new type of scareware,
dubbed Rogue:MSIL/Zeven, which identifies a user’s browser–whether it’s
Google Chrome, Internet Explorer or Firefox–and serves up a nearly
perfect-looking version of the browser’s malware warning page. Read the full article. [Information Week]
By Robert HansenI’ve talked about this a few times over the years during various
presentations but I wanted to document it here as well. It’s a concept
that I’ve been wrestling with for 7+ years and I don’t think I’ve made
any headway in convincing anyone, beyond a few head nods. Bad security
isn’t just bad because it allows you to be exploited. It’s also a long
term cost center. But more interestingly, even the most worthless
security tools can be proven to “work” if you look at the numbers.
Here’s how.
WASHINGTON, D.C.–The United States has a responsibility to take a leadership role in securing the Internet against both internal and external attackers, a duty that the federal government takes very seriously, the country’s top military cybersecurity official said Tuesday. However, Gen. Keith Alexander, director of the National Security Agency and commander of the U.S. Cyber Command, provided virtually nothing in the way of details of how the government intends to accomplish this rather daunting task.
TechCrunch Europe has cleaned up its website following the discovery of
malicious code that left visiting surfers exposed to infection by a
variant of the infamous Zeus banking Trojan. Read the full article. [The Register]
Every week, hackers are creating 57,000 new Web addresses which they
position and index on leading search engines in the hope that unwary
users will click them by mistake. Read the full article. [Help Net Security]
A dangerous XSS bug surfaced on Twitter on Monday, and researchers have seen active exploits for the bug, which allows an attacker to steal the session cookie of a Twitter user with a simple click-and-you’re-owned technique.
There’s an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user’s authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way that IE 8 handles CSS style sheets.
