Busting Frame Busting
In this video from the OWASP AppSec Research conference, Gustav Rydstedt from Stanford University, discusses frame-busting and clickjacking vulnerabilities on popular Web sites.
Vulnerabilities
Why Vulnerability Research Matters
It seems that any time there’s a high-profile incident in which a vulnerability is disclosed without a patch being available, there is an immediate and loud call from some corners to abolish the practice of vulnerability research. If researchers weren’t spending their days poking holes in software, the bad guys wouldn’t have so many flaws to exploit and we’d all be safer, this argument goes. But the plain fact is that all of us–users and vendors alike–are far better off because of the work researchers do.
On the Network Solutions Hack and Smartphone Attacks
In the long-awaited return of the News Wrap podcast, Threatpost’s newest editor, Paul Roberts, makes his debut as he and Dennis Fisher discuss the Network Solutions parked domains hack, the troubling attacks emerging on smartphone platforms and the odd story of a Trojan-infected PC being linked to a 2008 airplane crash.
Virus authors have developed a strain of malware that attempts to con users into uninstalling legitimate security packages. Read the full article. [The Register]
There’s old, and there’s old. Internet Explorer 6 clearly falls into the latter category, but despite its advancing age, IE6 still holds a lot of sway in the enterprise, as new data that came to light this week. That’s not the only weirdness that reared its head this week, though. There was the Firefox bug that wasn’t, the revelation of hundreds of thousands of infected parked domains and a mysterious bug that affects as many as 40 Windows apps. The dog days of summer are upon us. Read on for the full week in review.
Google said on Thursday that it patched ten security holes in its Chrome Web browser. The company also paid out more than $10,000 in bounties to security researchers who reported the holes.
Adobe has released security updates to fix critical flaws in its Reader and Acrobat applications for both Windows and Macintosh. The updates are emergency fixes for a vulnerability disclosed last month at Black Hat.
Metasploit’s HD Moore was in the midst of researching the recently patched LNK (Windows shortcut) vulnerability when he stumbled upon a serious problem that exposes more than 40 different Windows software programs to remote code execution attacks.
Since at least the time of the iPhone’s introduction in 2007, mobile phones have been moving toward their inevitable evolutionary destiny of becoming full-on handheld computers, complete with complex operating systems, the ability to run multiple applications and store large amounts of data. And for just as long, researchers have said that the attackers would begin focusing on mobile platforms as soon as they could figure out a way to make money on it. That time appears to be now.
A conceptual problem in the memory management area of Linux allows local attackers to execute code at root level which is caused by potential overlaps between the memory areas of the stack and shared memory segments, according to a report by Rafal Wojtczuk. Read the full article. [The H Security]
