By Chris WysopalVulnerability disclosure is in the spotlight again. First it was Tavis Ormandy disclosing a vulnerability in Microsoft Windows before Microsoft had a fix available. Now a group called Goatse Security has disclosed a vulnerability in an AT&T website that affects Apple iPad 3G owners. The Wall Street Journal reports on the repercussions against vulnerability researchers in “Computer Experts Face Backlash”.
A hacker tried to frame his neighbor by tapping into his Wi-Fi and
sending threatening emails to US vice president Joe Biden, according to
search warrant affidavits unsealed recently. Read the full article. [The Register]
The developers of the open source IRC server UnrealIRCd have had to report that the file servers of the project were compromised several months ago and the IRC servers code, Unreal3.2.8.1.tar.gz was replaced by a version with a backdoor. The backdoor allows anyone to execute commands on the server running UnrealIRCd. Read the full article. [The H Security]
Software security has become one of the more widely discussed and debated topics in the security industry in the last few years, as many software vendors and enterprises both large and small have begun to to focus considerable attention on improving the processes they have in place for producing software. But far less light has been shone on the security of the software supply chain, an increasingly thorny problem in today’s environment.
By Dmitry Bestuzhev The World Cup 2010 is the most popular event running right now. The cyber criminals are already taking advantage by sending spam leading to phishing sites, to spread malware and ID theft attacks. Today we found an interesting attack apparently not related to money.
The U.S. Federal Bureau of Investigation has opened an investigation
into the leak
of an estimated 114,000 Apple iPad user e-mail addresses including those of Chief of Staff Rahm Emanuel, ABC ABC News anchor Diane Sawyer and NY Mayor Michael Bloomberg. Read the full article. [IDG News Service]
Had you gone to sleep in 2004 and woken up three days ago, you’d be forgiven for thinking you’d only slept a few hours instead of a few years. This week saw the inglorious return of not just the full disclosure debate, but also of the heated rhetoric that usually accompanies it. Had you awoken to a mix of Maroon 5 and Hoobastank on your iPod, the illusion would’ve been complete. Read on for the full week in review.
French researchers have developed an automated
social engineering tool that uses a man-in-the middle attack and strikes
up online conversations with potential victims. Read the full article. [Dark Reading]
Adobe has shipped a “critical” Flash Player update to fix a total of 32 documented vulnerabilities in the ubiquitous software product.
Webmasters running unfinished modules for Drupal do so at their own risk
after the open-source CMS updated its guidelines on fixing security
vulnerabilities. Read the full article. [The Register]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
