DoD Considers Protecting Private IT Systems
The Pentagon has raised the possibility of the Defense Department
becoming engaged in safeguarding nationally critical IT systems run by
business. Read the full article. [GovInfoSecurity]
Vulnerabilities
Research: Frame-Busting Does Not Stop Clickjacking
New research from Stanford University and Carnegie Mellon
University’s Silicon Valley campus found that frame-busting, a popular
technique that basically stops a website from operating when it’s loaded
inside a “frame,” does not prevent clickjacking. Read the full article. [Dark Reading]
CERT Releases Basic Fuzzing Framework
Carnegie Mellon University’s CERT (Computer Emergency Response Team) has released a basic fuzzing framework to help identify and eliminate security vulnerabilities from software products.
Adobe, which has been under fire for the security of its flagship products, Flash and Reader, for some time now, may be on the verge of changing its patching process to push fixes out on a monthly schedule, which would coincide with Microsoft’s monthly Patch Tuesday releases.
One of the most novel approaches for acquiring new botnet clients is a weird combination consisting of direct DDoS extortion,
followed by penalties for delayed response and the offering of 30% discount in case the victim wants to
DDoS the competition once the ransom is paid. Read the full article. [ZDNet]
Five people were indicted this week on wire fraud and other criminal charges stemming from a 2007 cybertheft in which nearly $450,000 was stolen from the bank accounts of the city of Carson, California using credential-stealing spyware. Read the full article. [Computerworld]
Cisco Systems has warned of serious vulnerabilities in a device that
connects a building’s ventilation, lighting, security, and energy supply
systems so they can be controlled by IT workers remotely. The networking giant urged users of the Cisco Network
Building Mediator products to patch the vulnerabilities, which among
other things allow adversaries to obtain administrative passwords. Read the full article. [The Register]
Adobe has issued a security patch for its Adobe Photoshop CS4 software to plug “critical” vulnerabilities that expose users to code execution attacks with rigged image files.The flaws affect both Windows and Mac OS X users. Adobe Photoshop CS5 is not affected by these issues.
Media Temple, Web hosting provider for Adobe, ABC, Sony, NBC, Time,
Volkswagen, and Starbucks, was hit with a sophisticated distributed
denial-of-service (DDoS) attack. Read the full article. [CNET]
A researcher was able to gain unfettered access to
his iPhone 3GS from Ubuntu 10.04. If he connected the device whilst it
was turned off and then turned it on, Ubuntu auto-mounted the file
system and was able to access several folders despite never having
previously been connected to the iPhone. Read the full article. [The H Security]
