In a startling revelation, the open-source Mozilla project says that its flagship Firefox browser contains a root certificate authority that doesn’t seem to have a known owner.
It’s quite possible that this could be a legitimate root certificate that changed hands during a merger or some other transaction but the fact that Mozilla’s folks can’t seem to figure out the owner is disconcerting on many levels.
Espionage network GhostNet, first identified about a year ago, is much larger and more sophisticated than previously assumed according to a study entitled “Shadows in the Cloud”, by the Munk Centre for International Studies, the Information Warfare Monitor, the SecDev Group and the Shadowserver Foundation. Read the full article. [The H Security]
Not surprisingly, spam using the Apple iPad as a lure to get users to
give up personal or credit card information has began to make rounds of
Twitter users. Read the full article. [Help Net Security]
By David Emm (Securelist)Today’s threat landscape is very complex. Cybercriminals use a wide
range of threats to hijack people’s computers and to make money
illegally. These threats include Trojans of many different kinds,
worms, viruses and exploit code which is designed to enable malware to
make use of vulnerabilities in the operating system or applications.
Cybercriminals also employ a range of sophisticated techniques to hide
malware activity or to make it difficult for anti-virus researchers to
find, analyse and detect malicious code.
An internal review has found that the Justice Department has not done enough to fight identity theft, the fastest-growing crime in the country. Justice Department Inspector General Glenn Fine says in a report that the department is falling short in efforts to combat identity theft, and that the issue has faded as a priority over the past two years. Read the full article. [Forbes]
A security researcher shows that it’s possible to launch an attack internally from one PDF onto another already existing PDF. More information here.
Upscale grocery conglomerate Whole Foods Market said it is
continuing to clamp down on a series of Facebook-based scams that
entice users with a purported $500 gift card from the Austin,
Texas-based supermarket chain. Read the full article. [CNet]
A new blended email threat appears to be a security alert from
eBay, said researchers. The email message with the subject line “eBay Procedural Warning
– Security Alert,” is addressed to “Dear eBay Member,” and warns
recipients that the sender has “detected security issues on behalf of
your account.” Read the full article. [Help Net Security]
Dennis Fisher talks with HD Moore, the founder of the Metasploit Project and the chief security officer at Rapid7, about the evolution of Metasploit, the difficulty of client-side exploitation in the age of DEP and ASLR and the decision on when to publish an exploit.
Mozilla is the first browser vendor to fix a vulnerability exploited at this year’s CanSecWest Pwn2Own contest.Just one week after a U.K.-based hacker known as “Nils” broke into a 64-bit Windows 7 machine with a Firefox vulnerability, the open-source group shipped Firefox 3.6.3 to plug the security hole.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
