VANCOUVER, BC — The first day of the CanSecWest Pwn2Own hacker
challenge wrapped up here today with a familiar face going after a
familiar target.
And, for the second year in a row, a German hacker known simply as
“Nils” exploited a previously unknown vulnerability in Mozilla Firefox
to take complete control of a 64-bit Windows 7 machine.
VANCOUVER, BC — For the third year in a row, Charlie Miller has
hacked into a MacBook by exploiting a critical Safari browser
vulnerability. At the CanSecWest Pwn2Own hacker contest here, Miller performed a clean drive-by download against Safari to get a full command shell on the MacBook.
VANCOUVER, BC — A pair of European researchers used the spotlight of the CanSecWest Pwn2Own hacking contest here to break into a fully patched iPhone and hijack the entire SMS database, including text messages that had already been deleted.
Google has added a nifty new security feature to warn GMail users when there are suspicious log-ins to their e-mail accounts.The feature, now being rolled into Firefox and Internet Explorer, will flag GMail log-ins from multiple locations and flash the following warning to an affected user:
A computer security professional who sold Internet Explorer exploit
code to credit card hacker Albert Gonzalez was sentenced Tuesday to three years probation and a $10,000 fine. Jeremy Jethro, 29, was paid $60,000 by Gonzalez for a zero-day
exploit against Microsoft’s browser, “the purpose and function of which
was to … enable the conspirators to unlawfully gain access to, and
redirect, individual’s computers,” according to court records. Read the full article, [Wired]
Malware that exploits holes in popular applications is being delivered
by big ad delivery platforms including those run by Yahoo, Fox, and
Google, according to researchers. Read the full article. [CNet]
Researchers from Indiana University and Microsoft were able to
infer sensitive data by analyzing the distinct size and other
attributes of each exchange between a user and a website interaction. Using man-in-the-middle attacks, they could glean the
information even when transactions were encrypted using the Secure
Sockets Layer, or SSL, protocol or the WPA, or Wi-fi Protected Access
protocol. Read the full article. [The Register]
Criminal hacker organizations are operating with increasing corporate-life efficiency, specialization and expertise, said the FBI at FOSE conference. Here are the top ten operational positions in a cybercrime group. Read the full article. [Computerworld]
Mozilla has fast-tracked a patch for a critical vulnerability affecting its flagship Firefox browser.
The patch, which was originally slated for release on March 30,
fixes a vulnerability that could allow remote code execution attacks.
The flaw was originally released
into the VulnDisco exploit pack in February but Mozilla’s security
response team did not get the details until the middle of March.
Days before the start of Pwn2Own, Mozilla has patched its flagship Firefox browser. The Firefox 3.6.2 update fixes a critical bug in a font decompression routine that could be exploited to “crash a victim’s browser and execute arbitrary code on his/her system,” Mozilla said in a security advisory. Read the full article. [Computerworld]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
