Vulnerabilities

Credit card numbers are so passe. Today’s hackers know the real powerhouse data to steal is emission certificates. That’s exactly what hackers went after last week when they obtained
unauthorized access to online accounts where companies maintain their
carbon credits. Read the full article. [Wired]

By Jeremiah GrossmanThere are several security issues affecting all major Web browsers that
have remained unaddressed for years (probably because the bad guys
haven’t leveraged them aggressively enough, but the potential is
there). The problem is that the only known ways to fix these issues
(adequately) is to “break the Web” — i.e. negatively impact the
usability of a significant and unacceptable percentage of websites.
Doing so is a non-starter for any browser vendor looking to grow market
share. The choice is clear for most vendors: Be less secure and adopted, rather than secure and obscure. This is what the choice comes down to. This is a topic deserving of further exploration.

A hacker attack at payroll processing firm Ceridian Corp. has potentially revealed the names, Social Security
numbers, and, in some cases, the birth dates and bank accounts of
27,000 employees working at 1,900 companies nationwide. Read the full article. [StarTribune]

Hackers broke into computer systems at a Massachusetts chapter of the
United Way last month and attempted to make off with more than $150,000
from one of the nation’s largest charities with the use of a money mule duped by a “Work-at-home” scam. Read the full article. [KrebsonSecurity]

An IBM ISS researcher at Black Hat DC revealed major
security holes in a little-known wiretapping architecture for IP
networks created by Cisco Systems for law enforcement. The weaknesses
could result in an attacker interfering with legal surveillance or
performing some unauthorized surveillance of his own. Read the full article. [Dark Reading]

Microsoft today issued a security advisory to acknowledge an information disclosure hole in its Internet Explorer browser and warned that an attacker could exploit the flaw to access files
with an already known filename and location.The vulnerability was first discussed at this week’s Black Hat DC conference by Jorge Luis Alvarez Medina, a security consultant with Core Security
Technologies.   Microsoft says the risk is highest for IE users running Windows XP or who have disabled the browser’s Protected Mode feature.

A pair of Spanish researchers here today
demonstrated a way to hack the connection between a Web application and
a database, letting the attacker hijack Web credentials and perform
other nefarious activities. Read the full article. [Dark Reading]