Lax security screening at Apple’s App Store and a design flaw are putting iPhone users at risk of downloading malicious apps that could steal data and spy on them, a Swiss researcher warns at Black Hat DC. Read the full article. [cnet]
By Joshua WrightRecently, I picked up a Verizon MiFi device for $50 and the
extension of my service contract for another 2 years. The fun that I’ve
had with the device so far has well made up for both costs.
Adware slingers have taken advantage of the buzz around the latest version of Firefox to establish a fake browser download site. Read the full article. [The Register]
Developers at the open-source Apache HTTP Server have released
version 1.3.42 of the popular web server to patch a moderate security flaw in mod_proxy. [The H Security]
Database security expert David Litchfield
has unveiled a critical,
unpatched vulnerability in Oracle’s 11G database software that allows a hacker to take control of an
Oracle database and access or modify information at any security level. Two sections of code within the company’s database
application — one that allows data to be moved between servers and
another that allows management of Oracle’s implementation of java — are
left open to any user, rather than only to privileged administrators.
Those vulnerable subroutines each have their own simple flaws that
allow the user to gain complete access to the database’s contents. Read the full story [Forbes]
Twitter revealed more details about the phishing attacks that caused the company to reset the passwords on some user accounts Feb. 2. Read the full article. [eWEEK]
The ultra-secure technology used to protect
some of the world’s most commonly used microchips might not be so
secure, a researcher said at Black Hat DC. Read the full article. [Dark Reading]
Apple has shipped a patch to cover five documented vulnerabilities that expose iPhone and iPod Touch users to malicious hacker attacks. The most serious flaw could allow remote code execution if an iPhone/iPod Touch user opens audio and image files.
Brian Krebs talks with Rick Doten, chief scientist at Lockheed Martin’s Center for Cyber Security Innovation. Doten has built an impressive slide deck on ATM fraud attacks. Read the full article. [KrebsonSecurity]
There are several flaws in the way that the iPhone handles digital certificates which could lead to an attacker being able to create his own trusted certificate and entice users into downloading malicious files onto their iPhones.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
