One of the patches released by Microsoft last week is not providing protection against the vulnerability it was meant to fix, according to a researcher who today accused Microsoft of making functionality a higher priority than security.
Over at the Zero Day blog [zdnet.com], I covered the saga of the one-year-old Windows token kidnapping vulnerability that remains unpatched and is now being exploited in malicious hacker attacks.
(Research by Joe Stewart, SecureWorks)
In response to published reports [outdustry.com] about a hacking attack [appletell.com] against the iTunes gift card system, security researcher Joe Stewart has gone digging for answers and comes up with an eyebrow-raising theory.
Five of the brighter minds in the security industry spent two hours Thursday afternoon arguing, needling each other and generally disagreeing about everything under the sun and at the end of it all settled absolutely nothing on the topic of partial disclosure.
Apple has issued an advisory to warn that malicious hackers can rig audio files to hijack usernames and passwords from its popular iTunes media player.
The company described the bug as a “design issue” in the iTunes podcast feature can be abused via rigged audio files to cause an authentication dialog to be presented to the user. From that dialog, a hacker can hijack iTunes credentials and upload it to the podcast server.
Despite all the grief that Microsoft has taken over the years for the security problems with Windows, Internet Explorer and its other products, Apple’s Mac OS X has turned out to be a hacker’s dream. As Rob Westervelt reports [SearchSecurity.com], security researcher Dino Dai Zovi made quick work of OS X Wednesday at the SOURCE Boston conference.
Adobe has released a security bulletin to patch a “critical” code execution flaw affecting the ubiquitous PDF Reader and Acrobat software.
However, the patch is only available for Adobe Reader 9 and Acrobat 9. Earlier versions of the software are affected by the vulnerability — and in the wild attacks — but Adobe says those fiixes are delayed for at least another week.
Microsoft’s batch of security patches for March 2009 has been released released with fixes for 8 vulnerabilities in the Windows operating system.
In all, the Redmond, Wash. software maker shipped three bulletins, one rated “critical,” the company’s highest severity rating. Here are the raw details:
Wired’s Threat Level blog is reporting that a 27-year old Los Angeles man was sentenced to four years in prison after pleading guilty last year to infecting as many as 250,000 computers and stealing thousands of peoples’ identities and hijacking their bank accounts.
According to a Patch Tuesday advance notice from Microsoft, there will be three security bulletins released on March 10, one rated critical.
The other two bulletins are rated “important” and can expose Windows users to spoofing attacks. All supported versions of Windows will be affected by next Tuesday’s releases, including the newer Windows Vista and Windows Server 2008.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
