Google has a reputation for being open and transparent with many of its initiatives and internal workings, but one of the things that the company hasn’t talked much about publicly until recently is security. In this interview with SearchSecurity.com, the director of security for Google Apps, Eran Feigenbaum, discusses the company’s plans for security around cloud computing and how the model affects compliance efforts.
Browsing Category: Web Security
From Microsoft’s SDL blog (Chris Weber)
I’m writing to tell you about our new Watcher tool for web-app security auditing and testing. Watcher is a plug-in for Eric Lawrence’s Fiddler proxy aimed at helping developers and testers find security issues in their web-apps fast and effortlessly. Because it works passively at runtime, you have to drive it by opening a browser and cruising through your web-app as an end user. For the developer, the tool can provide a quick sanity check, so you can find problems and hot-spots that warrant further attention. In the hands of a pen-tester it can assist in finding issues that lead to other attacks like XSS and CSRF. Read the full story [msdn.com]
By David Mortman
I am very excited to be guest blogging about RSA here on Threatpost. A special thank you to Dennis and Ryan for the privilege.
I am also very excited to once again be speaking at RSA this year. Last year, I was on a panel with Mike Rothman, Rich Mogull, Martin McKeay and Ron Woerner titled “Avoiding Another Security Groundhog Day”. The main theme of our panel was how could we as security practitioners move forward with protecting our customers while avoiding the sins of the past.
From DarkReading (Kelly Jackson Higgins)
Kernel rootkits are tough enough to detect, but now a researcher has demonstrated an even sneakier method of hacking Linux.
The attack exploits [dtors.org PDF] an oft-forgotten function in Linux versions 2.4 and above in order to quietly insert a rootkit into the operating system kernel as a way to hide malware processes, hijack system calls, and open remote backdoors into the machine, for instance. Read the full story [darkreading.com]
From The Register (John Leyden)
Scareware scammers are trying to game search engines into promoting crudware sites when a surfer searches for information on Ford cars.
The Ford scareware campaign [pandasecurity.com] features around one million links, all targeting the Ford Motor Company, designed to trick search engines into promoting malicious pages towards the top of search results. Malvertised pages are punting a rogue anti-virus product, called MS AntiSpyware 2009. The malicious application attempts the scare users into buying useless software on the basis of fraudulent scan results that report systems are infected, whether they are or not. Read the full story [theregister.co.uk]
By Roel Schouwenberg
Over the weekend, we’ve seen a number of Cross Site Scripting worms for Twitter.
Now, with all the recent security problems at Twitter, these worms [networkworld.com] come as little surprise. The most virulent worm is not particularly complex in the vulnerability it is exploiting. The original author? A bored 17-year-old who had nothing better to do over the Easter weekend.
From Computerworld (Gregg Keizer)
Although the media blitz about the Conficker worm prompted a significant number of enterprise users to finally fix a six-month-old Windows bug, about one in five business computers still lack the patch [computerworld.com], a security company said today.
Scans of more than 300,000 Windows PCs owned by customers of Qualys Inc. show that patching of the MS08-067 vulnerability — a bug that Microsoft fixed with an emergency update issued in October 2008 — picked up dramatically two weeks ago. Read the full story. Also see our previous coverage of the Conficker threat.
From the Industry Standard (Robert McMillan)
Flaws in popular Internet-based telephony systems could be exploited to create a network of hacked phone accounts, somewhat like the botnets that have been wreaking havoc with PCs for the past few years.
Researchers at Secure Science recently discovered ways to make unauthorized calls from both Skype [securescience.net] and the new Google Voice communications systems, according to Lance James, the company’s cofounder. Read the full story [thestandard.com] Here’s the paper [pdf] explaining the Google Voice attack.
From PC World (Daniel Ionescu)
The malicious worm affecting Twitter over the weekend has now mutated and continues to invade [pcworld.com] the popular microblogging network. Although Twitter is taking action [twitter.com] against the problem, security analysts fear that further mutations of the worm will continue to wreak havoc on the network over the week. This article provides practical advice on how to stay safe while using Twitter.
University of Utah officials say a computer virus has infected more than 700 campus computers [tech.yahoo.com], including those at the school’s three hospitals.
University health sciences spokesman Chris Nelson said the outbreak of the Conficker worm, which can slow computers and steal personal information, was first detected Thursday. By Friday, the virus had infiltrated computers at the hospitals, medical school, and colleges of nursing, pharmacy and health. Read the full story [yahoo.com]