Researchers Call for Ban on PHP SuperGlobal Variables
Researchers urge developers to ban PHP SuperGlobal variables in applications. These variables are wide open to remote code execution, remote file inclusion and security bypasses.
Web Security
Many Flash, Java Users Running Older, Vulnerable Versions
It’s long been known that Java and Flash are favored targets of attackers, thanks to their huge install bases and numerous security issues. And the users who are targeted by these attacks aren’t doing themselves any favors either, as new research shows that 19 percent of business users are running the newest version of Java, […]
Watch-Like Heartbeat Monitor Seeks to Replace Passwords
Researchers have developed a wearable device that measures electrocardiogram readings, which are unique to every person, that the researchers hope could be used as an alternative to passwords for authentication.
In the wake of the revelations surrounding the NSA’s domestic surveillance and intelligence-gathering operations, security experts said there would likely be a natural uptick in the usage of privacy focused tools such as Tor, PGP and other encryption services. In the case of Tor, there has been more than a slight increase–the number of Tor […]
Late Tuesday morning, one of the engineers in CloudFlare’s San Francisco office saw a message on Twitter saying that the New York Times Web site was down. Minutes later, more messages appeared, as security researchers and others began looking into the situation and realized that someone may have compromised the site’s DNS records. Understanding the ramifications of that sort of attack, if that’s in fact what it was, Matthew Prince, CloudFlare’s CEO sent an email to Rajiv Pant, the CTO of the Times, saying that the company’s engineers would be available if Pant needed some help figuring out the situation. He did.
There is a critical remotely exploitable vulnerability in Cisco’s Secure Access Control Server which allows a remote attacker to take complete control of a vulnerable server. The bug results from a bad implementation of the EAP-FAST protocol and it affects a number of versions of the Cisco ACS. The vulnerability is a highly critical one, […]
Opera has pushed out version 16 of its eponymous browser this week, complete with what it’s calling “tons of bug fixes” and improved performance.
Java users get another reminder to upgrade to current versions of the browser plug-in after a zero day targeting a previously patched Java 6 bug was found in the Neutrino Exploit Kit
The attack that took down the New York Times Web site Tuesday afternoon, along with domains belonging to Twitter and the Huffington Post, was accomplished through the use of compromised credentials belonging to a reseller for the registrar that those companies use to buy their domains.
The Syrian Electronic Army, a group known for attacking high-profile media sites in the last year or so, has in the last few hours compromised the domain information for a large number of sites, including the New York Times home page and some of Twitter’s domains. Security researchers say that the most likely attack vector was the domain registrar used by the companies.
