Firefox Extension HTTP Nowhere Allows Users to Browse in Encrypted-Only Mode
A new browser extension for Firefox is designed to use SSL and do so correctly by only accepting HTTPS requests.
Web Security
Pinterest Closes Hole That Allowed Anyone to View Users’ Email Addresses
A security researcher has discovered a vulnerability in Pinterest, the rapidly growing social network, that enables an attacker who knows a target’s username or user ID to discover that user’s email address. The bug is quite simple to exploit and could give an ambitious attacker a huge target list for phishing attacks.
Google, Mozilla Considering Limiting Certificate Validity to 60 Months
In the wake of a parade of problems with certificate authorities and attackers using stolen digital certificates, both Google and Mozilla are poised to enforce new rules in their browsers for how long end-entity certificates should be trusted.
Spammy websites distributing adware as Java or other kinds of software updates are nothing new but researchers have recently noticed two sites pushing that malware to users through sites that leverage Google’s App Engine.
There are 25 fresh security patches in the newest version of Google Chrome, including fixes for a number of high-severity vulnerabilities. Chrome 29 also includes a number of performance enhancements.
An attacker, who may have gotten the information from the database of a third party, claims to have access to the OAuth login tokens and secrets for every Twitter user. He has posted more than 15,000 of the entries online and claims that he can now access the account of any user he wishes. Twitter officials, however, say no accounts have been compromised.
A member of Facebook’s security team acknowledged over the weekend that the group could’ve taken further steps to verify a vulnerability initially brought to their attention by an independent security researcher last week but that the company largely adhered to its bug disclosure policy.
The Internet is a big thing. Or, more accurately, a big collection of things. Figuring out exactly how many things, and what vulnerabilities those things contain has always been a challenge for researchers, but a new tool released by a group from the University of Michigan that is capable of scanning the entire IPv4 address space in less than an hour.
A USENIX paper presented yesterday explains how a team of researchers was able to disrupt a small portion of the underground merchants selling fraudulent Twitter accounts.
The National Highway Traffic Safety Administration restored its servers yesterday, 10 days after an attack that knocked the agency’s website offline.
