Google Debuts New Help for Hacked Sites Videos, Articles
Search giant Google has posted a set of new informational videos and articles to help website owners recover their sites after they’ve been hacked.
Web Security
Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing
UPDATED Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week.
Slideshow: Scenes from CanSecWest 2013
VIEW SLIDESHOW Scenes from CanSecWest 2013The CanSecWest security conference in Vancouver last week included technical presentations on bypassing ASLR and DEP and the intricacies of Android research, as well as a fascinating talk on the red team exercises Facebook’s security team runs. We put together some scenes from the show and Vancouver itself.
VANCOUVER–Within less than 24 hours of the vulnerabilities being used and disclosed to them, both Mozilla and Google have issued patches for flaws employed by participants in this week’s Pwn2Own contest at CanSecWest here.
VANCOUVER–When Facebook announced last month that its corporate infrastructure had been compromised through a watering-hole attack against several of its employees, it was major news, both because of the attack itself and because the company had come out and owned up to it. The interesting thing, however, is that this was not the first major problem that the Facebook incident response team had handled. In fact it was the third one in less than a year.
VANCOUVER–Finding and exploiting new vulnerabilities in the major browsers has become a difficult exercise for security researchers, thanks to the exploit mitigations, sandboxes and other protections that Microsoft, Google and Mozilla have added in the last few years. The same has become true of Adobe Flash, but difficult is not the same as impossible, as the contestants at the Pwn2Own contest here have shown.
Facebook users are sharing less information publicly, yet continue to share countless bits of information with what one group of researchers has dubbed “silent listeners.”
A vulnerability in sudo – a program that manages user privileges on certain types of systems – could allow an unauthenticated user to execute commands for about five minutes, without entering a password.The problem, which has since been fixed, previously existed in builds 1.6.0 through 1.7.10p6 and 1.8.0 through 1.8.6p6 of sudo. The program is usually found in Unix-based Linux and Mac OS X systems.
Similar to what Mozilla did in its Firefox browser earlier this year, Apple has elected to block old, out-of-date versions of Adobe’s Flash Player product in Safari in hopes of getting users to update their systems.
Evernote, the online service that enables users to store and sync all kinds of data across multiple devices, has become the latest major Web property to suffer a serious intrusion. The company said on Saturday that attackers had compromised some user information, including email addresses and hashed passwords.
