Some WordPress Themes, Thousands of Sites Open to XSS Vulnerability
A number of Wordpress themes being distributed by the developer Parallelus are vulnerable to cross-site scripting (XSS) attacks, reports said.
Web Security
Hunting Badware
Security often is discussed in super-serious terms, using metaphors and analogies from the military or medical communities to underscore the gravity of the situation. But the truth is, some of this stuff is pretty funny, and the folks at StopBadware.org know this. To explain the way that attackers use compromised Web sites to infect unsuspecting visitors with malware, the group put together this video featuring actual human people dressed as Web sites.
New Strain of Man-in-the-Browser Malware Refines Data Sent to Attacker in Real Time
Hackers fond of man-in-the-browser (MiTB) attacks have brought efficiency to their work. New strains of MiTB malware have been discovered that are able to parse logs for the sensitive information hackers are targeting, rather than send massive unstructured logs back to the attacker’s command and control server.
Attackers targeting major U.S. banks with distributed denial of service attacks are using a number of toolkits to automate the job. Prolexic Technologies, a security company specializing in DDoS protection services, identified one toolkit called itsoknoproblembro, a kit that attacks multiple ports and network targets.
By Fabio AssoliniThis is the description of an attack happening in Brazil since 2011 using 1 firmware vulnerability, 2 malicious scripts and 40 malicious DNS servers, which affected 6 hardware manufacturers, resulting in millions of Brazilian internet users falling victim to a sustained and silent mass attack on DSL modems.
Researchers working on the “physically unclonable functions found in standard PC components (PUFFIN) project” announced last week that widely used graphics processors could be the next step in online authentication.
The National Telecommunications Commission (NTC) of the Philipines has asked for assistance from law enforcement after a handful of government sites in the country, including the NTC’s site, were brought offline this morning in a hack allegedly carried out by PrivateX, an offshoot of the hacktivist group Anonymous.
Mozilla is trying to deal a two-fisted blow to the continued use of passwords as an online authenticator, as well as the practice using social media username-password combinations as a persistent login on other sites. Its Persona project has moved into its first beta release promising developers and website users a better and more private authentication experience.
PNC Bank appears, as promised, to be the latest victim of hacktivists carrying out denial-of-service attacks against major U.S. financial services institutions. PNC, out of Pittsburgh, joins Wells Fargo, J.P. Morgan Chase & Co. and Bank of America on a list of banks taken offline reportedly by a group who claimed responsibilities for the attacks as retaliation for the portrayal of Muslims in “Innocence of Muslims,” a series of movie trailers uploaded to YouTube.
In an analysis of 1.7 billion shortened URLs, researchers at Web of Trust found that 8.7 percent of TinyURLs and five percent of Bit.ly URLs lead to sites that received poor ratings for ‘trustworthiness’ and ‘child protection.’
