Web Security

A project soliciting funds for a new video game to compete with the likes of World of Warcraft and Skyrim has been pulled from the crowd funding website Kickstarter after it became clear that the proposal was a sham. 

The Iranian government has discovered what it describes as a ‘hidden agenda’ behind a recent malware attack on the country’s Oil Ministry, according to a report published by the FARS News Agency.

The dust still hasn’t cleared from revelations that many of RuggedCom brand networking products contain an easily-exploited back door account, and that it is working on a fix for the problem, according to a statement from Siemens, which recently bought RuggedCom.

Anti malware company Symantec released its threat report for 2011 on Monday. Buried in the dry statistics about the number of Web based attacks and malicious programs detected during the year are some surprising facts. Among them: religious-themed Web sites are among the dirtiest on the Internet.

By Joe BasiricoProfessional hackers or security testers tend to write a lot of code. We write exploit code, fuzzers, code to handle esoteric protocols and data structures, unpackers, disassemblers, reversers, parsers, and so much more. We write this code because often what we’re doing is so specific that is requires one off tools. Over time we develop an enormous arsenal of our own tools, scripts, functions and code snippets that make us significantly more efficient, but are hacks that are only beneficial to us.We then turn around and present them at conferences, we show off their magic in the hands of the original developer and the crowd goes wild and the ecosystem stops there, because they are unsupported, undocumented and nearly unreadable by anybody but the original author. I’d like to fix that.

This post is the third in a 4-part series on Application Security, or “AppSec”. The series will define the components of a sound AppSec program, delineate the growing threats to software, weigh the costs of a data breach, and outline the CISO’s responsibility in managing software security risk. Taken together, they are a primer on AppSec best practices that will help organizations build the business case for further investment in this critical IT security discipline.By Fergal GlynnThis series began with a general definition of Application Security (“AppSec”) as a fundamental infosec practice that addresses the reduction of both immediate and systemic software risk. When undertaken correctly, AppSec takes a systematic, programmatic approach to hardening business-critical software, from the inside. That’s not to say that organizations must over-invest in an advanced program from the start to be effective – in fact, quite the opposite.

The controversial Cyber Intelligence Sharing and Protection Act (CISPA) passed with bipartisan support by a 248-168 vote in the U.S. House of Representatives last night, despite warnings from privacy experts and a growing public outcry.