Servers belonging to Automattic, which makes the popular Wordpress blogging software, say that their servers were hacked and that the company’s source code is believed to have been “exposed and copied,” according to a company blog post Wednesday.
When Adobe warned customers earlier this week about a newly discovered vulnerability in the Flash Player software, company officials said that there were already attacks underway against the bug. Those attacks are using malicious Flash files buried in Word documents and Microsoft’s security engineers have analyzed the exploits and found some interesting details.
Adobe on Monday warned its customers about a new unpatched vulnerability in its Flash Player application. Officials say that the bug is being used in targeted attacks involving a malicious Flash file embedded in a Microsoft Word document.
By Moxie MarlinspikeIn the early 90’s, at the dawn of the World Wide Web, some engineers
at Netscape developed a protocol for making secure HTTP requests, and
what they came up with was called SSL. Given the relatively scarce body
of knowledge concerning secure protocols at the time, as well the intense pressure everyone at Netscape was working under,
their efforts can only be seen as incredibly heroic. It’s amazing that
SSL has endured for as long as it has, in contrast to a number of other
protocols from the same vintage. We’ve definitely learned a lot since
then, though, but the thing about protocols and APIs is that there’s
very little going back.
As the first phishing attacks begin to emerge targeting the millions of customers affected by the email data breach at Epsilon, there are indications that more than just email addresses and names may have been taken during the attack.
In the wake of the data breach at e-mail marketing firm Epsilon, the specter looms of widespread phishing attacks on hundreds of millions of e-mail users whose information was stolen from the firm. But according to Aaron Higbee, the Chief Technology Officer at Intrepidus Group, organizations had reason to fear phishing attacks long before the Epsilon breach made headlines.
After winning the attention, and hopefully the backing of executives, as we covered in The Challenge of Starting an Application Security Program, it becomes much more straightforward to win the funding needed for the right tools, services, and training needed for secure application development.
Unknown attackers have launched distributed denial of service attacks on a long list of blogs hosted on the social media site LiveJournal, including the blog of a prominent anti-corruption blogger in Russia.
A popular free mobile application from online music service Pandora.com that is the subject of a Grand Jury investigation into loose data privacy practices in the mobile application market confirms that the application silently sends reams of sensitive data to advertisers.
Researchers and law enforcement officials have been working on taking down and crippling various botnets such as Rustock, Storm, Conficker and others for years. It’s a complex problem, and in this video Ryan Naraine talks with Kaspersky Lab malware researcher Tillmann Werner about the Conficker botnet and options for controlling these networks.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
