Web Security

The Problem of Issuing Certs For Unqualified Names

The recent attack on Comodo and several of its associated registration authorities has spurred quite a bit of re-examination of the way that the Web’s certificate authority infrastructure works–or doesn’t. One interesting result of this work is that the folks at the Electronic Frontier Foundation have discovered that there are tens of thousands of legitimate certificates issued by CAs for unqualified names such as “localhost” or “Exchange,” a practice that could simplify some forms of man-in-the-middle attacks.

Google to Add Warnings About Malicious Executables to Chrome

Google is testing a new feature in its Chrome browser that will warn users when they attempt to download a potentially malicious executable file. The feature is an extension of the existing Web-based security mechanisms the company has integrated into Chrome and the Safe Browsing API and will be available to all users later this year.

Lessons Learned From the LizaMoon SQL Injection Attack

by Alex Rothacker
2

By Alex RothackerLast week, a large scale SQL Injection attack dubbed LizaMoon, referencing one of the domain names used in the attack, surfaced. This attack targets websites by injecting code that redirects visitors to a rogue anti-virus (AV) site. While on the AV site, visitors are presented with fake antivirus screens and popups, they are prompted to download fake software that will run a scan of the computer and ask the user to pay for a license to remove the alleged found infection.

Security Stories We Wish Had Been April Fool’s Jokes

by Dennis Fisher
1

There’s a grand tradition in the security community of clever, cerebral and sometimes downright inane April Fool’s pranks. They often take the form of fake news stories about viruses, world-ending attacks or something involving Bruce Schneier and Chuck Norris. But the security world is bizarre enough on its own without any help, so we’ve collected some of the stranger, scarier and more entertaining true stories of recent times that we wish had been April Fool’s jokes.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.