A french IT security firm is warning of a previously unknown (“zero day”) vulnerability that affects most versions of Microsoft’s Internet Explorer Web browser. The hole, if exploited, could allow remote attackers to circumvent defensive features in fully patched WIndows 7 and Windows Vista and run malicious code on vulnerable systems.
The recent wave of online actions by supporters and opponents of information leaking site Wikileaks has focused attention on the phenomenon of distributed denial of service (DDoS) attacks. But a study published by Harvard University’s Berkman Center for Internet and Society this week concludes that there is no clear and easy defensive solution for many of the sites being targeted by DDoS attacks.
A gusher of Web applications vulnerabilities, malicious insiders and
sophisticated malware threaten networks and data. To keep your systems
reasonably secure, what will your security focus be during the year
ahead?
UPDATE: The Massachusetts Attorney General has been notified that financial data on 1,800 residents were exposed in a database breach linked to CitySights NY, a sightseeing firm. The case could set the stage for enforcement of the State’s nine month-old data privacy law.
Social networking behemoth Facebook revised their bug disclosure policy last week to
protect well-intentioned vulnerability researchers from potential lawsuits
stemming from their discoveries.
CitySights owner Twin America says the credit card details of 110,000 customers were stolen in a Web based attack and suggests it wasn’t following Payment Card Industry guidelines for storing card data.
After
a hack of systems belonging to online publishing giant Gawker Media that yielded more than one million passwords,
the online media company’s chief technology officer has announced new defense strategies
aimed at placating their users and preventing further
humiliating data breaches.
This video is a short demo of an attack that researcher Billy Rios developed to exploit a series of bugs in browser plug-ins. By chaining the vulnerabilities together, Rios is able to steal content from a victim’s machine. The slides containing the code for the attack are available on Rios’s blog.
Microsoft’s vulnerability Severity Rating System is closing in on its tenth birthday. While the security landscape has been transformed during that time, the Ratings have endured. But do they still work? Threatpost asked prominent vulnerability researchers to give us their opinion. You may be surprised at what they had to say.
By Jeremiah Grossman, CTO, WhiteHat SecurityEveryone sounded the alarms at the Gawker Media attack, which included a security breach of websites such as Gizmodo, Lifehacker, Kotaku, io9, and others. The numbers were impressive: 1.3 million user accounts exposed, 405 megabytes of source code lost, and perhaps more important to some, the identity of those leaving anonymous comments potentially revealed. For Gawker, there is a loss of trust that will be difficult to regain. Users are already clamoring for the ability to delete their accounts. And, on the technical side, all Gawker’s systems will need to painstakingly audited or rebuilt entirely from scratch to prevent the same thing from happening again. Happy Holidays indeed.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
