Mozilla Expands Bug Bounty to Web Apps
Mozilla has decided to follow the lead of Google and expand its bug-bounty program to pay for vulnerabilities found on certain of its Web sites, including the site for Firefox and the main Mozilla site.
Web Security
After A Decade, Time To Rethink Microsoft’s Vulnerability Ratings?
Security Experts will tell you that one year is a lifetime in the world of online threats and attacks. But eight years after Microsoft introduced its innovative severity rating system for software vulnerability, the company says its original definitions of what makes a software hole important still apply. Security experts aren’t so sure.
HeapLocker Tool Protects Against Heap-Spray Attacks
As attackers have focused more and more of their energies on exploiting bugs in Web applications, and specifically memory-corruption vulnerabilities, researchers have followed along, trying to find new ways to protect users from these attacks. One of the newer entrants in this field is a tool called HeapLocker, designed to prevent heap-spray attacks.
Google has pushed out a new version of its Chrome browser, fixing two high-priority security bugs as well as several other flaws.
CLARIFICATION: This story corrects information concerning the availability of the stolen account names and passwords online.
Millions of Web users are waking up to news that broke over the weekend that systems belonging to Gawker Media were hacked and password data on millions of user accounts published on the Internet. How can you figure out if your e-mail and password were among more than a million that were stolen? Read on for instructions on figuring out if you’re one of the victims of the Gawker attack, and what to do about it.
A massive hack of systems belonging to online publishing giant Gawker Media has put gigabytes of sensitive information related to Gawker founder Nick Denton and the company’s operations online. But a trove of millions of hashed account passwords could be an even bigger problem for untold numbers of individuals, companies and government agencies.
Two major online ad networks–DoubleClick and MSN–were serving malware via drive-by download exploits over the last week, experts say, after a group of attackers was able to trick the networks into displaying their ads by impersonating an online advertising provider.
The National Institute of Standards and Technology has chosen the five finalists for the last round of its competition to find the next hash function standard. The SHA-3 finalists include Skein, developed by a group including Bruce Schneier and Jon Callas.
Dutch authorities issued a statement Thursday saying that a 16 year old boy has been taken into custody for involvement in attacks against the Web sites of Mastercard and Visa.
Another serious remotely exploitable bug in Internet Explorer has cropped up, this one related to the way that IE handles a specific DLL library on pages that reference CSS files. There also is publicly available exploit code for the new bug.
