WebKit Flaws Haunt Apple iTunes
Apple has shipped a new version of its iTunes media player to fix 13 security flaws that cold be exploited to launch attacks against Windows machines.
Web Security
Apple Uses Security Advisory to Push iTunes 10 Upgrade
Social networking features, a rockin’ new logo and GUI improvements aren’t the only reason you should upgrade to iTunes 10, says Apple. The update to Apple’s popular music player software, released on Wednesday, also fixes a bunch of gaping vulnerabilities that could make earlier versions susceptible to Web based attacks.
Online Bank Fraud Hammering Small Businesses
Online bank fraud, for all of its obvious ploys and tired tactics, is still a remarkably effective way to make money. Too lazy or clueless to get a real job? Go phishing. Lots of people are doing it, and by some estimates, it’s evolving into a nearly $1 billion business.
A cybersecurity researcher has discovered an easy way for a hacker to
swipe copies of documents scanned by Hewlett-Packard all-in-one printers
widely used in workplace settings. Read the full article. [The Last Watchdog]
Scammers are offering prospective marks an application that supposedly shields them from exposure to survey scams. Naturally, you first have to fill in a survey to install the script,
which is punted through Userscripts(dot)org. Read the full article. [The Register]
Cyber crooks stole just shy of $1 million from a satellite campus of The University of Virginia last week. Read the full article. [KrebsonSecurity]
Google has removed malicious programs from its Google Code platform after Web firm zScaler said the company’s servers were being used to serve malicious code.
There has never been more focus on security than there is right now, whether it’s from software vendors looking to eliminate flaws in their products, from attackers looking to exploit those flaws or from customers who are sick of having their PCs compromised. And as the focus has intensified in recent months, researchers say that, for a variety of reasons, it has become increasingly difficult to find exploitable client-side bugs–particularly memory-corruption flaws–leading them to dig deeper and find more exotic bugs.
According to the researcher who helped take down
Mariposa, the operators who purchased the bot software from the
man known as “Iserdo” and then built Mariposa, for some
reason didn’t opt for the feature, which he offered for 200 euros, even
though it would have increased their potential profits. Read the full article. [Dark Reading]
Starting tomorrow, a little-known group of security researchers will
kick off a month of bug disclosures that target unpatched
vulnerabilities in software from Adobe, Microsoft, Mozilla, Apple and
others. Read the full article. [Computerworld]
