A conceptual problem in the memory management area of Linux allows local attackers to execute code at root level which is caused by potential overlaps between the memory areas of the stack and shared memory segments, according to a report by Rafal Wojtczuk. Read the full article. [The H Security]
Conventional wisdom has it that Microsoft’s Internet Explorer Web browser is on the way out: succumbing to the death of thousand cuts administered by plucky rivals like Mozilla’s Firefox, Google’s Chrome and even Opera.
Hacked smartphones could endanger troops by sending location data to the enemy using mechanisms similar to those employed by recently discovered Android malware, experts say. Read the full article. [Network World]
Mozilla has been aware of the Firefox iFrame bug that came to light yesterday for more than two months now and the company’s engineers concluded early on in the process that the problem was a fairly minor one that was unlikely to cause the vast majority of users any confusion or be exploited by attackers.
In this video from the OWASP AppSec Research conference in Sweden, security researcher Ivan Ristic of Qualys discusses practical methods for breaking SSL.
A hack attack that can expose users to malware exploits has infected
more than 1 million webpages, at least two of which belong to Apple. The SQL injection attacks bombard the websites of legitimate
companies with database commands that attempt to add hidden links that
lead to malware exploits. Read the full article. [The Register]
By Charlie MillerI’m a security researcher. I find bugs in software, they get fixed. I write exploits, they give me a shell. It’s more or less always the same and it gets kind of boring. But there was one exploit I helped write back in 2007 that was a little different. This is the story of that exploit.
It’s possible to craft a malicious website so that a user’s clicks are
secretly redirected to a legitimate site in a way that steals a user’s
passwords and other data. Many Web developers have added protections to
block the tactic on standard websites, but Stanford University
researchers warn that there are not nearly enough defenses against the
technique on mobile websites. Read the full article. [Technology Review]
The drumbeat for more secure application development picked up pace on Tuesday, with news that software giant HP had acquired privately funded Fortify Software, a maker of static code analysis tools, for an undisclosed amount.
Penn State researchers managed to
identify the pass code patterns on two Android smartphones (the HTC G1
and the HTC Nexus One), 68 percent of the time using photographs taken under
different lighting conditions, and camera positions. Read the full article. [ZDNet]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
