Malware-Spiked Spam Uses Amazon.com Lure
A currently spamvertised malware campaign is brand-jacking Amazon.com,
in an attempt to trick end users into visiting a client-side exploits
serving URL. Read the full article. [ZDNet]
Web Security
This Week In Security: Black Hat, Spammers and Trusted Rootkits
The old saying that there’s nothing new under the sun is just as true in the security industry as it is anywhere else. Many new attacks are variants or tweaks of existing ones, new software fails in exactly the same way as old software and new technologies crop up to solve problems that are 30 years old. You can add to that list the sad frequency with which interesting talks at security conferences are having to be canceled because someone doesn’t like the content. This week saw yet another talk pulled from Black Hat, a major cybersecurity meeting in Washington, a rootkit with digitally signed drivers and some new tactics by spammers. Read on for the full week in review.
Password Timing Attacks Expected to Grow
A well-known cryptographic attack could be used by hackers to log into
Web applications used by millions of users, according to two security
experts who plan to discuss the issue at Black Hat. Read the full article. [Computerworld]
In an effort to enlist more help finding bugs in its most popular software, such as Firefox, Thunderbird and Firefox Mobile, Mozilla is jacking up the bounty it pays to researchers who report security flaws to $3,000.
Dennis Fisher talks with Caleb Sima of Armorize about the company’s scheduled talk at Black Hat on China’s cyber army being canceled under pressure from the governments of China and Taiwan.
Dennis Fisher talks with Caleb Sima of Armorize and Andy Chou of Coverity about the companies’ new partnership designed to make security and quality code testing simpler and more efficient and the state of software security in general.
Instead of indicating password quality via coloured bars, the Windows crypto tool Thor’s Godly Privacy (TGP) informs users about the estimated time required for a successful brute-force attack on the chosen password. Read the full article. [The H Security]
Privacy shortcomings in Chatroulette expose users to risks in phishing, man-in-the-middle attacks and location-based threats,
according to a study by security researchers. Read the full article. [The Register]
Developers could build a framework that could maintain transactional records among web services in order to recreate the scene of the crime in the aftermath of a cyber attack, scientists from the National Institute of Standards and Technology suggest in a new study. Read the full article. [Information Week]
A talk on China’s state-sponsored offensive security efforts scheduled for the Black Hat conference later this month has been pulled from the conference after concerns were raised by some people within the Chinese and Taiwanese government about the talk’s content.
