Researchers have identified a bug in the way that some third-party VPN services use the PPTP protocol over IPv6, a problem that enables eavesdroppers to unmask the specific IP addresses of the VPN service’s users.
Man-in-the-browser attacks are increasingly being used to successfully bypass authentication mechanisms used by online banking sites, according
to a security researcher. Read the full article. [eWEEK Security Watch]
Researchers are closely watching the rise of malware on Internet-enabled mobile devices. New mobile malware boasts a broad range of functionality, including the
capability to download other malicious files, detect internet
connections or establish new ones, undertake URL redirection and carry
out phishing attacks. Read the full article. [Infosecurity]
Dennis Fisher talks with Alex Horan of Core Security about penetration testing, the place of security within a business and Core’s new push to make security more accessible and understandable for business leaders.
The driver download portal of hardware manufacturer Lenovo temporarily
deployed malicious code. Various virus scanners issued alerts about a
Java-based Trojan downloader or dropper. Read the full article. [The H Security]
Security experts are warning about a fresh round of attacks against SSH implementations. The attacks are brute-force attempts to authenticate to remote SSH servers, a tactic that has been used quite often in the past in distributed attacks.
DHS Inspector General Richard Skinner spoke before the House Committee on Homeland Security yesterday and detailed his office’s latest report on the progress US-CERT has made in securing cyberspace and included noting limitations with enforcement, staffing and strategic planning. Read the full article. [Infosecurity]
Microsoft launched a new Web-based
mechanism for researchers to securely report stolen credentials, bank
and credit card data, or other data they discover, and as a way to
quickly alert the appropriate banks, retailers, or government agencies
of a compromise. Read the full article. [Dark Reading]
Attention-piquing malicious spam emails purportedly coming from the DHS,
the Pentagon or the Transportation Security Administration have
recently been spotted by researchers. Read the full article. [Help Net Security]
Two prominent privacy-rights organizations, the Tor Project and the Electronic Frontier Foundation, have launched a new Firefox extension that encrypts all of the browser’s communications with some prominent Web sites.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
