Web Security

Webmasters running unfinished modules for Drupal do so at their own risk
after the open-source CMS updated its guidelines on fixing security
vulnerabilities. Read the full article. [The Register]

However well we protect our data, sooner or later we run the risk of
information we want to keep private ending up in the public domain.
Researcher Harold van Heerde of the Centre for Telematics and
Information Technology (CTIT) at the University of Twente therefore
wants information to fade away over time: just let the details gradually
disappear from view. This would drastically reduce privacy-related
problems while ensuring that the information still retains its
usefulness to some extent. Read the full article. [ScienceDaily]

By Robert HansenEarly this morning Google’s Tavis Ormandy published a vulnerability in the hcp protocol handler. It allows the attacker to run arbitrary commands as the user. In practice it created a lot of alerts and warnings for me – but the XP install I was using is somewhat locked down. So I’m not sure how practical this attack would be over any other attack that causes an alert, as the article mentions. Later his reports says it works around the alerts (I couldn’t reproduce that, but that was his intention). Either way, though, this is some pretty amazing research. However, there are some odd things about this that really struck me the wrong way.

A researcher has discovered a flaw residing in the Windows Help and Support Center, a feature that
provides users with online technical support. Malicious hackers can
exploit the weakness of Windows by embedding commands in web addresses
that activate the feature’s remote assistance tool, which allows
administrators to execute commands over the internet. Read the full article. [The Register] Read the advisory. [Seclists.org]

There’s a large-scale attack underway that is targeting Web servers running Microsoft’s IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there’s no clear indication of who’s behind the campaign right now.

WordPress users whose websites are hosted on GoDaddy servers have been
targeted by fake AV peddlers yet again. Read the full article. [Help Net Security]

Unsuspecting users looking for videos on recent events like the Gulf of
Mexico oil spill and the NBA playoffs are being directed to maliciously crafted websites with
videos that appear to be identical to YouTube postings. Read the full article. [InfoSecurity]