Originally expected for today, Mozilla has confirmed that it is delaying the the release of
version 3.6.4 of its open source Firefox web browser, the next security
and stability update to the 3.6.x branch of Firefox. Instead, Mozilla
has announced the availability of a release candidate for public
testing. Read the full article. [The H Security]
Microsoft has released an open-source Web Protection Library (WPL) to help developers protect web sites from cross-site scripting attacks.
The WPL, which is a set of .NET assemblies, is being offered as part of a defense in depth strategy to add an extra layer to any validation or secure coding practices.
Botnets increasingly are creating phony
online accounts on legitimate websites and online communities in order
to steal information from enterprises. Merrick
Furst, botnet expert and distinguished professor of computer science at
Georgia Tech, says bots are showing up “en masse” to customer-facing
websites — posing as people. Read the full article. [Dark Reading]
A spyware application that surreptitiously scans chat logs and hard
drives of unsuspecting Mac users has found its way onto three of the
more popular download sites, said security researchers. Read the full article. [The Register]
The Accoria web server, also known as Rock Web Server, contains several
cross-site scripting (XSS) and cross-site request forgery (XSRF)
vulnerabilities. Read the full advisory. [Department of Homeland Security]
A vulnerability on Facebook forced hundreds of thousands of users to
endorse a series of webpages over the holiday weekend, making the social
networking site the latest venue for an attack known as clickjacking. Read the full article. [The Register]
Malware authors are increasingly willing — if not eager — to talk
about what they’re working on in a public forum like Twitter. Read the full article. [InfoWorld]
Organized cyber thieves stole more than $100,000 from a small credit
union who serves U.S. Treasury employees in Salt Lake City last week, in a brazen online robbery that
involved dozens of co-conspirators. Read the full article. [KrebsonSecurity]
Oil giant BP suffered further embarrassment after its
official Twitter account was hacked. Pranksters purloined the @BP_America Twitter account to write “Terry
is now in charge of operation Top Kill, work will recommence after we
find a XXL wetsuit. #bpcares #oilspill”. Read the full article. [The Register]
Federal authorities say they have cracked open a cybercrime gang that
allegedly duped tens of thousands of consumers into paying more than
$100 million for worthless antivirus protection, priced from $30 to $70.
A Chicago grand jury returned an indictment against Bjorn Daniel Sundin, 31, a U.S. citizen believed
to be living in the Ukraine; Shaileshkumar P. Jain, 40, a Swedish
citizen believed to be living in Sweden; and James Reno, 26, of Amelia,
Ohio. Read the full article. [The Last Watchdog]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
