Mozilla is disabling older versions of the Java Deployment Toolkit plugin for Firefox users, in a bid to block attacks against a newly-discovered Java security hole that attackers have been exploiting of late to install malicious code. Read the full article. [KrebsonSecurity]
Targeted attacks might be tough to prevent, but
what if you could fight back against the attacker once he’s infiltrated
your network? A researcher has come up with a proof-of-concept (PoC)
that does just that by finding vulnerabilities in the attacker’s malware
and using it against him. Read the full article. [Dark Reading]
Amazon.com administrators closed a security vulnerability
that made it possible for attackers to steal user login credentials for
the highly trafficked e-commerce website. Read the full article. [The Register]
Two Belarusian nationals suspected of operating a rent-a-fraudster
service for bank and identity thieves have been arrested overseas,
according to New York authorities, who unsealed an indictment for one of
the suspects. Read the full article. [Wired]
On the heels of a Black Hat EU presentation that exposed security problems with the cross-site scripting (XSS) filter in Internet Explorer 8, Microsoft plans to ship an update to the filter to fix what is hopefully the last remaining attack scenario.
The New York Times is reporting that Google’s password system was compromised during a targeted attack last December.The system, called Gaia or Single Sign-On, controls access by millions of users worldwide to almost all of the company’s Web services, including e-mail and business applications.
A week after Web hosting company Network Solutions dealt with a
large-scale infection of WordPress-driven blogs, the company
acknowledged that other sites it hosts have been compromised. Read the full article. [Computerworld]
Security researchers at the Intrepidus Group have hacked into Palm’s new WebOS platform, using nothing more than text messages to exploit a slew of dangerous web app vulnerabilities.
Miscreants have created a Trojan that poses as a Google Chrome
extension. Spammed messages attempt to dupe prospective marks into trying an
add-on that “helps you better organise your documents received in your
email”. Read the full article. [The Register]
The non-profit Open Web Application Security Project (OWASP) has released its latest list of top 10 web application security risks. Read the release statment. [OWASP.org]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
