The Register’s Dan Goodin has news about a belated but significant move by Google to protect its GMail and other services from CSRF (cross site request forgery) attacks.
In recent days, Google’s login pages began setting a cookie with a unique token on each user’s browser. That same value is also embedded into the login form. If the two don’t match, the user will be unable to log in. Read the full article [theregister.co.uk]
Mozilla has released a preview build of Firefox that includes its new Content Security Policy specification, a framework that’s designed to enable site owners to protect against common Web-based attacks.
The rash of attacks on social networking sites is continuing, this time in the form of a cross-site scripting worm that is currently plaguing Reddit, the popular social bookmarking portal. The Reddit attack is interesting in that it requires a minimum of user interaction in order to spread.
On the heels of yet another Twitter phishing attack, Threatpost editor Ryan Naraine chats with Kaspersky Lab malware researcher Costin Raiu about a new "Krab Krawler" project that pinpoints signs of malicious activity on Twitter. Raiu introduced the project at this year’s Virus Bulletin conference. View the VB presentation here.
At the Virus Bulletin 2009 conference,Trend Micro security researcher Ivan Macalintal talks to Threatpost editor Ryan Naraine about the intricacies of the Koobface attack. See more on this story here.
GENEVA — The attacks and scams that have been affecting users of Facebook, Twitter and other popular social networking sites are continuing to evolve and improve, as the attackers learn more about their victims and refine their tactics, experts say.
Digital Underground podcast with Dennis Fisher
Dennis Fisher talks with Stefan Tanase, senior security researcher at Kaspersky Lab, live from Virus Bulletin 2009 about the threats on social networking sites and the privacy and security concerns presented by Web 2.0 technologies. Here are the slides from Tanase’s presentation.
An ongoing attack on Google users is sending victims to rogue anti-virus software sites, researchers said this week.
The attack takes advantage of Google’s page-ranking feature, according to researchers at eSoft’s Threat Prevention Team. The scam works like this: An attacker hacks a site, but instead of embedding exploits on the hacked site, they put links to other websites to boost rankings for malicious sites, and Google users in particular seem to be the targets. Read the full story [scmagazineus.com]
Security researchers are reporting on an ongoing scareware serving campaign abusing the popular micro-blogging service Twitter.
Hundreds of tweets using four different URL shortening services are currently spammed through the automatically registered Twitter accounts, relying on a pseudo-random text generation using Twitter’s trending topics. Read the full story [zdnet.com]
From PC Mag (Larry Seltzer)
Just when we were getting the point across that you need to be careful about what links you click on, along comes the new phenomenon of shortened links through redirection services, making it that much harder to be careful. There are products and services that can help though.
The success of these services has been driven mostly by Twitter, whose 140 character limit on posts makes it important for links to be as short as possible. The fact remains that when you click on a shortened link you don’t know where you will end up. Read the full story [pcmag.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
