Twitter-based Botnet, Obama and Cybersecurity and a New Linux Kernel Flaw
Threatpost editors Ryan Naraine and Dennis Fisher discuss the botnet being controlled through Twitter, Obama and cybersecurity, as well as the new Linux kernel flaw.
Web Security
Apple plugs Safari code execution holes
Apple has released Safari 4.0.3 to fix at least six security vulnerabilities that put Mac and Windows users at risk of hacker attacks.
The update is considered highly-critical and should be immediately applied on both Windows and Mac systems because of the risk of information disclosure, phishing and remote code execution attacks. See Apple’s advisory for details [apple.com]
Microsoft IE 8 Shines in Web Browser Security Test
From Network World (Ellen Messmer)
Microsoft’s Internet Explorer 8 rated tops among five browsers tested by NSS Labs for effectiveness in protecting against malware and phishing attacks — though NSS Labs acknowledges Microsoft paid for the tests.
Nevertheless, the test process, which lasted over a two-week period in July at the NSS Labs in Austin, evaluated the browsers based on access to live Internet sites and in theory could be duplicated elsewhere. Apple Safari 4, Google Chrome 2, Mozilla Firefox 3, and Opera 10 beta were evaluated as being behind Microsoft IE 8 when it comes to browser protection against phishing and malware, mainly because Microsoft was deemed more speedy and comprehensive in delivering updates about known phishing and malware to the user’s desktop browser. Read the full story [thestandard.com] Here’s a link to the study and results [pdf from nsslabs.com]
As smartphones become even smarter, they are going to attract more and more attention from attackers, spammers and others looking to take control of the billions of mobile devices in use today, the head of Google’s Android security team said. In a talk at the USENIX Security symposium Wednesday, Rich Cannings acknowledged the danger that malware and other security threats pose to Android phones as well as other smartphones, Computerworld reports.
This short video demonstration shows a new technique for exploiting a flaw in Apple Safari 4 that enables an attacker to hijack the Top Sites feature in Safari and replace the victim’s Top Sites with phishing sites. The vulnerability and attack were discovered by Inferno.
By Roel Schouwenberg
On Tuesday we got another DDoS attack on Twitter. A lot of people are asking why Twitter doesn’t seem to be coping with attacks like these. And at the same time there are more and more people jumping on the bandwagon saying stay away from Adobe products.
Threatpost editors Ryan Naraine and Dennis Fisher discuss the DDoS
attacks against Twitter, Facebook and LiveJournal and delve into
Apple’s Mac OS X patch and Microsoft’s Patch Tuesday plans.
By Stefan Tanase
There are a lot of theories flying around about why Twitter and other
social media services got knocked offline yesterday. I’ve heard rumors
about it being linked to political tension between Georgia and Russia.
Others blame Iran for the outages.
Twitter was the target of a sustained denial-of-service attack Thursday morning, an attack that took the site offline for several hours. Twitter’s service went down around 9 a.m. EDT and was back up around noon, while Facebook’s site also experienced problems that may have been the result of a DoS attack.
From Washington Post (Brian Krebs)
Security researchers today unveiled details about a little-known but ubiquitous class of vulnerabilities that may reside in a range of Internet components, from Web applications to mobile and cloud computing platforms to documents, images and instant messaging products. At issue are problems with the way many hardware and software makers handle data from an open standard called XML. Read the full story [washingtonpost.com].
