The Nine-Ball Exploit Exposed
In this video, researcher Andrew Martin walks through an attack on a Web site involving the Nine-Ball exploit, which has been used to compromise tens of thousands of legitimate Web sites in the last few months.
Web Security
DEFCON: CSRF Attacks Made Easy
LAS VEGAS — The security of social networking sites isn’t as bad as you think. In fact, it’s much worse.
Sites such as Twitter, Facebook and others that rely heavily on user-generated content, shared content and aggregation have been the targets of increasingly sophisticated attacks over the last few months, and if the problems discussed in a presentation at the DEFCON hacker conference here Saturday are any indication, this is only the beginning.
New Flaw in Firefox Could Enable Phishing Attacks
There is a new vulnerability in Firefox that enables an attacker to open a new tab in a victim’s browser with a spoofed URL. The vulnerability is found in all current versions of Firefox and Mozilla does not have a patch for the problem yet.
From Viruslist.com (Yury Namestnikov)
In the past ten years, botnets have evolved from small networks of a dozen PCs controlled from a single C&C (command and control center) into sophisticated distributed systems comprising millions of computers with decentralized control. Why are these enormous zombie networks created? The answer can be given in a single word: money.
A botnet, or zombie network, is a network of computers infected with a malicious program that allows cybercriminals to control the infected machines remotely without the users’ knowledge. So how does one start? What does a cybercriminal in need of a botnet do? There are many possibilities, depending on the criminal’s skills. Unfortunately, those who decide to set up a botnet from scratch will have no difficulty finding instructions on the Internet. Read the full paper (viruslist.com)
Kun Liu from IBM Research discusses the potential for developing privacy-aware social networking applications through the measurement and monitoring of privacy risks.
Earlier this week, I wrote about a “highly critical” — and unpatched — vulnerability that puts millions of Web surfers at risk of malicious hacker attacks.
Since then, there has been word that the release of the vulnerability and exploit was “self-inflicted” (Mozilla exposed the bug themselves) and official instructions on how to mitigate the risks until a patch is ready.
From Google Online Security Blog (Macduff Hughes)
There’s been some discussion today about the security of online accounts, so we wanted to share our perspective. These are topics that we take very seriously because we know how important they are to our users. We run our own business on Google Apps, and we’re highly invested in providing a high level of security in our products. While we can’t discuss individual user or customer cases, we thought we’d try to clear up any confusion by taking some time to explain how account recovery works with various types of Google accounts and by revisiting some tips on how users can help keep their account data secure. Read the full story [Google Online Security Blog].
From Bits (Claire Cain Miller and Brad Stone)
Twitter, which is generally quite private about its business plans, has fallen prey to an attack by a hacker who has apparently exposed confidential corporate information.
The hacker claims to have private documents including confidential contracts with Nokia, Samsung, Dell, AOL and Microsoft; the resumes of people who have applied to work at Twitter; personal information about Twitter employees including credit card numbers; future business plans; and floor plans and security codes for Twitter’s offices. Read the full story [NYTimes.com].
From eWEEK (Chris De Herrera)
One of the major challenges CIOs face is the deployment and security of smartphones in the enterprise. It’s important for CIOs to assess how their organization should secure the smartphones employees use to access corporate resources. Here, Knowledge Center contributor Chris De Herrera explains how CIOs can deal with some common security concerns regarding smartphones deployed in the enterprise, including Apple iPhone, RIM BlackBerry, Windows Mobile, Google Android and Palm Pre devices. Read the full story [eweek.com]
Threatpost editors Dennis Fisher and Ryan Naraine discuss the recent vulnerabilities in ActiveX controls, Microsoft’s slow response to the video control flaw and the slew of DDoS attacks against U.S. government and commercial sites.
