From Zero Day (Ryan Naraine)
Apple has released Safari 4.0.2 to fix a pair of security flaws that could lead to cross-site scripting or remote code execution attacks. The vulnerabilities affect Safari for Windows (XP and Vista) and Mac OS X. Read the full story [ZDNet].
Mark Dowd and Ben Hawkes, two well-known security researchers, have won a contest put on by Google to find exploitable security flaws in the company’s Native Client system. The pair discovered 12 exploitable issues, seven more than the next most successful team.
By Byron Acohido, The Last Watchdog
No one in the tech security world is surprised that criminal exploitation of Twitter has commenced in earnest, as I’ve written in this story on page 1B of Monday’s edition of USA TODAY. Coding and social engineering techniques that spammers and malware purveyors have been refining and perfecting in the email realm over the past several years couldn’t mesh more smoothly into the world of social network messaging. And Twitter — the über popular Web 2.0 service that media companies can’t seem to hype enough — has presented cyber fraudsters with the attack vector of their dreams.
By Stefan Tanase, Kaspersky Lab, Romania
In June, we saw an explosive rise in the number of Koobface modifications – the number of variants we detected jumped from 324 at the end of May to nearly 1000 by the end of June. And this weekend brought another flood, bringing us up to 1049 at the time of writing.
From SANS AppSec Street Fighter Blog (Jason Montgomery)
I just ran across Jakob Nielsen’s Alert Box post titled Stop Password Masking and wanted to provide some feedback from a security vs. usability perspective. I have great respect for Nielsen’s contribution to the usability of the web. Back in the early days of the internet (mid 1990’s), his books were gospel at my consulting firm, ATGi.
My initial reaction to his article was ‘that’s a crazy idea’ – but after some reflection, I really felt like it was a good mental exercise to actually consider what he was saying. If I hadn’t known who Nielson was, I probably would have dismissed his suggestion outright. Sometimes it is a good exercise to go back and review why we do the things we do – especially as it relates to information security controls. Nielsen questions the real security benefit of password masking – something I haven’t given a second thought to…well, ever. Read the full story [SANS].
From The New York Times (Riva Richmond)
Facebook launched a beta test today that foreshadows new privacy controls coming to “Publisher” – the box at the top of your home and profile pages where you add content. The changes will let you easily specify who among your friends gets to see that specific photo, video or status update you’re sharing. Read the full story [nytimes.com]
From SearchSecurity
Network security researcher Dan Kaminsky has had a year to reflect on the impact of the cache poisoning vulnerability he discovered in the Domain Name System (DNS). Kaminsky revealed during last year’s Black Hat Briefings a technique that made it relatively easy to exploit the bug and enable an attacker to redirect website requests to malicious sites. In the time since, Kaminsky has become an advocate for improving security in DNS, and ultimately, trust on the Internet. In this interview, Kaminsky talks about how the implementation of DNSSEC would enable greater security and trust on the Net and provide a platform for the development of new security products and services. Read the full interview [techtarget.com]
From IDG News Service (Robert McMillan)
Former Apple Macintosh evangelist Guy Kawasaki posts Twitter messages about a lot of different thing, but the message he put up Tuesday was really out of character: “Leighton Meester sex tape video free download!”
His message included a link that, after some further clicking, landed Kawasaki’s followers on a fake porn site where online criminals try to install a nasty Trojan horse program on victim’s computers. And in an interesting twist, the program attacks both Mac and Windows users. Read the full story [computerworld.com]
Google has released a new version of its Chrome browser, which includes a fix for a serious buffer overflow vulnerability. The vulnerability in Chrome lies in the way that the browser handles certain responses from HTTP servers.
Mozilla’s security engineers are working on new technology that promises to mitigate a large class of Web application vulnerabilities, especially the cross-site scripting (XSS) plague against modern Web browsers.
The project, called Content Security Policy, is designed to shut down XSS attacks by providing a mechanism for sites to explicitly tell the browser which content is legitimate. It can also help mitigate clickjacking and packet sniffing attacks. Read the full story [zdnet.com] Also see Mozilla’s explanation of the technology [mozilla.org]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
