Nate Lawson on Crypto Flaws, Web Application Security and Selling Hardware Bugs
Dennis Fisher talks with Nate Lawson of Root Labs about the proliferation of crypto flaws in Web applications and the market for hardware security bugs.
Web Security
Social networking attacks target enterprise data
By Alex Rothacker, Team SHATTER
It seems as though the latest rash of threats and attacks all have a familiar ring to them: they’re all aimed at social networking sites like Twitter and Facebook, which is interesting, because smart attackers will use whatever means possible to get to the stuff that really counts – enterprise data.
Threatpost News Wrap #4: Crypto libraries, cybersecurity czar job
Threatpost editors Ryan Naraine and Dennis Fisher talk about the problems with developers implementing their own crypto libraries in Web applications, the short list of names for the cybersecurity czar job and the possibility of a full-scale hacker bracket competition.
From ZDNet (Dancho Danchev)
Researchers from ParetoLogic are reporting on a newly discovered Mac OS X malware variant posing as fake video ActiveX object [paretologic.com] found at a bogus Macintosh PortTube site.
The use of fake video codecs is a social engineering tactic exclusively used by malware targeting Windows, and seeing it used in a Mac OS X based malware attack proves that successful social engineering approaches remain OS independent. Read the full story [zdnet.com]
Patch management has become, in the words of one bleary-eyed IT guy, “just freaking ridiculous.”
Here’s a look at what this IT guy, whose primary role is managing risk at a medium-sized business, was up against in the last two weeks:
From ZDNet (Dancho Danchev)
A currently ongoing malware attack across Twitter is abusing the momentum offered by Twitter’s trending topics in order to trick users into visiting bogus exclusive video sites and infect them with malware.
The campaign, spreading since last week, is relying on a growing number of automatically registered bogus Twitter accounts, which combine trending topics and hashtags with custom messages and pre-defined Tinyurl links, all leading to identical fake codec which is droping three different malware samples. Read the full story [zdnet.com]
One of the few things that most people in the security community seem to agree on is that there is a dire need for better security around Web applications. That need begins with the lack of security training for most Web developers and extends through the inconsistent use of Web-application testing, both pre-deployment and post-deployment. But one issue that has been overlooked for years probably belongs at the top of the list of Web application security woes: the haphazard use of cryptography.
Researchers at the University of California, Berkeley’s School of Information has released a report showing that the most popular Web sites in the United States all share data with their corporate affiliates and allow third parties to collect information directly by using tracking beacons known as “Web bugs” – despite the sites’ claims that they don’t share user data with third parties. Read the announcement [berkeley.edu]. Download the full report [knowprivacy.org].
Adobe’s first ever quarterly patch for the Reader and Acrobat product lines is set for June 9, the same day Microsoft is scheduled to deliver its batch of security updates.
As previously announced, Adobe plans to deliver security updates for Adobe Reader and Acrobat versions 7.x, 8.x, and 9.x for Windows and Macintosh on Tuesday, June 9.
Threatpost editors Ryan Naraine and Dennis Fisher look at the latest security news headlines and dig deeper into the latest wave of drive-by download infections and scareware attacks on Twitter.
