(China)
(Japan)
(Korea)Threatpost for B2B
Google Serves Up a Half Slice of Pwnium Cash for Pinkie Pie
Depending upon your perspective, the third iteration of Google Pwnium at this year's CanSecWest conference was either a mild failure or a huge success. No researchers were able to come up with a full compromise of the Chrome OS, the target in this year's contest, but Google said this week that it did receive a partial qualifying entry from one researcher and awarded him $40,000 for his efforts.
Using Kernel Exploits to Bypass Sandboxes for Fun and Profit
GAO: Flaws in IRS Network Could Put Taxpayer Information in Jeopardy
How To: Chrome Browser Privacy Settings
The Web browser is the primary portal through which the vast majority of connected users access and interact with the Internet. Each browser has its own security and privacy settings and those settings have an enormous impact on the nature of the relationship between users’ data and the services they encounter online. Google’s Chrome browser has extensive, easy to navigate privacy settings that let users manage everything from digital certificates to location tracking to “Do Not Track” requests.
Flaw Leaves EA Origin Platform Users Open to Attack
Five years ago, a pair of security researchers write a book called Exploiting Online Games in which they described a number of ways in which attackers could take advantage of weaknesses in the protection systems for various gaming platforms. Now, with online gaming having emerged as a massive business, other researchers have picked up the ball and begun finding serious flaws. The latest vulnerability to be disclosed is in EA's Origin online game-delivery system, which researchers from ReVuln have shown can be exploited remotely to run malicious code on users' machines.
Third-Party Applications to Blame for 87 Percent of Vulnerabilities Last Year
Third-party applications accounted for a whopping percentage of vulnerabilities last year, many more than security flaws found in Microsoft programs according to a report released this week by Danish vulnerability research firm Secunia.
Ramnit Malware Back and Better at Avoiding Detection
The Ramnit malware family has been given a facelift with new anti-detection capabilities, a troubleshooting module, as well as enhanced encryption and malicious payloads.
Apple Fixes OS X Flaw That Allowed Java Apps to Run With Plugin Disabled
Apple on Thursday released a large batch of security fixes for its OS X operating system, one of which patches a flaw that allowed Java Web Start applications to run even when users had Java disabled in the browser. OS X 10.8.3 fixes 21 total vulnerabilities, and also includes a new version of the malware removal tool for Apple machines.
Reuters Editor Indicted for Helping Hackers Break Into Tribune Co.
A Reuters social media editor on Thursday was charged with helping hackers break into the Tribune Co.'s network shortly after he was fired from a Sacramento television station in Fall 2010.
A U.S. Eastern District grand jury in Sacramento handed down a three-count indictment against Matthew Keys, 26, of Secaucas, N.J., for conspiracy to transmit information to damage a protected computer and transmitting or attempting to transmit that information. The combined counts carry a potential penalty of 25 years' imprisonment and $750,000 in fines.
Reuters Editor Indicted for Allegedly Helping Hackers Break Into Tribune Co.
UPDATE -- One of Matthew Keys' lawyers told The Huffington Post on Friday that his client was working as an "undercover" journalist when he engaged members of Anonymous in an IRC channel offering login credentials for Tribune Co. servers.
Keys, 26, of Secaucas, N.J., was suspended with pay from Reuters news service on Thursday after the social media editor was charged with helping hackers break into the Tribune Co.'s network shortly after he was fired from a Sacramento television station in Fall 2010.
Attack Exploits Weakness in RC4 Cipher to Decrypt User Sessions
It's been more than 25 years since Ron Rivest invented his RC4 stream cipher, and after all that time it's still being used widely, which is something of an achievement in the crypto world. However, for more than 15 years researchers have known about a weakness in RC4 that could enable an attacker to decrypt the keystream. Now, a cryptographer has published an attack that exploits that vulnerability and causes serious problems with TLS implementations.
Malware Discovery Forces National Vulnerability Database Offline
The website of the National Vulnerability Database (NVD) remains down today, six days after malware was reportedly found on its servers.
Google Removing Ad-Blocking Apps From Play Android Market
Google, which has been a favorite target of privacy advocates for the last few years, has taken another step that's unlikely to endear the company to that crowd or Android users. The company has begun removing ad-blocking apps from the Google Play Android app market, apparently for violating the terms of service.
NSA Director Alexander: US Building Cyberattack Teams
More rhetoric is coming out of Washington regarding the use of malware as an auxiliary weapon to bombs and bullets. National Security Agency leader Gen. Keith Alexander told a House Armed Services Committee yesterday that his new Cyber Command will be ready to retaliate should the United States critical infrastructure come under cyberattack.
Top Credit Agencies Admit Celebrities' Data Stolen
The top credit bureaus have admitted someone accessed prominent Americans' private data by filling out bogus requests via a Web site used by millions of consumers to access free annual credit reports.
Google Debuts New Help for Hacked Sites Videos, Articles
Search giant Google has posted a set of new informational videos and articles to help website owners recover their sites after they’ve been hacked.
Google to Pay $7M Settlement Over Street View Data Collection
Google has agreed to pay a $7 million settlement to several dozen U.S. states as part of an agreement of charges that the company was collecting private user data from WiFi hotspots while its Street View cars were driving around taking photos in various locations.
The controversy over Google's data-gathering practices with its Street View cars has been going on for more than a year, since it was revealed that the cars were collecting information from private users' WiFi routers.
Israeli Government Websites Targeted in Watering Hole Attack
A new watering hole attack has been reported, this one targeting two government-related websites based in Israel that have been injected with malware exploiting a six-month-old vulnerability in Internet Explorer.
Apparel Company Files Landmark Lawsuit Against Visa in PCI Dispute
A Tennessee-based footwear and apparel company has filed a $13 million lawsuit against Visa for what it considers random, subjective penalties for being out of compliance with the Payment Card Industry (PCI) standard the credit card company regulates.
