(China)
(Japan)
(Korea)Threatpost for B2B
Dropbox Users Reporting More Spam Following Last Summer’s Breach
It appears the breach of cloud-based storage service Dropbox last year has spurned another wave of spam over the last week or so. Users began posting complaints on the service’s Bugs and Troubleshooting forum yesterday claiming that their Dropbox-specific accounts started receiving spam again last weekend.
The Java Zero-Day Procession Continues
After a glorious 72-hour stretch without one, security researchers confirmed yesterday that they found yet another zero-day vulnerability in Oracle’s thoroughly troubled Java platform.
China Publicly Claims to Be the Victim of U.S. Cyberattacks
On Thursday the Chinese government, long considered the aggressor in highly publicized U.S. cyberattacks, publicly spoke about being the victim. Two of its military Web sites were attacked an average of 144,000 per month and two-thirds of those strikes came from the United States, according to a ministry spokesman.
How Much Does A Botnet Cost?
The cost of a botnet is contingent largely upon the physical location of the malware-infected computers inside of it. Therefore, a botnet containing only American or European machines is worth more than one with machines from less prosperous nations.
CPOs Challenged with Meeting Privacy Expectations and Maintaining Full User Experience
SAN FRANCISCO – People who interact with online services have mounting privacy expectations that run in parallel with their need for a full experience with the functionality central to those services. But can users have their privacy cake and eat it too?
Software Security Programs May Not Be Worth the Investment for Many Companies
SAN FRANCISCO--The discipline of software security has been gaining traction in a lot of organizations both large and small in recent years, thanks in part to the success that vendors such as Microsoft, Adobe and others have had with it. However, for many companies, the time and money spent on software security initiatives could be put to better use simply fixing flaws after products ship or are deployed, an expert said during a constructed debate.
Anti-Tibetan Attack Stems from Nvidia Abuse, Old RTF Vulnerability
A series of targeted attacks are continuing to bully a signed Nvidia application into dropping a backdoor that lets attackers root their way through the systems of Tibetan sympathizers.
MiniDuke Espionage Malware Hits Governments in Europe Using Adobe Exploits
New espionage malware has been discovered that targets a patched sandbox-bypass vulnerability in Adobe Reader. The attacks have hit a relatively small number of government victims in 23 countries, primarily in Europe, and rely on a string of unusual tactics, including the use of steganography to hide backdoor code, as well as the capability to reach out to Twitter accounts created by the attackers for links to command and control servers.
Researchers Find Stuxnet Older Than Previously Believed
Latest Kelihos Botnet Shut Down Live at RSA Conference 2013
Adobe Patches Two Critical Flash Player Vulnerabilities
Adobe released yet another security update for its Flash Player product, it’s third this month, earlier today. The emergency update patches three vulnerabilities, including two critical (CVE-2013-0643 and CVE-2013-0648) that are targeting Flash Player in Mozilla’s Firefox browser and could let an attacker crash and compromise affected systems.
RSA Conference 2013: Experts Say It's Time to Prepare for a 'Post-Crypto' World
SAN FRANCISCO--In the current climate of continuous attacks and intrusions by APT crews, government-sponsored groups and others organizations, cryptography is becoming less and less important and defenders need to start thinking about new ways to protect data on systems that they assume are compromised, one of the fathers of public-key cryptography said Tuesday. Adi Shamir, who helped design the original RSA algorithm, said that security experts should be preparing for a "post-cryptography" world.
cPanel Support Server Compromised
Website hosting provider cPanel is calling on some users to change their passwords after it informed them on Friday that hackers compromised one of its technical support department’s servers. The hosting provider does not know for certain the extent of the hack or what, if any, information was stolen during the compromise.
Facebook Patches OAuth Authentication Vulnerability
Social media supersite Facebook has fixed a vulnerability that could have allowed a hacker to access a user’s account simply by getting them to click through to a specially crafted website. The flaw essentially mimicked the functionality of an authentic Facebook application without actually installing an application to their profile.
'Six Strikes' System Flags P2P Piracy and Throttles Broadband Connections
The entertainment industry is teaming with five major Internet service providers to this week launch a new Copyright Alert System that will first warn online pirates and then start to strangle bandwidth of repeat offenders.
Dubbed "Six Strikes," the new system began roll out Monday, putting consumers on notice that content owners would be monitoring for illegal downloading or uploading of copyrighted movies, music and televsion shows and notifying participating ISPs such actvitity is detected.
Researchers Bypass Google Two-Factor Authentication
For some time, attackers had the ability to bypass Google's two-step authentication system through access to users' app-specific passwords, giving them full access to victims' Google accounts, including Gmail. The vulnerability that enables this attack, discovered by researchers from DuoSecurity, has been patched by Google.
Two More Java Zero Days Found by Polish Research Team
The seemingly endless list of critical zero day bugs found in Java grew longer today with news that one of the flaws fixed in Oracle’s recent patches for the product is under attack and when that bug is paired with another, separate vulnerability, the sandbox in the latest build of Java can be bypassed.
Anup Ghosh on Cyberespionage, Attribution and APTs
Dennis Fisher talks with Anup Ghosh of Invincea about the recent wave of companies admitting to being hacked by APT groups, the difference between cyberespionage and cyberwar, what the government can do to encourage more intelligence sharing and whether compromised companies are spending enough time on attribution.
You are missing some Flash content that should appear here! Perhaps your browser cannot display it, or maybe it did not initialize correctly.
Another iPhone Passcode Bypass Vulnerability Discovered
It’s getting hard to keep track of all the bugs piling up for Apple’s iPhone. Now it seems a glitch in the iOS kernel of Apple’s much maligned iOS 6.1 is responsible for yet another passcode bypass vulnerability, the second to surface this month. Attackers can apparently access users' photos, contacts and more by following a series of steps on an iPhone running iOS 6.1.
HTC Settlement Could Alter Mobile Security and Privacy Landscape
HTC America’s settlement with the U.S. Federal Trade Commission on Friday has the potential to revamp not only how hardware manufacturers handle the security and privacy of mobile devices, but how carriers do so, as well.
