Threatpost for B2B

Syndicate content
The First Stop For Security News
Updated: 13 hours 29 min ago

Spat Leads to Partial Leak of Rig Exploit Kit

Fri, 02/13/2015 - 11:12
A reseller of the Rig Exploit Kit has leaked some of the source code behind the pack after parting ways with the kit's developer. Experts don't expect a spike in Rig-based attacks.

Lack of CSPRNG Threatens WordPress Sites

Thu, 02/12/2015 - 12:47
WordPress has become a huge target for attackers and vulnerability researchers, and with good reason. The software runs a large fraction of the sites on the Internet and serious vulnerabilities in the platform have not been hard to come by lately. But there’s now a new bug that’s been disclosed in all versions of WordPress that […]

Patched Windows Kernel-Mode Driver Flaw Exploitable With One Bit Change

Thu, 02/12/2015 - 12:28
Details have been disclosed on a Windows kernel-mode driver privilege escalation vulnerability that was patched Tuesday by Microsoft.

Ryan Naraine on SAS 2015

Thu, 02/12/2015 - 10:10
Dennis Fisher talks with Ryan Naraine, the long lost co-founder of Threatpost, about the upcoming Kaspersky Security Analyst Summit in Cancun and how much the conference has grown in the last few years.

Chinese Hackers Compromised Forbes.com Using IE, Flash Zero Days

Wed, 02/11/2015 - 17:07
A Chinese APT group has been linked to a watering hole attack on Forbes.com used to target defense and financial targets.

Mozilla to Enforce Signing for Firefox Extensions Soon

Wed, 02/11/2015 - 16:09
In an effort to head off the problem of malicious or misbehaving browser add-ons, Mozilla is planning to require developers to have their Firefox extensions signed by the company in the near future. As much of users’ computing has moved into their browsers in the last few years, extensions and add-ons have become important tools. […]

Facebook ThreatExchange Platform Latest Hope for Information Sharing

Wed, 02/11/2015 - 14:52
Facebook announced ThreatExchange, an API-based platform for the exchange of attack and threat data.

Microsoft Group Policy Vulnerability Affects All Windows Computers

Wed, 02/11/2015 - 14:13
Details were released on two Microsoft Group Policy vulnerabilities affecting all Windows machines going back to Windows Server 2003. The flaws were addressed in separate Patch Tuesday security bulletins.

Google Play Bug Can Allow Code Execution

Wed, 02/11/2015 - 14:05
Using a combination of vulnerabilities in the Google Play store and the Android stock browser, attackers can install malicious apps remotely on some Android devices. The attack is the result of a failure on the part of Google’s Play Store Web application to completely enforce the X-Frame-Options header, a common defense against clickjacking and other […]

Monster IE Update Top Patch Tuesday Priority

Tue, 02/10/2015 - 16:52
Microsoft released its February 2015 Patch Tuesday security bulletins, including a massive update for Internet Explorer and a patch for a Windows zero day disclosed by Google.

New Cyber Threat Center May Face Challenges

Tue, 02/10/2015 - 15:16
In the wake of news-making attacks on Sony Pictures, Home Depot and many others, the federal government is establishing a new information integration center to focus on cyber threats.

Researcher Tries to Get Ahead of CFAA Changes, Dumps 10M Sanitized Passwords

Tue, 02/10/2015 - 12:37
A dump of 10 million sanitized usernames and passwords was released online, sparking debate over its legality in light of proposed changes to the Computer Fraud and Abuse Act.

Markey Car Security Report Just the Start for Automakers

Tue, 02/10/2015 - 12:17
It turns out that computers and, by extension, things that contain computers, are vulnerable to attackers. That includes cars, something that the United States government has now discovered, and Sen. Edward Markey is now warning consumers that "automakers haven't done their part to protect us from cyber-attacks or privacy invasions."

Creaking Patch Tuesday’s Viability Rests with Quality, Speed

Tue, 02/10/2015 - 10:00
Patch Tuesday provides Windows IT shops with a cadence to their patch management efforts, but evolving threats and internal changes at Microsoft raise questions about its long-term viability.

PlugX, Go-To Malware for Targeted Attacks, More Prominent Than Ever

Tue, 02/10/2015 - 10:00
The popular remote access tool PlugX enjoyed an ascent in popularity in 2014 and is now a go-to malware for attack groups.

Intuit Suspends Turbo Tax e-Filing, Investigating Fraudulent Returns

Mon, 02/09/2015 - 14:23
Intuit last week temporarily suspended its Turbo Tax e-filing service following an increase in fraudulently filed state tax returns.

Cryptowall 3.0 Slims Down, Removes Exploits From Dropper

Mon, 02/09/2015 - 13:00
Research from Cisco on Cryptowall 3.0 ransomware shows that exploits have been removed from the dropper, indicating that the group behind it will rely instead on exploit kits.

Government Requests for Twitter User Data Continue to Grow

Mon, 02/09/2015 - 12:16
The appetite for Twitter user data from governments around the world continues to grow, with the volume of such requests increasing by 40 percent in the second half of 2014.

Siemens Fixes Critical Flaws in Some WinCC Versions

Mon, 02/09/2015 - 09:20
More than two months after the original advisory went out, Siemens has released patches for a pair of critical vulnerabilities in some versions of its Simatic WinCC SCADA product that remained vulnerable. Both of the vulnerabilities are remotely exploitable and have potentially damaging consequences for companies running affected versions of the product. One of the […]