(China)
(Japan)
(Korea)Threatpost for B2B
Apple iOS 6.1.3 Fixes Evasion Jailbreak Bug, WebKit Flaw
Apple has patched a handful of security vulnerabilities in iOS, including a bug that was used for the latest iPhone jailbreak tool, called Evasion. Apple iOS 6.1.3 has patches for six vulnerabilities, including the screen lock bypass bug and a flaw in WebKit that can be used to execute arbitrary code.
Attacks on SCADA, ICS Honeypots Modified Critical Operations
With antiquated gear running the country’s industrial control systems that oversee critical infrastructure, it’s no shock attackers targeting SCADA networks do their fair share of reconnaissance looking for weak spots in that equipment.
T-Mobile Wi-Fi Calling Feature Susceptible to Man-in-the-Middle Snooping
The default “Wi-Fi Calling” feature on T-Mobile devices that lets milllions of Android users make phone calls over a wireless Internet connection contains a vulnerability that could be exploited to perform man-in-the-middle (MiTM) attacks.
Ruby on Rails Patches DoS, XSS Vulnerabilities
The developers of Ruby on Rails, the popular web app framework, released four new versions of the product yesterday, complete with fixes for a series of vulnerabilities that could have lead to denial of service attacks and XSS injections.
Four vulnerabilities in total are addressed in versions 3.2.13, 3.1.12 and 2.3.18 of Rails, according to a post to the company’s blog on Monday. “All versions are impacted by one or more of these security issues,” according to the post.
Google Serves Up a Half Slice of Pwnium Cash for Pinkie Pie
Depending upon your perspective, the third iteration of Google Pwnium at this year's CanSecWest conference was either a mild failure or a huge success. No researchers were able to come up with a full compromise of the Chrome OS, the target in this year's contest, but Google said this week that it did receive a partial qualifying entry from one researcher and awarded him $40,000 for his efforts.
Using Kernel Exploits to Bypass Sandboxes for Fun and Profit
GAO: Flaws in IRS Network Could Put Taxpayer Information in Jeopardy
How To: Chrome Browser Privacy Settings
The Web browser is the primary portal through which the vast majority of connected users access and interact with the Internet. Each browser has its own security and privacy settings and those settings have an enormous impact on the nature of the relationship between users’ data and the services they encounter online. Google’s Chrome browser has extensive, easy to navigate privacy settings that let users manage everything from digital certificates to location tracking to “Do Not Track” requests.
Flaw Leaves EA Origin Platform Users Open to Attack
Five years ago, a pair of security researchers write a book called Exploiting Online Games in which they described a number of ways in which attackers could take advantage of weaknesses in the protection systems for various gaming platforms. Now, with online gaming having emerged as a massive business, other researchers have picked up the ball and begun finding serious flaws. The latest vulnerability to be disclosed is in EA's Origin online game-delivery system, which researchers from ReVuln have shown can be exploited remotely to run malicious code on users' machines.
Third-Party Applications to Blame for 87 Percent of Vulnerabilities Last Year
Third-party applications accounted for a whopping percentage of vulnerabilities last year, many more than security flaws found in Microsoft programs according to a report released this week by Danish vulnerability research firm Secunia.
Ramnit Malware Back and Better at Avoiding Detection
The Ramnit malware family has been given a facelift with new anti-detection capabilities, a troubleshooting module, as well as enhanced encryption and malicious payloads.
Apple Fixes OS X Flaw That Allowed Java Apps to Run With Plugin Disabled
Apple on Thursday released a large batch of security fixes for its OS X operating system, one of which patches a flaw that allowed Java Web Start applications to run even when users had Java disabled in the browser. OS X 10.8.3 fixes 21 total vulnerabilities, and also includes a new version of the malware removal tool for Apple machines.
Reuters Editor Indicted for Helping Hackers Break Into Tribune Co.
A Reuters social media editor on Thursday was charged with helping hackers break into the Tribune Co.'s network shortly after he was fired from a Sacramento television station in Fall 2010.
A U.S. Eastern District grand jury in Sacramento handed down a three-count indictment against Matthew Keys, 26, of Secaucas, N.J., for conspiracy to transmit information to damage a protected computer and transmitting or attempting to transmit that information. The combined counts carry a potential penalty of 25 years' imprisonment and $750,000 in fines.
Reuters Editor Indicted for Allegedly Helping Hackers Break Into Tribune Co.
UPDATE -- One of Matthew Keys' lawyers told The Huffington Post on Friday that his client was working as an "undercover" journalist when he engaged members of Anonymous in an IRC channel offering login credentials for Tribune Co. servers.
Keys, 26, of Secaucas, N.J., was suspended with pay from Reuters news service on Thursday after the social media editor was charged with helping hackers break into the Tribune Co.'s network shortly after he was fired from a Sacramento television station in Fall 2010.
Attack Exploits Weakness in RC4 Cipher to Decrypt User Sessions
It's been more than 25 years since Ron Rivest invented his RC4 stream cipher, and after all that time it's still being used widely, which is something of an achievement in the crypto world. However, for more than 15 years researchers have known about a weakness in RC4 that could enable an attacker to decrypt the keystream. Now, a cryptographer has published an attack that exploits that vulnerability and causes serious problems with TLS implementations.
Malware Discovery Forces National Vulnerability Database Offline
The website of the National Vulnerability Database (NVD) remains down today, six days after malware was reportedly found on its servers.
Google Removing Ad-Blocking Apps From Play Android Market
Google, which has been a favorite target of privacy advocates for the last few years, has taken another step that's unlikely to endear the company to that crowd or Android users. The company has begun removing ad-blocking apps from the Google Play Android app market, apparently for violating the terms of service.
NSA Director Alexander: US Building Cyberattack Teams
More rhetoric is coming out of Washington regarding the use of malware as an auxiliary weapon to bombs and bullets. National Security Agency leader Gen. Keith Alexander told a House Armed Services Committee yesterday that his new Cyber Command will be ready to retaliate should the United States critical infrastructure come under cyberattack.
Top Credit Agencies Admit Celebrities' Data Stolen
The top credit bureaus have admitted someone accessed prominent Americans' private data by filling out bogus requests via a Web site used by millions of consumers to access free annual credit reports.
