(China)
(Japan)
(Korea)Feed aggregator
SCADA, ICS Bug Brokering Mirrors IT Vulnerability Market
SAN JUAN, Puerto Rico – The world of SCADA and industrial control system vulnerabilities is starting to mirror that of IT security, not only in the demonstration and exploitation of zero-day vulnerabilities, but in the brokering of flaws and exploits between hackers and organizations interested in buying research.
Chris Soghoian on Wireless Carriers and Android Security
Chris Soghoian of the ACLU discusses the looming crisis of mobile security caused by the failure of mobile carriers to push Android updates to users at the Kaspersky Lab Security Analyst Summit Monday.
Google Blocks High Profile Sites After Advertising Provider NetSeer is Hacked
Google Chrome users, among others, couldn't access some of the most popular Web sites Monday after an advertising network's corporate Web site was injected with malware. But, according to the ad company's chief executive, those sites were safe.
FTC Endorses New Privacy Guidelines, Do Not Track for Mobile Apps, Devices
Hoping to ramp up privacy on mobile devices such as smartphones and tablets, the Federal Trade Commission (FTC) has released a series of suggestions to help app developers, advertising networks and device companies better protect their users online.
Department of Energy Compromised in Sophisticated Attack
Hackers targeted and compromised computer networks at United States Department of Energy headquarters in Washington DC two weeks ago, according to a report published by the Washington Free Beacon earlier this morning.
Partial Disclosure Leaves Adobe Reader Zero-Day Story in Limbo
SAN JUAN, Puerto Rico – It’s the vulnerability that never was. Or was it?
Wireless Carriers Put on Notice About Providing Regular Android Security Updates
SAN JUAN, Puerto Rico -- Activist Chris Soghoian, whom in the past has targeted zero-day brokers with his work, has turned his attention toward wireless carriers and their reluctance to provide regular device updates to Android mobile devices.
How the RSA Attackers Swung and Missed at Lockheed Martin
SAN JUAN, PUERTO RICO--The attack that resulted in the compromise of RSA's SecurID database in 2011 had a lot of ramifications and sent shockwaves through much of the security industry. But it could have had much broader consequences had the security team at Lockheed Martin not discovered the same attack team on its own network and taken actions to shut them down.
Blog: New crimeware attacks LatAm bank users
Citadel Trojan: It’s Not Just for Banking Fraud Anymore
Banking malware has primarily been just that, an attack tool used against financial institutions to steal money from online bank accounts. But what if cybercrime gangs decided to flip that on its head, and use malware such as the Citadel banking Trojan to steal credentials from not only banks, but government agencies and commercial businesses?
Juniper’s Junos Could Open Routers to TCP Attacks
Some systems running older versions of Juniper Networks’ Junos OS software could be vulnerable to a transmission control protocol (TCP) flaw that can enable a hacker to crash and reboot certain routers.
Dotcom Offers €10,000 Reward For Breaking Mega's Crypto
Of all the problems that entrepreneur Kim Dotcom has faced in the last decade, including several arrests, insider trading charges and even a raid on his New Zealand home involving black helicopters and dozens of agents in body armor, the criticism of the cryptography employed by his new Mega cloud-storage service would seem to be fairly low on the list. However, Dotcom is taking that criticism rather personally, if the €10,000 reward he's offering to anyone who can break the service's crypto is any indication.
Blog: Mobile attacks!
Analysis: Kaspersky Lab report: Evaluating the threat level of software vulnerabilities
Yahoo Mail Breach Linked to Old Wordpress Vulnerability
Researchers at Australia-based BitDefender say they've found how some Yahoo Mail accounts are being hijacked, and it leads back to "buggy" blog software Yahoo's developers used.
Inside the Targeted Attack on The New York Times
The Chinese group behind the targeted attack on the New York Times was laser focused on accessing the email of a reporter and the newspaper’s former Beijing bureau chief to the point that it used an inordinate number of custom malware samples to get the job done.
“In terms of statistics, 45 [custom malware samples] as a ratio to the number of computers involved, 53, is a high ratio,” said Richard Bejtlich, chief security officer of Mandiant, the forensics firm hired by the Times to investigate the targeted attack. “Usually, you’ll see one or two for the relatively small number of systems involved.”
China, The New York Times and the Value of Self-Shaming
There aren't many things that count as surprises anymore in the security industry. And the news today that The New York Times was penetrated by a team of Chinese attackers who apparently had access to large amounts of employee emails for several months certainly doesn't fall into that category. It would be news if these attackers weren't targeting The Times and other large media companies. What's interesting and novel is that the company decided to out itself as a victim, signing up for what may be a large dose of public scorn and derisive laughter.
Report: Mainstream Websites Host Majority of Malware
While Android malware continues to grow faster than other malware types, it still accounts for only a minute fraction of all malware on the Web, according to Cisco’s annual security report released this week.
Compromised websites hosting malicious Java and iFrame attacks and other malware far and away outpaces all other delivery vectors for malware, Cisco’s report said.
Buffer Overflow Vulnerability Found in VLC Media Player
A buffer overflow could occur in VideoLAN's VLC cross-platform multimedia player when attempting to parse a specially crafted advanced systems format (ASF) movie, a researcher reported.
Experts Say CEOs Need to Get Handle on Cyberespionage Problem
NEW YORK--The long list of high-profile cyberespionage and cybercrime attacks that have surfaced in the last couple of years has led to broad discussions in the security community, government circles and elsewhere about the scope of the problem. Those discussions now are just starting to reach into the boardroom, and security experts say that any CEO who isn't concerned about this problem is living in the past.
