CGISecurity Logo

Topics

Tags

  • PCI Is Meaningless, But We Still Need It

    Posted by Robert A on

    in
    ,
    | |

    There's a good rant at informationweek on PCI. "The Heartland Payment Systems breach demonstrates that PCI is bunk. Unfortunately, unless something better comes along, bunk is better than nothing. The PCI compliance program is like a Zen koan: it's a proposition that can't be understood rationally. Unlike a koan, however, pondering on PCI won't eventually…

  • British hacker gang ‘tried to steal £229m from Japanese bank’

    Posted by Robert A on

    in
    ,
    | |

    "A six-strong hacker gang attempted to plunder £229million from a Japanese bank in an audacious high-tech scam, a court heard.   A crooked security guard at Japanese bank Sumitomo Mitsui let alleged computer hackers into the building in the dead of night where they installed spy software on computers used for multi-million pound cash transfers, the…

  • Safari RSS Reader Vulnerability

    Posted by Robert A on

    in
    , ,
    | |

    In 2006 I gave a talk at blackhat on the risks of RSS vulnerabilities. It appears Safari has a flaw in its RSS reader as outlined by Brian Mastenbrook. "The original version of this page contained a simple workaround for this issue which I believed would protect users against this problem. I have since discovered…

  • Oracle Releases Critical Patch Update With 41 Fixes

    Posted by Robert A on

    in
    ,
    | |

    "Oracle delivered 41 security fixes to its customers in its first critical patch update (CPU) of the year. Among those fixes are patches for serious flaws affecting Oracle WebLogic Server and Windows versions of Oracle Secure Backup. According to Oracle, a vulnerability in the WebLogic Server plugins for Apache, Sun and IIS Web servers received a…

  • HTTPS-only mode added to Chrome Browser

    Posted by Robert A on

    in
    ,
    | |

    Google has added a HTTPS browsing feature to chrome. From the changelog"A new HTTPS-only browsing mode. Add –force-https to your Google Chrome shortcut, and it will only load HTTPS sites. Sites with SSL certificate errors will not load. " Release Notes 2.0.156.1 http://dev.chromium.org/getting-involved/dev-channel/release-notes/releasenotes201561 Very cool.

  • Gary McKinnon confesses to escape extradition to USA

    Posted by Robert A on

    in
    ,
    | |

    "COMPUTER hacker Gary McKinnon has signed a formal confession in a last-ditch attempt to avoid his extradition to the US, his family have confirmed. Former Highgate Wood School pupil Mr McKinnon, 42, is currently awaiting extradition after being accused of causing $700,000 worth of damage when he allegedly hacked into US security systems from his…

  • CWE & SANS TOP 25 Most Dangerous Programming Errors

    Posted by Robert A on

    in
    , , , ,
    | |

    “Most of the vulnerabilities that hackers exploit to attack Web sites and corporate servers are usually the result of common and well-understood programming errors. A list of 25 of the most serious such coding errors is scheduled to be released later today by a group of 30 high-profile organizations, including Microsoft, Symantec, the U.S. Department…

  • CWE & SANS TOP 25 Most Dangerous Programming Errors

    Posted by Robert A on

    in
    , , , ,
    | |

    “Most of the vulnerabilities that hackers exploit to attack Web sites and corporate servers are usually the result of common and well-understood programming errors. A list of 25 of the most serious such coding errors is scheduled to be released later today by a group of 30 high-profile organizations, including Microsoft, Symantec, the U.S. Department…

  • Hackers deface Army and Nato sites

    Posted by Robert A on

    in
    ,
    | |

    "Hackers have taken down two high-profile targets as they continue their ongoing Web attacks in support of Palestine, defacing Web sites run by the U.S. Army and the North Atlantic Treaty Organization (NATO). The attacks on Thursday took down the Web sites for The United States Army Military District of Washington and the NATO Parliamentary…

  • New DNSSEC Bind Flaw Patched

    Posted by Robert A on

    in
    ,
    | |

    "Security researcher Dan Kaminsky made headlines last year when he discovered a critical DNS flaw. If left unpatched it could have crippled vast parts of the Internet. As 2009 starts up, a new DNS (define) flaw has emerged, but the severity of the threat is less pronounced. ISC (Internet Systems Consortium) the group leading development…

  • Oracle to issue 41 patches on January 13th

    Posted by Robert A on

    in
    ,
    | |

    "Next Tuesday (13 January) promises to be a busy day for hard-pressed sys admins. Although Microsoft's regular monthly Patch Tuesday update promises only one bulletin, a critical fix for Windows1, Oracle's quarterly batch weighs in at 41 fixes. The updates fix vulnerabilities across "hundreds of Oracle products", an alert from Oracle warns. Highlights include nine…

  • TJX Maxx hacker sentenced to 30 years

    Posted by Robert A on

    in
    ,
    | |

    We've previously covered the TJX compromise. It appears one of the attackers involved is going to prison. "Maksym Yastremskiy, the Ukrainian accused of being a key figure in the infamous TJX Maxx Wi-Fi hack of 2005, has been sentenced to 30-years in prison by a Turkish court. Yastremskiy – or 'Maksik' as he was sometimes…

  • Twitter hacked via weak passwords to admin system

    Posted by Robert A on

    in
    ,
    | |

    "A teenage hacker, known in the digital underground as GMZ, claims he obtained access to the micro-blogging site’s admin controls using a brute force dictionary attack. After guessing the login identity of an administrator, in part based on the large number of people she followed, GMZ ran an automated password guessing program overnight to reveal…

  • CheckFree warns 5 million customers after DNS hack

    Posted by Robert A on

    in
    ,
    | |

    "Tolley wouldn't say what banks were affected by the hack, but the majority of these five million customers were CheckFree's own users, she said. In total, about 42 million customers access CheckFree's bill payment site, she said. Customers who went to CheckFree's Web sites between 12:35 a.m. and 10:10 a.m. on the morning of the…

  • Hackers Post Faked Report of Steve Jobs’s Death

    Posted by Robert A on

    in
    , ,
    | |

    "MacRumors, one of the many sites which cover Apple's annual Macworld product launches, has had its live coverage infiltrated, with someone adding the false news of Steve Jobs's death to the blow-by-blow reports." Here's the very amusing screenshot of the incident.http://cache.gawker.com/assets/images/gawker/2009/01/macrumorshacked.jpg Read more: http://valleywag.gawker.com/5124580/hackers-post-faked-report-of-steve-jobss-death

  • Pak hackers plan attack on Indian cyber networks: Intel

    Posted by Robert A on

    in
    ,
    | |

    "After the Mumbai terror strikes, anti-India elements in Pakistan are now planning an attack on Indian computer networks, intelligence agencies have warned. Already Pakistani hackers are trying out a dry run against Indian networks through popular websites registered there after the Mumbai terror strikes, Home Ministry sources told PTI here today. "Every time the relations…

  • Israel hacks Arab TV station

    Posted by Robert A on

    in
    ,
    | |

    "Israeli military forces have reportedly hacked into a Hamas-run TV station to broadcast propaganda. The hijack of the Al-Aqsa television station last weekend represents the latest phase in a war in cyberspace that has accompanied the ongoing conflict in Gaza. Al-Aqsa is known for featuring allegedly antisemitic childrens' cartoons as part of its broadcast schedule…

  • Twitter Security Collapses; Obama, Fox and Britney Accounts Hacked

    Posted by Robert A on

    in
    , ,
    | |

    From Twitter's blog "The issue with these 33 accounts is different from the Phishing scam aimed at Twitter users this weekend. These accounts were compromised by an individual who hacked into some of the tools our support team uses to help people do things like edit the email address associated with their Twitter account when…

  • Security: The Number One Technology Failure of All Time

    Posted by Robert A on

    in
    | |

    "I was reading through an article last night about the 25 greatest blunders in technology history and was happily strolling through memory lane (what are Palm Pilots, PS/2s and Apple Newtons anyways? :p) and then got quite a surprise at the very end of the article.  The number one technology failure of all time according to the…

  • Police set to step up hacking of home PCs

    Posted by Robert A on

    in
    ,
    | |

    The Home Office has quietly adopted a new plan to allow police across Britain routinely to hack into people’s personal computers without a warrant. The move, which follows a decision by the European Union’s council of ministers in Brussels, has angered civil liberties groups and opposition MPs. They described it as a sinister extension of…

  • 2009 Security Predictions Collection

    Posted by Robert A on

    in
    ,
    | |

    I've been collecting a list of security predictions for 2009 that people on this list may find 'interesting'.Here they are Opinion: Security predictions for 2009http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9124621&source=rss_news 2009 Security Predictionshttp://www.sans.edu/resources/securitylab/2009_predictions.php Security predictions for 2009http://www.itworld.com/security/59948/security-predictions-2009 10 Security Predictions For 2009http://www.crn.com/security/212201985 The 2009 Security Prediction Prediction Listhttp://blogs.gartner.com/greg_young/2008/12/19/the-2009-security-prediction-prediction-list/ 2009 security predictions: Deja vu all over againhttp://www.infoworld.com/article/08/12/31/2009_security_predictions_Deja_vu_all_over_again_1.html 2009 – my security…

  • Computerworld Security predictions for 2009

    Posted by Robert A on

    in
    | |

    "My predictions for information security in 2009 are just predictions, not recommendations. I am trying to guess what will happen, not suggesting what should happen. As always, take these with a grain of salt. Though these predictions are based on primary research and many, many discussions with chief security officers, they concern information security only…

  • MS08-067 Worm on the Loose

    Posted by Robert A on

    in
    , ,
    | |

    Dshield has published a report of a new MS08-067 worm spreading. "It does various things to install and hide itself on the infected computer.  It removes any System Restore points that the user has set and disables the Windows Update Service.  It looks for ADMIN$ shares on the local network and tries to brute force…

  • OWASP releases Application Security Verification Standard for developers, security pros, and buyers

    Posted by Robert A on

    in
    ,
    | |

    "Now there's an open industry standard for Web application and Web service security: The Open Web Application Security Project (OWASP) Foundation has released the Application Security Verification Standard (ASVS). Mike Boberski, project lead and co-author of OWASP's ASVS Project, says the main goal of the standard is to provide a commercial and workable open standard…

  • MD5 considered harmful today: Creating a rogue CA certificate

    Posted by Robert A on

    in
    , , , , , ,
    | |

    UPDATE: I’ve added a link to the presentation slides and some other sites providing coverage of this. The following paper was published today at the CCC conference by Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, and Benne de Weger. “We have identified a vulnerability in the Internet Public Key…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.