Microsoft Archives

Microsoft

Update: Hack Investigation At Dept. of Labor Turns Up Internet Explorer 8 Zero Day Hole

May 5, 2013 Paul Roberts

A hack of the U.S. Department of Labor web site that was revealed late last week is being described as a “watering hole” style attack aimed at compromising the systems of other government workers, in part using an exploit for a previously unknown (or “zero day”) security vulnerability in some versions of Microsoft’s Internet Explorer web browser.(*) Multiple reports last week indicated that a security breach of the Department of Labor web site had occurred. Accounts indicated that visitors to the site using versions of Internet Explorer were being attacked using exploits for a known vulnerability. Over the weekend, however, researchers analyzing the attacks say that it used an exploit for a zero day hole in IE8, and that details of the attack tie it to a China-based hacking group known as “DeepPanda.” In a blog post on Friday, researchers at the security firm Invincea said that they believed that the […]

The End Of Privacy: Facebook ‘Likes’ Reveal Sensitive Personal Data

March 12, 2013 Paul Roberts

We all know that, to online marketers, we’re just the sum of our Facebook Wall posts and “Likes” – the ubiquitous, virtual “thumbs up” that we attach to all manner of online ephemera. But all those ironic comments and votes of approval may be revealing a lot more about us than we’re willing to share, according to a new report from researchers at the University of Cambridge and Microsoft Research in the UK. In a paper published in the Proceedings of the National Academy of Science (PNAS), the researchers demonstrated that it is possible to use knowledge of an individual user’s “Likes” on Facebook to “automatically and accurately predict a range of highly sensitive personal attributes including: your age, and gender, you sexual orientation, ethnicity, religious and political views. The list of guessabl`e information goes on to include other less quantifiable characteristics like your personality traits, intelligence, happiness, your preference (or not) […]

Many Watering Holes, Targets In Hacks That Netted Facebook, Twitter and Apple

March 11, 2013 Paul Roberts

The attacks that compromised computer systems at Facebook, Twitter, Apple Corp. and Microsoft were part of a wide-ranging operation that relied on many “watering hole” web sites that attracted employees from prominent firms across the U.S., The Security Ledger has learned. The assailants responsible for the cyber attacks used at least two mobile application development sites as watering holes in addition to the one web site that has been disclosed: iPhoneDevSDK.com. Still other watering hole web sites used in the attack weren’t specific to mobile application developers – or even to software development. Still, they served almost identical attacks to employees of a wide range of target firms, across industries, including prominent auto manufacturers, U.S. government agencies and even a leading candy maker, according to sources with knowledge of the operation. More than a month after the attacks came to light, many details remain under tight wraps. Contacted by The Security […]

With $Pi Million At Stake, Chrome Withstands Hacker Assault

March 8, 2013 Paul Roberts

With $3.14159 million in prize money at stake, Google’s Chrome OS has withstood attempts to hack it in the company’s semi-annual Pwnium contest in Vancouver, a Google spokeswoman told The Security Ledger. In a statement Thursday, Google spokeswoman Jessica Kositz said that the company did not receive any winning entries during the day-long contest, but that the company is evaluating work that may qualify for a partial prize: a potentially infinite series of Google Wallet transfers in the amounts: $1 followed by $.50 followed by $.25 followed by $.125 and so on. OK – We made that last part up. Pwnium runs alongside the better known pwn2own contest at CanSecWest. This year, Google is providing funding for both contests. However, in 2012 the company pulled its support for pwn2own, objecting to the lack of a requirement of “responsible disclosure” – in which entrants must disclose the details of their exploits to the […]

FTC Forum Will Tackle Mobile Device Threats

February 22, 2013 Paul Roberts

The U.S. Federal Trade Commission is continuing to focus its energies on protecting the growing number of consumers using smart phones and other mobile devices. Next up: a public forum to discuss threats to mobile devices. The FTC announced the one-day public forum on Friday and said it hopes to use the event to address problems like “malware, viruses and similar threats facing users of smartphones and other mobile technologies.” The event will take place on June 4th at the FTC’s offices on New Jersey Avenue NW in Washington, D.C. The public forum is just the latest effort by the nation’s leading watchdog to reign in a free-wheeling mobile application marketplace, and put stronger consumer and privacy protections in place. Earlier this month, the agency released a Staff Report that called on mobile OS, mobile device and mobile application firms to provide clearer guidelines to consumers about how their information […]