Threats Archives

Threats

Microsoft Rushes Fix for IE Hole Used in Attacks on DC’s Elite

January 2, 2013 Paul Roberts

Microsoft issued an emergency fix for its Internet Explorer web browser on Monday, just days after security researchers reported finding a previously unknown (zero day) vulnerability in IE that was being used in targeted attacks against members of Washington D.C.’s media, government and policy elite. Microsoft’s Security Response Center (MSRC) released the fix for IE versions 6, 7 and 8 on Monday following reports of sophisticated and targeted attacks using the vulnerability were detected on the web site of the Council of Foreign Relations, a leading think tank whose members include senior government officials. In a Security Advisory (#2794220), Microsoft described the flaw as a “remote code execution vulnerability” in code that governs the way that “Internet Explorer accesses an object in memory that has been deleted or (improperly) allocated.” The vulnerability could allow a malicious attacker to create a malicious web page that would exploit the vulnerability to corrupt memory in […]

Update: Popular WordPress Plugin Leaves Sensitive Data in the Open

December 26, 2012 Paul Roberts

Editor’s Note: Updated to add comments from Jason Donenfeld. – Paul A security researcher is warning WordPress uses that a popular plugin may leave sensitive information from their blog accessible from the public Internet with little more than a Google search. The researcher, Jason A. Donenfeld, who uses the handle “zx2c4” posted a notice about the add-on, W3 Total Cache on the Full Disclosure security mailing list on Sunday, warning that many WordPress users that had added the plugin had directories of cached content that could be browsed by anyone with a web browser and knowledge of where to look. The content of those directories could be downloaded, including directories containing sensitive data like password hashes, Donenfeld wrote. W3 Total Cache is described as a “performance framework” that speeds up web sites that use the WordPress content management system by caching site content, speeding up page loads, downloads and the […]

Update: Spammers abusing Google Rich Snippets to boost Scam Sites

December 20, 2012 Paul Roberts

Editor’s Note: Updated to add official comment from Google. Spammers prove the rule that says criminals will always stay one step ahead of the law. That’s why – despite predictions from some of the technology industry’s best and brightest (*ahem* Bill Gates) that spamming would be eradicated it survives (and thrives) even today. One way that spammers continue to stay in business is by latching on to new technology – any new technology – that might give them an edge in reaching more potential victims and luring them in. Spammers were among the first to recognize the importance of technologies like Search Engine Optimization (SEO) in driving traffic to web sites. They’re willing to try any new social media platform – no matter how nascent. And they don’t cling to technology or methods that don’t work. When the Internet community got hip to how loosely monitored infrastructure like open proxies (PDF) contributed […]

Citing Facebook, Mobile Devices, FTC Updates Online Protections for Kids

December 19, 2012 Paul Roberts

The U.S. Federal Trade Commission issued updated rules on Wednesday that will ban online advertisers from tracking the online behavior of children without explicit consent from their parents. In a press conference in Washington D.C, FTC Chairman Jon Leibowitz announced new guidelines for implementing the Children’s Online Privacy Protection Act (COPPA). Among other things, the changes expand the list of information that cannot be collected from children without parental consent to include photographs, videos and audio recordings of children and geo-location information. “Unless you get parental consent, you may not track children and use their information to build massive profiles of online behavior,” said FTC Chairman Leibowitz. The new rules are a major revision to the COPPA rule, which was first passed in 1998. The law is a kind of privacy Bill of Rights and applies to children 13 years old and younger. Speaking at a press conference on Wednesday afternoon, […]

The Good News for Newtown Investigators: Destroying Hard Drives is Harder than You Think

December 18, 2012 Paul Roberts

Adam Lanza knew what he was doing. The 20 year-old man, who has been named as the killer of 27 people, including 20 children, six elementary school staff members and his own mother, deliberately destroyed the hard drives to personal computers he used before leaving his home to launch his attack on t the Sandy Hook Elementary School in Newtown, Connecticut. The hard drives are believed to contain valuable clues to Lanza’s online activities and could help establish a motive for the otherwise senseless crime. According to reports from various news outlets, Lanza removed the hard drives and “smashed” them using what’s described as a hammer or possibly a screw driver. The drives are described as “broken into pieces.” A report on CBS quoted an unnamed source that was “working with the drives” as saying that they were “so badly damaged that authorities face a significant challenge in retrieving any data […]