Web

Vulnerability Undermines WordPress Two-Factor Plugins

The firm Duo Security* said that it has discovered a vulnerability that affects a range of two-factor authentication plugins for the WordPress content management platform. The vulnerability could allow a malicious insider to use credentials for one WordPress site to log into a different site that is part of a ‘multi-site’ WordPress deployment without needing to pass a multi-factor authentication test. In a blog post on Thursday, DUO co-founder and CTO Jon Oberheide said that the vulnerability was discovered as part of an internal review of DUO’s two factor WordPress plugin, but that researchers realized it affects at least two other multi-factor plugins. DUO issued a warning to users of its plugin. The company also reached out to WordPress and to the publishers of other multi factor authentication plugins to address the issue, Oberheide wrote. DUO makes multi-factor authentication technology that allows users to log-in using a combination of username, […]

Continue Reading

Veterans Targeted In Attack Using IE 10 Zero Day

Visitors to the web site of the Veterans of Foreign Wars (VFW) are being targeted in an attack that exploits a previously unknown hole in Microsoft’s Internet Explorer 10 web browser, according to warnings Thursday by security firms.   Some visitors to the web site of the Veterans of Foreign Wars (VFW), vfw[dot]org, were the victim of a ‘watering hole’ attack that takes advantage of a previously unknown ‘use-after-free’ vulnerability in Microsoft’s Internet Explorer 10 web browser. The VFW site was hacked and then altered to redirect users, silently, to a malicious website programmed to exploit vulnerable versions of IE 10 on systems running 32 bit versions of the Windows operating system.  The VFW did not immediately respond to e-mail and phone requests for comment. According to a write-up by the security firm FireEye, the vulnerability allows the attacker to “modify one byte of memory at an arbitrary address” stored […]

Continue Reading

In Next Phase: Web Tracking Cookies Grow Legs

It’s easy to focus on the low hanging fruit in the Internet of Things revolution – the Internet-connected thermostats, connected vehicles and lawn sprinklers that you can manage from the Web.   But the biggest changes are yet to come – as powerful, wearable technology, remote sensors and powerful data analytics combine to map and record our every waking (and sleeping) moment. I got a glimpse of that reading this article over at the blog StreetFightMag.com, a site that concentrates on the hyperlocal marketing sector. Hyperlocal was a big thing about six or seven years ago, as online media outfit (and their advertisers) decided that consumers were losing interest in the thin gruel that online mass-media provided, but remained intensely interested in local news and affairs. Alas, capitalizing on the relatively small-scale opportunities in ‘hyperlocal’ proved harder than anyone thought, as this week’s decision to shutter AOL’s remaining Patch web […]

Continue Reading

Thingful is a Facebook for Smart Devices

The data on exactly how many Internet of Things devices will be online by the end of the decade is a matter of debate. Cisco famously put the number at 50 billion by 2020, though Morgan Stanley thinks it could be as high as 75 billion. The analyst firm IDC estimates the number at 50 billion. But others have put the number lower. Gartner puts the number of connected things at around 30 billion by 2020. We might all be better off taking a cue from McDonald’s and just start using the phrase “billions and billions” by the end of the decade. As with McDonald’s hamburgers – the exact number doesn’t really matter, so long as everyone agrees that it’s going to be big. Really big. But all those devices – and the near-limitless IPV6 address space that will accommodate them – do present a management and governance problem: how […]

Continue Reading

Fix From LG Ends Involuntary SmartTV Snooping, But Privacy Questions Remain

The electronics firm LG issued a software update for some “Smart TV” models that were discovered spying on owners, but the company still faces scrutiny over its privacy policy. The company issued a firmware update for its LG 42LN575V model television sets, which were the subject of scrutiny last week after a UK-based technology consultant using the handle “DoctorBeet” discovered that his LG television was transmitting information about his viewing habits to company servers without his consent. The blogger, “DoctorBeet” (aka Jason Huntley, of Yorkshire, England) first wrote about his discovery on November 18, setting off a small firestorm of controversy. An analysis by Huntley uncovered a number of sketchy or outright illegal data harvesting behaviors. Among them: His LG television sent information on which channels he viewed to an LG-owned web domain. (The domain in question was not in service at the time.) The LG television relayed information on […]

Continue Reading
1 … 20 21 22 23 24 … 36