Man In The Middle
An online poker news site tested dozens of sites and found numerous vulnerabilities.
A security researcher who reported a vulnerability in the popular Oracle database product said Thursday that his discovery was never patched and remains wide open to attack.
Google has turned on encrypted search by default. The tech giant announced in a blog post Tuesday that users, over the next few weeks, will be automatically directed to https://www.google.com when they sign into their accounts. The secure channel will help protect search terms and results pages from being intercepted by a third party. As a result, websites won't have access to each individual search query that drives traffic to their site, but they still will be able to view a list of the top 1,000 queries via Google Webmaster Tools. Users wanting to send their individual search entry to advertisers, so they can improve their campaigns, can opt to still do so by clicking on an ad appearing on the search results page.
Apple on Tuesday released an update to its iTunes software to repair a whopping 79 vulnerabilities. Most of the flaws are memory corruption issues found in WebKit, an open source web browser engine that helps render the iTunes Store. In the case of those bugs, adversaries could launch a man-in-middle attack while a user browses the store, which may lead to malicious code execution. The other holes patched by upgrading to iTunes 10.5 lie in CoreFoundation, ColorSync, CoreAudio, CoreMedia and ImageIO.
As attackers have found a way to break traditional online banking security controls, recently issued guidelines offer some new advice for financial institutions.
A federal lawmaker is calling on a number of high-profile websites to adopt a more secure web protocol to prevent wireless hackers from hijacking their users' data.
Apple has released a security update for its Mac OS X. Version 10.6.6 rectifies a single security vulnerability, in PackageKit, that could allow a man-in-the-middle attacker to launch malicious code or cause an application to crash. Users are encouraged to update here. - DK
Sign up to our newsletters
SC Magazine Articles
- Study: Open Source Software use increasing in enterprises but without vulnerability monitoring
- RSA Conference 2015: Prepare for the IoT before it's too late, Sorebo warns
- 'Aaron's Law' returns to Congress
- RSA 2015: Tension continues to grow between govt, cryptographers
- CozyDuke APT group believed to have targeted White House and State Department
- Study: Conficker declared top threat of 2014, but N. America targeted mainly by AnglerEK
- RSA 2015: Straight talk about encryption, bulk surveillance and IoT
- RSA 2015: In the healthcare industry, security must innovate with business
- RSA 2015: Unintended use of aircraft systems next challenge for counterterrorism community
- RSA 2015: Bug hunting and responsible vulnerability disclosure