A security researcher who reported a vulnerability in the popular Oracle database product said Thursday that his discovery was never patched and remains wide open to attack.
Google has turned on encrypted search by default. The tech giant announced in a blog post Tuesday that users, over the next few weeks, will be automatically directed to https://www.google.com when they sign into their accounts. The secure channel will help protect search terms and results pages from being intercepted by a third party. As a result, websites won't have access to each individual search query that drives traffic to their site, but they still will be able to view a list of the top 1,000 queries via Google Webmaster Tools. Users wanting to send their individual search entry to advertisers, so they can improve their campaigns, can opt to still do so by clicking on an ad appearing on the search results page.
Apple on Tuesday released an update to its iTunes software to repair a whopping 79 vulnerabilities. Most of the flaws are memory corruption issues found in WebKit, an open source web browser engine that helps render the iTunes Store. In the case of those bugs, adversaries could launch a man-in-middle attack while a user browses the store, which may lead to malicious code execution. The other holes patched by upgrading to iTunes 10.5 lie in CoreFoundation, ColorSync, CoreAudio, CoreMedia and ImageIO.
As attackers have found a way to break traditional online banking security controls, recently issued guidelines offer some new advice for financial institutions.
A federal lawmaker is calling on a number of high-profile websites to adopt a more secure web protocol to prevent wireless hackers from hijacking their users' data.
Apple has released a security update for its Mac OS X. Version 10.6.6 rectifies a single security vulnerability, in PackageKit, that could allow a man-in-the-middle attacker to launch malicious code or cause an application to crash. Users are encouraged to update here. - DK