New Security risks detected and patched

VLS MEDIA PLAYER

Due to vulnerability in the handling of playlists, attackers can inject malicious code onto a computer. Playlists in XSPF format are affected.

SOLUTION: The manufacturer has made available the updated version 1.1.10, in which the error is corrected. The link is available on VLS’s website.

ADOBE FLASH

Hackers are actively exploiting a security hole in Flash player that allows them to read data from Web pages which a user logged on to, such as email accounts.

SOLUTION: Adobe has closed the unforeseen cross-site scripting hole, and is offering an update to Flash 10.3.181.22 for download.

FACEBOOK

An android app named FaceNiff allows attackers to penetrate others’ Facebook accounts if they active on the same Wi-Fi network.

SOLUTION: In order to protect themselves against such an attack, users should consider always using the SSL option when accessing Facebook via public networks. The change can be made in the settings menu of Facebook.

INTERNET EXPLORER

Researchers found an IE bug that let them read cookies from remote PC’s. They can thus log in to some protected sites without a password. The victim is sent a puzzle game in which he has to drag and drop objects, which actually secretly enables the exploit.

SOLUTION: Microsoft has already fixed this hole thanks to researchers.

Read More

FB scammers use Finnish loophole

There’s a new twist to the recent spate of scam links that look like videos with shocking titles. Sophos reports that scammers are using pages translated into Finnish in order to tricks people into authorizing rogue applications to access their personal data. The button “share” posts the scam link to victim’s friends’ walls.  There is of course no such video.

Read More

Google warns users of malware

Google has begun warning users they might be infected with malware, according to a company blog post. The search giant started detecting connections from infected machines running through proxy servers, indicating that all Web traffic on those machines might be being intercepted.

The particular strain of malware hasn’t been named by Google, but it affects only Windows-based computers. Anyone who sees this alert is advised to update their security software.

Read More

People knowingly continue with unsafe transactions: survey

A recent Symantec survey has thrown up the shocking finding that people often continue with an online transaction that they might suspect to be fraudulent. While 55 percent of respondents recognized green address bar highlighting as an indication of security, 80 percent knew about browsers using padlock icons to signify secure sites, and 81 percent knew to look for “HTTPS” in the address bar, only 55 percent said they would not proceed with a transaction if these indications were missing. Further, 15 percent of respondents who were aware of HTTPS login security offered by websites consciously didn’t use it. More telling, 97 percent of respondents thought they were somewhat or extremely knowledgeable about web security, and 82 percent were extremely concerned about the need to keep their data and identities confidential.

Read More

Antisec rises from LulzSec's ashes, continues carrying out attacks

The group of hackers calling themselves LUlzSec might have retired suddenly and surprised the world, but a new group called Antisec has risen in its place. AntiSec has already taken credit for a number of brazen data leaks, and has successfully targeted the US Military and even FBI. The attacks usually involve accessing networks belonging to the target or contractors hired by the target, using simple scripting attacks that reveal passwords to administrator accounts. Common social engineering also results in the discovery of other accounts for which users use the same passwords. Compromised information is said to include military plans, schematics, and private email addresses.

In an apparently unrelated attack, the Pentagon has admitted that over 24,000 files were accessed earlier this year, though it isn’t specifying what information was compromised, if any. A foreign terrorist group is suspected. 

Read More