A new Perspective on Firefox security

Skimming the security headlines this week, one might think Carnegie Mellon University researchers release of the Perspectives Add-on for Firefox came in reaction to news of Firefox 3.0’s handling of certain SSL certificates. That was just a somewhat happy coincidence though as the research team led by David Anderson, assistant professor of computer science at CMU, had been working on the plug-in for a good 18 months. At issue is self-signed SSL certificates and how they are handled by browsers. Some say Firefox does things correctly by popping up a warning, but the message itself can be confusing to end users. Anderson explains Perspectives’ role in browser security on our Newsmaker of the Week podcast.

Novell’s iPrint open to attack, say researchers

Attackers can exploit bugs in Novell’s iPrint application to obtain corporate information or hijack computers, security experts said this week. Novell has issued a patch that plugs multiple holes in the ActiveX control that Novell ships as part of its iPrint product, but according to Danish bug tracker Secunia, one of the flaws remains unfixed.

Novell advisory

Secunia advisory

**********

Two new updates from Debian:

libTIFF (denial of service, code execution)

libxml2 (denial of service)

**********

Today’s malware news:

Western Union MTCN #2989115571Fake airplane tickets, greetings cards and credit card receipts. There’s plenty of ZIPped trojans being spammed around. The one that’s being seeded right now claims to be a bounced Western Union money transfer. F-Secure, 08/28/2008.Myspace Cracker Steals Firefox PasswordsA “Myspace Cracking tool” has recently come to light, but it’s after only one thing: Your personal details. The SpywareGuide Greynets Blog, 08/26/2008.

**********

From the interesting reading department:

Researcher Web sites to access bank accountsPosting seemingly innocuous information – like a mother’s maiden name or a pet’s name – could help a crook access personal data stored by banks, financial services firms and other companies. Computerworld, 08/25/2008.Podcast: Perspectives puts new look on Firefox securityMuch has been made of Firefox 3.0’s handling of self-signed SSL certificates this week. Coincidently, a team of researchers at Carnegie Mellon Univeristy released a new Firefox Add-On designed to deal with this very issue and help make Firefox more secure. David Anderson, assistant professor of computer science at CMU, talks about the Perspectives plug-in and how it can make your Firefox browsing experience a little more secure. Network World, 08/28/2008.

Article: Mozilla Firefox browser gets security boost

Locked iPhones can be unlocked without a passwordPrivate information stored in Apple’s iPhone and protected by a lock code can be accessed by anyone with just a few button presses. IDG News Service, 08/27/2008.Malware infects space station laptopsMalware has managed to get off the planet and onto the International Space Station (ISS), NASA confirmed today. And it’s not the first time that a worm or virus has stowed away on a trip into orbit. Computerworld, 08/27/2008.Call out a phisher, get attacked by malwareUsers tired of phishing attacks who retaliate by talking back are being targeted with exploits designed to hijack their computers, a security researcher said Tuesday. Computerworld, 08/26/2008.Cyber-threat environment becoming increasingly severeToday’s cyber-threat environment is increasingly severe, compounded by the emergence of new types of attacks. Computerworld, 08/26/2008.Keeping smartphones from becoming a security threatMy company is considering purchasing new smartphones for all employees and I am concerned about the implications of what this means for tracking our sensitive data. What are the special challenges of protecting data in an increasingly mobile workforce, and how can I meet my data protection goals? Network World, 08/25/2008.