* Patches from Apple, Ubuntu, Debian, others * What's The Latest Buzz? * Open phones are more vulnerable, and other interesting reading
Last week’s DEMOFall 08 generated a lot of press around the theme of “distributed Web”, but there were a number of security-related technologies worthy of mention. My favorite among the bunch was Usable Systems UsableLogin product, which promises single-signon for Web sites using strong passwords and centralized management. Very slick.
Apple releases iPhone 2.1 update
The highly anticipated firmware update for Apple’s iPhone 3G is finally out and while most are hoping for better battery life and more stable third-party applicatioms, the update does bring a number of security fixes to the popular device. The most serious of the flaws could be exploited to run malicious code. iTunes 8.0 is required in order to get the 2.1 update.
**********
Four new patches from Unbuntu:
Postfix (data leak, denial of service)
**********
Two new updates from Debian:
**********
Two new fixes from Mandriva:
libxml2 (heap overflow, denial of service)
**********
Today’s malware news:
The 2008 US Presidential Election is well on its way, and what news could be more enticing than an alleged sex scandal involving one of the candidates? The latest e-mail spam run on the loose contains a link to an supposed pornographic video of Democratic candidate Senator Barack Obama. F-Secure, 09/10/2008.
**********
From the interesting reading department:
Open phones are more vulnerable
The opening up of the mobile industry is great news for application developers but not so good for IT security professionals who want to sleep at night, executives from the security industry said Thursday. IDG News Service, 09/12/2008.
ITU plan to stop DoS attacks could end Net anonymity too
Finding ways to limit DoS attacks and SMS spam by making it harder to spoof the origin of electronic communications is on the agenda at a telecommunications standards meeting next week — but civil rights advocates worry it could put an end to anonymity on the Internet. IDG News Service, 09/12/2008.
Hackers deface Large Hadron Collider Web site
Hackers have broken into the network of the Swiss particle-physics laboratory operating the Large Hadron Collider experiment that has just begun smashing atoms in the hope of finding the theorized Higgs particle, an elementary particle of mass. Network World, 09/12/2008.
Microsoft defends IE ‘phone home’ feature, clarifies privacy policy
Microsoft Friday defended the Internet Explorer 8 (IE8) tool that suggests sites based on the URLs typed into its address bar, saying that the browser “phones home” only a limited amount of information to Microsoft and that the company discards all user IP addresses almost immediately. Computerworld, 09/14/2008.
Warning: Portuguese Spam Masquerading as Official Symantec Email
We have observed a fraudulent spam attack masquerading as an email from Symantec. This email is in Portuguese and contains the Symantec logo and coloring, which make it appear as a legitimate email from Symantec. Symantec Security Response, 09/10/2008.
Haven’t Seen These For A While…There was a time when I would stumble across these overlaid profiles every other day (not to mention the endless friend requests from Bots promoting similar websites), but the friend requests have long since dried up and I hardly ever see these kinds of profiles anymore. The SpywareGuide Greynets Blog, 09/14/2008.Twitter SpamrunI saw a message on Twitter here from one of my contacts, and decided to go check it out. What I found was an unhealthy dose of spam profiles all pushing the same collection of products (most of which seem to be purchase only). The SpywareGuide Greynets Blog, 09/12/2008.
