Brian Prince

Top Hacks, Breaches and Compromises of 2010 (So Far) AT&T Hack Exposes E-Mail Addresses In June, researchers at Goatse Security uncovered a flaw on AT&T’s Website and used it to get their hands on 114,000 e-mail addresses belonging to Apple iPad 3G owners. AT&T was not pleased, and the FBIlaunched an investigation. Thieves Hit ECMC […]

Video games can be fun, but who knew they also can be useful tools for IT forensic investigations? To Brandon Nesbit, a security consultant at Trustwave, that Nintendo Wii or Sony Playstation 3 (PS3) some use for enjoyment can be a wealth of information. At the upcoming DEFCON security conference, Nesbit plans to offer insight […]

The AutoFill feature in Apple’s Safari browser could be abused by attackers to steal user information, according to findings from a security researcher. Jeremiah Grossman, CTO of WhiteHat Security, noted that in Safari version 4 or 5, the AutoFill feature fills in information such as e-mail addresses and names by default whenever it recognizes a […]

Security researchers have found more malware exploiting an unpatched Windows vulnerability via .LNK shortcut files. According to Sophos blog July 23, two other pieces of malware have been observed targeting the bug. One is a keylogging Trojan the company is calling Chymin-A that is “designed to steal information from infected computers.” The other is Dulkis-A, […]

Siemens is distributing a tool to help customers deal with a malware threat targeting its SCADA, or supervisory control and data acquisition, software. Sysclean, developed by Trend Micro, detects Stuxnet and cleans it from infected machines. First reported by security vendor VirusBlokAda, based in Minsk, Belarus, Stuxnet targets Siemens’ Simatic WinCC and PCS 7 software, […]

The past several weeks have seen some prominent examples of just how contentious the issue of responsible disclosure can still be. With the Black Hat and DEFCON security conferences just around the corner, Microsoft wants to change the mindset surrounding discussions of vulnerability disclosures by emphasizing the concept of collaboration. Rather than use the term […]

Spammers are increasingly turning to shortened URLs to beat spam filters, and an old foe is at the center of it. According to Symantec’s July 2010 MessageLabs Intelligence Report, spam with shortened hyperlinks reached a peak of 18 percent on April 30, translating to 23.4 billion spam e-mails. An analysis of the spam campaign has […]

Mozilla pushed out a large security update Tuesday for its Firefox browser, fixing 16 flaws that left Web users susceptible to exploits. Eight of the vulnerabilities patched in Firefox 3.6.7 are rated “critical” and can be leveraged to remotely execute code. Two other bugs – a same-origin bypass using canvas context and a cross-origin data […]

Virtualization, Cloud PCI Compliance Tips for Your Enterprise by Brian Prince Do Ask, Do Tell Companies should get independent verification that its cloud/virtualization vendor is PCI-compliant, and make sure there are measures in place to maintain that compliance. Companies should study their SLA to see if it protects them in the event of a data […]

Microsoft is arming Windows users with a new automated tool to help thwart exploits of a zero-day that has come under attack. The bug, which lies in the Windows shell component of the operating system, exists because Windows parses shortcuts in a way that permits malicious code to be executed when the icon of a […]

FileMaker is nudging the iPad and iPhone further into the enterprise space by bringing their database technology to the mobile devices’ users. The company released FileMaker Go iPhone and FileMaker Go for iPad Tuesday, and the programs are now available through Apple’s iTunes App Store. With FileMaker Go, users can view, edit and search for […]

Adobe Systems is adding new sandboxing technology to Adobe Reader to tighten security and close down doors for attackers. Known as -Protected Mode’, the technology will be included in the next full version of the PDF viewing software, and comes at a time when attackers are increasingly using Adobe vulnerabilities to compromise computers. The technology […]