Brian Prince

Mozilla has patched the Firefox flaw exploited during the Pwn2Own contest at the CanSecWest security conference, held March 24 to 26. The bug was discovered and exploited by a researcher from MWR InfoSecurity going by the hacker alias “Nils.” According to Mozilla, the vulnerability was a memory corruption flaw. “By moving DOM nodes between documents, […]

URL shortening has taken a bit of a beating in the security community during the past two years, particularly as the popularity of Twitter has taken off. But not everyone believes the real-world dangers of URL shortening are in line with the hype. Fears of shortened URLs are being overblown, said Zscaler researcher Julien Sobrier, […]

Foxit Software plans to follow Adobe Systems’ lead and add a dialog box giving users a heads-up about a new attack tactic involving malicious PDF files. The security issue was uncovered by Didier Stevens, an IT security consultant with Contraste Europe, who discovered a way to get PDF viewers such as Adobe Reader and Foxit […]

Google and McAfee have uncovered evidence that a campaign of politically motivated cyber-attacks is targeting critics of a Chinese-backed mining operation in Vietnam. In a blog post, Neel Mehta of Google’s security team noted the cyber-assault on Vietnamese activists is separate from the Aurora incident the company reported in January, and potentially involves tens of […]

A security researcher said he has found a new way to exploit Adobe Reader and other PDF-viewing software without using an actual security vulnerability. The researcher, Didier Stevens, has developed a proof-of-concept PDF file that launches an embedded executable. According to Stevens, PDF viewers like Adobe Reader and Foxit Software’s Foxit Reader do not allow […]

IBM is working with the U.S. Federal Aviation Administration to develop a prototype security system utilizing advanced analytics to stop cyber-attacks. The research project will use streaming analytics in an effort to enable the FAA to better correlate and analyze data. According to an IBM statement March 30, the system will “look retrospectively at event […]

Google, Microsoft and other tech industry heavyweights have joined forces with advocacy groups to push for changes to the Electronic Communications Privacy Act (ECPA). ECPA was enacted in 1986 to provide a legal framework to extend government monitoring of telephone communications to electronic communications on computers. The sweeping legislation set a standard for the coming […]

Microsoft issued an emergency patch March 30 for a zero-day bug affecting Internet Explorer, closing a security hole exploited by attackers this month in assaults on IE 6 and 7 users. The update was initially going to be issued as part of April’s Patch Tuesday release and actually includes fixes for a total of 10 […]

A new study from BeyondTrust underscores what many IT administrators should already know – less privileges can mean more security. In an analysis of Microsoft security bulletins from 2009, BeyondTrust – which specializes in privilege management – found that removing administration rights is a mitigating factor in 90 percent of the critical Windows 7 vulnerabilities. […]

More than 3 million federal student loan records were stolen in a massive data breach. According to the Educational Credit Management Corp. (ECMC), a guarantor of federal student loans, “portable media” containing the names, addresses, Social Security numbers and dates of birth of 3.3 million people was stolen from the company roughly a week ago. […]

Microsoft is planning to patch a zero-day bug in Internet Explorer in March 30 with an out-of-band emergency fix. The patch plugs a security hole Microsoft first warned about March 9 after attackers began targeting the vulnerability in IE 6 and 7. IE 8 is unaffected. “We recommend that customers install the update as soon […]

A new report from Symantec names China as the world’s primary source of targeted malware the month of March. The high stakes of such attacks were brought into focus for many earlier this year with the Aurora attack on Google and dozens of other companies. According to Symantec (PDF), while most of the malware (36.6 […]