Fox News Server Found Unsecured
445654
A gaping security hole in Fox News's Web site revealed file directories and sensitive content.
109664
In what was speculated to be a reaction to a possible DoS attack, the Bush Administration has blocked at least some foreign visitor access to its official campaign Web site.
87195
Also: Feds slow in getting records on Web. Read these stories and more from around the Web on News.com Extra.
22770
Unpatched Windows machines are vulnerable to latest adware attack
630275
Update: A little digging shows the Pennsylvania high schooler in detention is in the doghouse for mouthing off, not for using Firefox, as reported on the web. Turns out the kid altered the scanned detention report, sparking the "punished for using Firefox" story. Look for a retraction from the culprit.
124155
Also: Google Shared Stuff plays well with others. Read these stories and more from around the Web on News.com Extra.
63702
TechWeb - Officials think the site's server was hacked sometime between Jan. 26 and Jan. 28.
103206
This unedited e-mail below, sent privately to friends by Wall Street Journal correspondent Farnaz Fassihi, was posted on pointer.org, a site run by the Poynter Institute journalism school.
46657
A website that allows whistle blowers to anonymously post sensitive  documents is taken offline in the US.
300950
Update addresses potential denial-of-service vulnerabilities as well as a flaw in QuickTime.
91755
Also: Crippled spy satellite threatens Earth. See what people are saying on News.com Extra.
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
222872
Be afraid: There's no such thing as a secure network.
676378
privately run and not affiliated with the Transportation Security Administration â-ffers news (such as the Nazi salute allegedly flipped
745068
InfoWorld - A recent string of high-profile ActiveX vulnerabilities caused the U.S. Computer Emergency Readiness Team (US-CERT) to advise users to disable the ubiquitous Microsoft browser plug-in technology altogether. The vectors for these recent exploits include a third-party image uploading tool used on both the Facebook and MySpace social networking sites, and flaws found in Yahoo's Music Jukebox, Real Networks' RealPlayer, and Apple's QuickTime.
353737
News, Infocus, Columns, Vulnerabilities, Bugtraq ...
136725
Three weeks after the U.S. Naval War College's networks were taken offline after a network intrusion was discovered,  there's  no word on when it will be restored.