Hackers Can Expose Masked Surfers, Study Says
624933
A researcher says the techniques to stay anonymous online can be thwarted through flaws in the systems.
301264
Hackers wasted little time in exploiting a flaw in the way Microsoft software handles graphics files. Internet watchers say they&#39;ve spotted infected images that could implant a back door into a Windows computer if they are viewed.
748665
Online portal says bugs could have let attackers alter appearance of pages and access a victim's data.
451868
The growing use of Web feed readers and the proliferation of content aggregation sites are giving hackers an easy way to deliver malware to users' computers, security analysts warn.
586072
The Anti-Phishing Working Group, in its most recent report, said that online scam artists are turning to new tactics to try to trick Web surfers into divulging financial information.
148612
Attackers can trick browsers into releasing password information.
80556
GNUCitizen is describing an apparent vulnerability that could trick people into revealing personal data.
4497
Within days of the release of the security bulletin, there was proof of concept code available on the web. As the exploit was analyzed by various security groups, it was found that it was similar
677442
Security researchers have released code showing how a pair of widely used technologies could be misused to take control of a victim&#39;s Web browsing experience.The code, published over the weekend by researchers Adrian Pastor and Petko Petkov, exploits features in two technologies: The UPnP (Universal Plug and Play) protocol, which is used by many operating systems to make it easier for them to work with devices on a network, and Adobe Systems&#39; Flash multimedia software.By tricking a victim into viewing a malicious Flash file, an attacker could use UPnP to change the primary DNS server used by the router to find other computers on the Internet. This would give the attacker a virtually undetectable way to redirect the victim to fake Web sites. For example, a victim with a compromised router could be taken to the attacker&#39;s Web server, even if he typed Citibank.com directly into the Web browser navigation bar.&quot;The most malicious of all malicious things is to change the primary DNS server,&quot; the researchers wrote. &quot;That will effectively turn the router and the network it controls into a zombie which the attacker can take advantage of whenever they feel like it.&quot;Because so many routers support UPnP, the researchers believe that &quot;99 percent of home routers are vulnerable to this attack.&quot;In fact, many other types of UPnP devices, such as printers, digital entertainment systems, and cameras are also potentially at risk, they added in a Frequently Asked Questions Web page explaining their research.The attack is particularly worrisome because it is cross-platform -- any operating system that supports Flash is susceptible -- and because it is based on features of UPnP and Flash, not bugs that could be easily fixed by Adobe or the router vendors.Users could avoid this attack by turning UPnP off on their routers, where it is normally enabled by default, but this would cause a variety of popular applications, such as IM software, games, and Skype, to break and require manual configuration on the router.Adobe could make changes to Flash to mitigate the problem, but attackers could most likely also launch this attack using another technique, known as DNS pinning, said Aviv Raff, a researcher who has also blogged about the attack.&quot;This is a critical issue,&quot; he said in an IM interview. &quot;People should turn off UPnP in their devices, and vendors should put UPnP disabled by default in the devices they deliver.&quot;Although this could make life difficult for nontechnical users, Raff believes it would be worth the effort. &quot;It&#39;s better than having your traffic owned by malicious people,&quot; he said.However, another security expert said that turning off UPnP would be overkill, considering that online criminals have not even begun using this attack. &quot;Look... if you get hit by a meteor, it&#39;s devastating,&quot; said Roger Thompson, chief research officer with Grisoft. &quot;But no one goes around building meteor shelters.&quot;
459659
More than half of all Web sites serving up attack code are legitimate domains that have been hacked by criminals, according to a Websense study.
607294
Recently disclosed security holes that affect Internet Explorer 7 and Firefox could let attackers grab data via malicious Web sites.
518501
Security experts say that attacks using image files could bypass established defenses.
88476
Two recently disclosed vulnerabilities that affect Internet Explorer 7 and Windows Vista could let hackers nab user data.
143995
A sophisticated hacking scheme seen early last year appears to be affecting an increasing number of Web servers.
324151
Attackers continue to use well-worn techniques, such as SQL injection, to exploit holes in popular Web applications but have also moved on to other targets, including government sites, and newer exploit methods, such as cross-site request forgery, according to the latest report filed by the Web Applications Security Consortium.The nonprofit industry group released the findings of its annual Hacking Incidents Database report this week, and despite the fact that cyber-criminals are still capable of using familiar means like SQL injection to victimize e-commerce sites and other transactional systems, a growing number of assailants are broadening their efforts and capabilities and going after new sets of targets, the research contends.Based on WASC's in-depth investigations into roughly 80 individual attacks carried out during calendar 2007, the group concludes that data theft remains the primary goal of most incidents, representing 42 percent of all the events.Surprisingly, site defacement -- thought to be a dying art in the world of profit-driven hacking -- actually still accounted for 23 percent of the attacks covered in the report, followed by exploits aimed at planting malware on sites at roughly 15 percent.And while the lion's share of the incidents studied by the group revolved around the attempted theft of sensitive data that could be sold on the underground market or used to carry out fraud, the phishing threats of years past are increasingly becoming outnumbered by attacks that utilize malware code hidden on legitimate Web applications to victimize unsuspecting end-users, the group said.Of all the threats studied by WASC in its report, 67 percent were designed specifically to derive some form of profit -- pointing to continued growth in the professionalism of those responsible for the attacks, researchers said."One of the biggest issues is that so much of this activity is being delivered directly though legitimate Web sites that are being hacked," said Ryan Barnett, a project leader at WASC who also serves as director of application security training at applications firewall vendor Breach Security, which sponsored the 2008 report."It used to be that as long as users didn't go to certain Web sites they'd be safe, but obviously, that's changing," he said. "SQL injection still works surprisingly well, so we're seeing plenty of those across the board, but you do also begin to see more use of things like cross-site request forgery, to which even greater numbers of sites might be vulnerable."SQL injection, which attempts to use security vulnerabilities occurring in the database layer of applications to compromise them, still remains a weak point in some widely-used Web systems, in particular e-commerce sites, a reality that the researcher views as surprising based on the well-established history of the technique. However, CSRF threats, which attempt to hijack authenticated Web sessions to carry out their ploys, are becoming more common, while still far less frequent than SQL injections, according to the expert. Indeed, CSRF threats accounted for only 2 percent of the incidents tracked by WASC for the 2007 report, while SQL injections represented 20 percent, the most popular format for exploit.Unintentional information disclosure, which involves sites that emanate such detailed authentication failures that hackers may use them to find a way in, was the second most popular format for attackers to break into applications at 15 percent, followed by cross-site scripting exploits, which use malware planted on legitimate sites to subvert end-users' machines, at 12 percent of the incidents.In terms of the types of organizations being assailed by the attacks tracked by WASC, the group found that government agencies actually represented the largest group of targets.Perhaps because financial services companies and retailers have improved their applications defenses, hackers have moved on to the government set as well as educational institutions, the report contends.Some 29 percent of the incidents covered in the report targeted government agencies, followed by education at 15 percent, and retailers and media outlets tied at 12 percent.In addition to attempts to steal data, WASC contends that government agencies may also be getting hacked by parties looking to embarrass or disable the organizations' sites based on ideological goals. Because government agencies are forced to report more of their security incidents publicly, hackers may merely be trying to force the organizations to admit that they have been exploited in public, the researchers said.
537602
Pop-up blocker and phishing protection feature are vulnerable to attacks, according to SecuriTeam reports.
122784
Businesses are more likely to pick up a virus via employee Web surfing than from e-mail attachments, according to an IDC study.