Gmail exploit aids domain hijack
217825
Web designer holds out against extortion Web designer David Airey has succeeded in recovering his domain after hackers exploited flaws in Gmail to trick his hosts into authorising a fraudulent transfer.â¦
229375
Challenge/response e-mails accidentally marked as spam by AOL and EarthLink.
316177
An attack combining malicious codes on Web sites and end-user laziness could compromise millions of routers still configured with their out-of-the-box defaults.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
298762
Microsoft's IE (Internet Explorer) browser has an unpatched vulnerability that could let hackers hijack, then access, Google Gmail accounts, a California security company warned Monday.IE, said Santa Clara-based Cenzic in an alert issued Monday, contains an unspecified cached files bug that, when combined with a cross-site request forgery flaw in the Web-based e-mail service, exposes Gmail account sign-ons and lets others access those accounts and any messages or file attachments there.Although not a bug that can be leveraged remotely -- an attacker must have local, physical access to the PC -- as Cenzic pointed out in its alert, there are scenarios where that's not a limitation. "These vulnerabilities could be exploited such that all users of a shared computer who use Internet Explorer and share a user account -- a common practice at computer kiosks in a library or Internet cafe -- could be vulnerable," said Cenzic.Gmail contributes to the overall vulnerability because its URLs display attachments when viewed using the "View Source" command, the warning went on. IE, however, sports "improper use of caching directives [and] incorrect access checks on cached Internet Explorer files."Together, the bugs could conceivably let someone at a public PC hijack any Gmail log-on credentials that had been entered on the machine since the IE cache had last been purged. IE deletes the contents of its cache only as new files are added -- and the oldest are deleted -- or when the user explicitly instructs the browser to clear the cache using the "Delete Browsing History" command.Microsoft denied that IE even has a bug. "Microsoft has thoroughly investigated the claim and found that this is not a product vulnerability," said a company spokesman Tuesday morning. "In the scenario in question, an attacker would need authenticated access to the system in order to modify files located in the cache. With that level of access, an attacker could install malicious programs that would have more impact than the scenarios described."While true, that did not address Cenzic's scenario; by design, public PCs such as those in libraries, schools or Web cafes do not require authentication to access. Microsoft was not available for clarification.Google did not immediately respond to questions about Gmail's part in the threat
570915
The experts claim hackers have compromised these sites by exploiting scripting vulnerabilities in their guestbooks.
539362
Only Salesforce standing In the morass of Web 2.0 insecurity, Gmail and other Google-hosted services stood out as a beacon of hope. That's because they were believed to be the only free destination that offered protection against a decade-old vulnerability that enabled hackers to steal sensitive authentication details as they pass over Wi-Fi hotspots and other types of public networks.â¦
571745
Two Google site vulnerabilities that could be used to mount phishing attacks have been reported, says the Internet search giant. It already has fixed one, and expects to patch the second shortly.
513309
News.com reports that a web worm named Santy is utilizing Google to help it spread to web bulletin boards using the PHP scripting language.
143995
A sophisticated hacking scheme seen early last year appears to be affecting an increasing number of Web servers.
712724
Program developed by "ethical hacking" group takes advantage of cross-site scripting vulnerability to steal contacts, forward e-mail.
127768
Third-party fix plugs a recently discovered browser flaw that's increasingly being exploited in cyberattacks.
236014
A new Trojan horse modifies infected PC's hosts file to replace Google text ads with ads from another source.
217608
New software allows recipients of spam to band together to target known websites behind the messages. The idea is to bombard the sites with messages, slowing them down and making them more expensive to run.
305434
A vulnerability, which has been detected in Microsoft&#39;s flagship Internet Explorer, can be exploited by malicious users to conduct cross-site scripting attacks.
758956
Hole could allow remote attackers to access your local search results.
204799
A new flaw has been discovered in Microsoft&#39;s Internet Explorer browser that allows malicious users to create fake sites that could lead to new email phishing scams.