Surf Jack – HTTPS will not save you

Monday, August 11th, 2008

Say hello to a new security tool called “Surf Jack” which demonstrates a security flaw found in many public sites. The proof of concept tool allows testers to steal session cookies on HTTP and HTTPS sites that do not set the Cookie secure flag. I’ve been working with two banks ...

An Illustrated Guide to the Kaminsky DNS Vulnerability

Sunday, August 10th, 2008

The big security news of Summer 2008 has been Dan Kaminsky's discovery of a serious vulnerability in DNS. This vulnerability could allow an attacker to redirect network clients to alternate servers of his own choosing, presumably for ill ends.This all led to a mad dash to patch DNS servers worldwide, ...

DNS flaw is so big it puts every network at risk

Thursday, August 7th, 2008

A recently found flaw in the internet's addressing system is worse than first feared, so Dan Kaminsky said when speaking publicly about his discovery at the Black Hat conference in Las Vegas.He said fixes for the flaw in the net's Domain Name System (DNS) had focused on web browsers but ...

15 Great, Free Privacy Downloads

Thursday, August 7th, 2008

One of the worst privacy invaders the world has ever seen is the Internet. When you surf, Web sites can find out where you've been and can gather other information about you. Trojan horses and spyware can snoop on you. Key loggers can capture your keystrokes as you type. Eavesdroppers ...

Massive faux-CNN spam blitz uses legit sites to deliver fake Flash

Wednesday, August 6th, 2008

More than a thousand hacked Web sites are serving up fake Flash Player software to users duped into clicking on links in mail that's part of a massive spam attack masquerading as CNN.com news notifications, security researchers said today.The bogus messages, which claim to be from the CNN.com news Web ...