Surf Jack – HTTPS will not save you

Monday, August 11th, 2008

Say hello to a new security tool called “Surf Jack” which demonstrates a security flaw found in many public sites. The proof of concept tool allows testers to steal session cookies on HTTP and HTTPS sites that do not set the Cookie secure flag. I’ve been working with two banks ...

New Tool to Automate Cookie Stealing from Gmail, Others

Sunday, August 10th, 2008

A security researcher at the Defcon hacker conference in Las Vegas on Saturday demonstrated a tool he built that allows attackers to break into your inbox even if you are accessing your Gmail over a persistent, encrypted session (using https:// versus http://). When you log in to Gmail, Google's servers will ...

Malicious Botnet Stole Bank, Credit Union Credentials

Wednesday, August 6th, 2008

The researcher who first discovered a motherlode of stolen enterprise user names and passwords in June has found that nearly 9,000 of them are bank and credit-card account credentials from around the world that were grabbed by an old but crafty botnet. And it turns out the initial 50 gigabytes' ...

Site Guesses Your Gender via Browsing History

Thursday, July 31st, 2008

This is a pretty old issue, but this is an interesting new implementation of an old idea. Using your browser history and by matching your browsing habits the site attempts to guess your gender with a weighting system according to the gender demographics for a list of fairly popular sites.It’s ...

Microsoft Unveils New Internet Explorer Security Features

Wednesday, July 2nd, 2008

Internet Explorer's getting a little bit safer. Microsoft Wednesday unveiled significant new security features that will be in the next version of the company's Web browser, Internet Explorer 8, currently in public beta testing. From Microsoft's standpoint, any improvement in security is a plus, and the company seems to be taking ...