Yahoo fixes email cross-site scripting flaw

Thursday, June 26th, 2008

Yahoo has fixed a vulnerability that could allow a hacker to get access to a person's webmail account. The problem was in the way Yahoo's mail interacts with version 8.1.0.209 of its IM application, according to web application security company Cenzic. Cenzic notified Yahoo of the problem in May, and the company ...

A Tour of Risky Web Sites

Wednesday, June 4th, 2008

Just over 4% of all Web sites are dangerous, according to a new report. But all bad sites aren’t created equal: Cyber bad guys are more likely to build their sites where it’s easy to do so. The report out today from McAfee, a tech-security company that’s trying to position itself ...

Gmail as a spam engine

Sunday, May 11th, 2008

This is not good. Researchers from INSERT found a vulnerability in the Gmail engine that could allow spammers to forward mail through Google, thereby bypassing blacklists and being accepted by whitelists. It works by using the same forwarding features that allow users, myself included, to forward their email through ...

Malicious hardware may be next hacker tool

Thursday, May 1st, 2008

As if computer viruses and worms aren't enough of a nuisance, malicious hardware, which will be much more difficult to detect, could soon become a threat too. Today, computer viruses, which are programs downloaded either as an email attachment or when someone visits a website, are responsible for most computer attacks. ...

Two Factor Authentication is Dead

Thursday, May 1st, 2008

The fundamental problem with two factor (2FA) session authentication is that the approach is vulnerable to Man in the Middle and Man in the Browser attacks. 2FA requires that customers present not only a password (something they know) when they log into online banking, but also demonstrate that they possess ...