Mozilla Tests More Secure Firefox

Thursday, October 1st, 2009

Mozilla on Wednesday posted preview builds of its Firefox browser with security enhancements designed to mitigate the risk of certain Web attacks. In a blog post, Brandon Sterne, security program manager for Mozilla, asks security researchers and server administrators to help test the changes by downloading a build appropriate for their ...

Shutting Down XSS with Content Security Policy

Tuesday, June 23rd, 2009

For several years, Cross-Site Scripting (XSS) attacks have plagued many of the web’s most popular sites and victimized their users. At Mozilla, we’ve been working for the last year on a new technology called Content Security Policy, designed to shut these attacks down. We wanted to give a bit of ...

‘Ardilla’ Automatically Roots Out SQL Injection And XSS, Generates Attacks

Thursday, June 18th, 2009

Researchers have built a tool that automatically finds and exploits SQL injection and cross-site scripting vulnerabilities in Web applications. The so-called Ardilla tool uses a technique developed by the researchers -- MIT's Adam Kiezun, the University of Washington's Michael Ernst, Stanford's Philip Guo, and Syracuse University's Karthick Jayaraman -- that creates ...

Most Malware Hosted On Trusted Sites

Tuesday, May 12th, 2009

Symantec's MessageLabs says the assumption most web-based malware originates from recently created, temporary, trashy adult sites is becoming an old-fashioned notion. Modern hackers are focusing on well-established, trusted websites they can compromise-sites users trust every day of the week. According to data collected last week, 84.6 percent of website domains blocked ...

Google Chrome update patches XSS vulnerability

Friday, April 24th, 2009

Mark Larson, the Google Chrome Project Manager, has posted an advisory on the Google Chrome Releases blog advising of a high risk vulnerability in the Chrome web browser. The cross-site scripting (XSS) vulnerability is caused by an error in handling URLs in the ChromeHTML URI handler, allowing an attacker to ...