Vulnerabilities and attacks

Samsung has issued a software update to address a nasty vulnerability found in a handful of smartphones that allowed attackers access to user data and left the handset vulnerable to malicious apps and bricking.

The vulnerability, which was discovered last month, lies in Exynos 4, the ARM-based system-on-a-chip typically found in Samsung smartphones and tablets. An exploit bypasses the system permissions, allowing any app to extract data from the device's RAM or inject malicious code into the kernel of a Galaxy S3. But other devices using the Exynos 4 were also found to be vulnerable, including select Galaxy S2 … Read more

Google and Microsoft revealed today that a certificate authority based in Turkey "mistakenly" issued security certificates last month, and that a recipient of one of the e-documents in turn created a bogus certificate that could let it impersonate various Google sites.

According to a blog post by Google engineer Adam Langley, Chrome detected and blocked an unauthorized security certificate for the domain "*.google.com" on December 24. After blocking the certificate, Langley said, Google investigated and determined the certificate came from an intermediate certificate authority that linked back to the Turkish certificate authority TurkTrust.

Fraudulent certificates … Read more

The hacking collective Anonymous has clarified that it has no plans to fade away in the New Year. It issued a statement over the weekend that warned the world to "Expect us 2013."

Along with the statement, the group created a video that boasts of its campaigns and exploits carried out in 2012. The video details the group's temporary shutdown of the U.S. Department of Justice, the FBI, Universal Music, and the Motion Picture Association of America's Web sites in protest of the U.S. government's indictment of the operators of popular file-hosting site … Read more

Microsoft issued a fix today for a zero-day vulnerability in older versions of Internet Explorer that could allow attackers to gain control of Windows-based computers to host malicious Web sites.

The company confirmed Saturday that it was investigating a remote code execution vulnerability in IE 6, IE 7, and IE 8 that could allow an attacker to use the corrupted PC to host a Web site designed to exploit the vulnerability with other users. Versions of the browser after IE 8 are unaffected, Microsoft said.

Microsoft said in an update to that security advisory that it has developed a one-click fix … Read more

Microsoft has confirmed that a zero-day vulnerability affecting older versions of Internet Explorer could allow attackers to gain control of Windows-based computers to host malicious Web sites.

The company acknowledged the issue in a security advisory yesterday that included advice on how users can mitigate the threat posed by the flaw.

"Microsoft is aware of targeted attacks that attempt to exploit this vulnerability through Internet Explorer 8," Microsoft said, noting that more recent versions of the Web browser, including IE 9 and IE 10, were unaffected.

The remote code execution vulnerability affects the way the browser accesses memory, … Read more

An Iranian news agency says the country successfully fended off yet another attack by the Stuxnet worm, according to reports.

The cyberattack allegedly targeted a power plant and other sites in southern Iran over the fall, the BBC and the Associated Press reported today.

Discovered in June 2010, Stuxnet is believed to be the first malware targeted specifically at critical infrastructure systems. It's thought to have been designed to shut down centrifuges at Iran's Natanz uranium enrichment plant, where stoppages and other problems reportedly occurred around that time. The sophisticated worm spreads via USB drives and through four … Read more

A suspected security hole affecting a handful of Samsung smartphones could give apps access to user data and leave the handset vulnerable to malicious apps and bricking, according to a developer.

The vulnerability, which was discovered and detailed by an XDA member with the handle "alephzain," lies in Exynos 4, the ARM-based system-on-chip typically found in Samsung smartphones and tablets. Alephzain developed an exploit he said bypasses the system permissions, allowing any app to extract data from the device's RAM or inject malicious code into the kernel.

Alephzain said that he stumbled upon the vulnerability while trying … Read more

NASA hacker Gary McKinnon will face no legal action in the U.K.

The Crown Prosecution Service has decided the appropriate jurisdiction for the McKinnon case is the U.S., after discussing the case with the U.S. Department of Justice and the police.

U.S. authorities started their bid to extradite McKinnon in 2005, accusing him of causing hundreds of thousands of dollars of damage by hacking into NASA and military systems. McKinnon admitted to the intrusion in 2002 but claimed he was looking for evidence of UFO activity.

But U.S. requests for his extradition were formally turned down … Read more

The wave of distributed denial of service attacks that hit U.S. banks in October was next-to-nothing compared to what could happen if cybercriminals actually carry through with their plans for next year.

According to a report (PDF) released today by McAfee Labs, an impending attack on U.S. financial institutions -- dubbed Project Blitzkrieg -- isn't only a possibility, it's a "credible threat."

"McAfee Labs believes that Project Blitzkrieg is a credible threat to the financial industry and appears to be moving forward as planned," the report reads. "Although Project Blitzkrieg hasn'… Read more