Chrome-based Web security scrutinizer by Google



Google today released an open-source tool called DOM Snitch that tries to flag Web site software that would be dangerous to run in a browser.
The software is an experimental Chrome extension that examines how Web site code executes to see if commands could lead to cross-site scripting or other attacks used to deliver malware to computers via a Web browser.
DOM Snitch (download) "enables developers and testers to identify insecure practices commonly found in client-side code," said Google security test engineer Radoslav Vasilev in a blog post. He elaborated:
To do this, we have adopted several approaches to intercepting JavaScript calls to key and potentially dangerous browser infrastructure such as document.write or HTMLElement.innerHTML (among others). Once a JavaScript call has been intercepted, DOM Snitch records the document URL and a complete stack trace that will help assess if the intercepted call can lead to cross-site scripting, mixed content, insecure modifications to the same-origin policy for DOM access, or other client-side issues.
The move is one of many Google has made of late to improve security on the Web--a medium the company believes is the programming platform of the future and that holds a dominant role in its own business. The company also is working hard to improve Chrome's own security.
Other open-source Google security products include Skipfish and Ratproxy, which let people test the security of Web applications.
-NEWS  SOURCE (Cnet)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Hackers are using Critical Flash Bug



Adobe said that the vulnerability, which it referred to by the identifier CVE-2011-2110 in its update, "could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via malicious web pages." Last week, Adobe released a series of security patches for their products, fixing a number of issues that included this vulnerability. 



More recently, security company Websense has discovered that this vulnerability is being used in two separate forms of attack. This includes so-called drive-by attacks, where users need only to visit a site in order to be served malware. The other form is spear-phishing, a targeted phishing attack that attempts to lure an internet user into clicking a malicious link by claiming to come from a legitimate business. The vulnerability only exists in versions of Flash which have yet to be patched with the latest security update. Websense recommends that all users patch the latest version as soon as possible. "As always, it's crucial that you install the latest version of Adobe Flash Player as soon as possible if you haven't done so already. The vulnerable versions are any version older than 10.3.181.26," said the company.
Hackers are using a critical security vulnerability in Flash to attack users despite a recent update from Adobe designed to fix the bug. 


SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Firefox 5 is now Available for Download after Fixing Some Serious Flaws


Mozilla released Firefox 5.0 that fixes several security issues, stability issues and introduces new features.
Privacy-aware users will be happy to learn that the Do-Not-Track header preference has been moved to increase discoverability.

The latest version of Firefox has the following changes:

  • Added support for CSS animations
  • Tuned HTTP idle connection logic for increased performance
  • Improved canvas, JavaScript, memory, and networking performance
  • Improved standards support for HTML5, XHR, MathML, SMIL, and canvas
  • Improved spell checking for some locales
  • Improved desktop environment integration for Linux users
  • WebGL content can no longer load cross-domain textures
  • Background tabs have setTimeout and setInterval clamped to 1000ms to improve performance.
Fixed in Firefox 5
  • It was possible for a non-whitelisted site to trigger an install dialog for add-ons and themes.
  • HTML-encoded entities were being improperly decoded when displayed inside SVG elements. This could lead to XSS attacks on sites relying on HTML encoding of user-supplied content.
  • Two crashes in WebGL code. One crash was the result of an out-of-bounds read and could be used to read data from other processes who had stored data in the GPU. The severity of this issue was determined to be high. The second crash was the result of an invalid write and could be used to execute arbitrary code. The severity of this issue was determined to be critical.
  • An image from a different domain could be loaded into a WebGL texture, and then each pixel could be rendered into a canvas element with a shader program, creating an approximation of the image in a form that was readable by the creator of the WebGL texture. This could be used to steal image data from a different site and is considered a violation of the same-origin policy.
  • When a JavaScript Array object had its length set to an extremely large value, the iteration of array elements that occurs when its reduceRight method was subsequently called could result in the execution of attacker controlled memory due to an invalid index value being used to access element properties.
  • A crash on multipart/x-mixed-replace images due to memory corruption.
  • Under certain conditions, viewing a XUL document while JavaScript caused deleted memory to be accessed. This flaw could potentially be used by an attacker to crash a victim's browser and run arbitrary code on their computer.
  • Several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products have been fixed. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Click Here to Download

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

19 Years Old Guy get Busted by London Police in Sony Hacking Case


A teenager has been arrested near London in connection with the hacking of Sony, London's Metropolitan Police said Tuesday. The 19-year-old is suspected of hacking into systems and mounting denial of service attacks against "a number of international businesses and intelligence agencies," police said. Naming suspects who have been arrested in Britain is illegal. Sony's PlayStation Network went down on April 20 after what Sony said was a massive data breach. It had more than 70 million subscribers at the time. It began coming back on line in mid-May. The PlayStation Store did not reopen until June 2.

The company estimated the cost of that attack will total $171 million. Hackers later broke into Sony Pictures website, compromising the accounts of over 1 million users, and the gaming company SEGA, stealing nearly 1.3 million users' details via a British subsidiary of the Japanese company. SEGA makes games for PlayStation and other gaming systems. The suspect's computer "will now be examined for ties to any potential group, including LulzSec," a police spokesman told CNN, declining to be named in line with custom. "This link has not been established yet as it is still early days," the spokesman said. The hacker group LulzSec claimed recently to have attacked the CIA website, and took credit for hacking into the website of the American public broadcaster PBS and posting a fake story saying the rapper Tupac Shakur was still alive. He was killed nearly 15 years ago. It's unclear whether LulzSec members played a role in the Sony PlayStation Network breach. But they have posted on their website what they claim is proprietary information from Sony Pictures and other Sony properties' websites. On Friday, on the occasion of their 1,000th tweet, the group posted a manifesto of sorts in which they said people, including their targets and advocates of Internet freedom, should be thankful. "The main anti-LulzSec argument suggests that ... our actions are causing clowns with pens to write new rules for you," the group wrote. "But what if we just hadn't released anything? What if we were silent? That would mean we would be secretly inside FBI affiliates right now, inside PBS, inside Sony... watching... abusing... ."
They seemed to suggest that by making their attacks public, they'll push websites to increase security. They said they're sitting on account information for 200,000 players of the online game Brink, but moments later said that releasing people's information is worth doing sometimes because it's fun. 
"Yes, yes, there's always the argument that releasing everything in full is just as evil, what with accounts being stolen and abused, but welcome to 2011," they wrote. "This is the lulz lizard era, where we do things just because we find it entertaining."
Analysts said the group appears to be some sort of spin-off of "Anonymous," the loose coalition of hackers that grew to prominence through their support of the whistle-blower site WikiLeaks.
But while Anonymous has its own set of moral codes and is largely politically motivated, LulzSec seems to be random.
For every hack like the one on PBS, which the group said came out of anger over a documentary about WikiLeaks, there's the cracking of porn site pron.com -- and a subsequent public list of members' e-mail addresses and passwords.
LulzSec has not yet posted a comment on the arrest of the teen in Essex, outside London, which police said was "intelligence-led."
The suspect was arrested Monday night and police are now examining a "significant amount of material," they said.


The Suspect Details:- 
Name: Mr Ryan Cleary
Alias: viraL
Age: 18-19
Address: 10 South Beech Avenue Wickford SS11 8AH
Phone Number: +447510557265
-NEWS SOURCE (CNN)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Nokia will Launch Mobiles with Microsoft Platform In 2011


Nokia is facing steep competition from competitors in several products. At the top end of the market it is struggling against smart phones such as Apple's iPhone, Research in Motion's Blackberry as well as Android, and on the lower end against emerging market phone makers who are dropping their prices.Nokia will start to deliver the Windows-based mobile phones in bulk next year, CEO Stephen Elop said in a speech at a technology trade show in Singapore. Finnish handset maker Nokia Corp. plans to introduce its first mobile phones using the Microsoft Windows operating system this year, the company's chief executive said Tuesday.  "Our primary smartphone strategy is to focus on the Windows phone," Elop said. "I have increased confidence that we will launch our first device based on the Windows platform later this year and we will ship our product in volume in 2012." Elop has acknowledged Nokia has been too slow to meet the challenge from competitors and has hinted that the company would drop its cellphone prices. Last month, the company warned both sales and profit margins in the second quarter would be substantially below previous forecasts. Nokia also unveiled Tuesday its N9 smartphone, which is based on the MeeGo platform. The company said it plans to launch up to 10 new Symbian-based smartphones over the next 12 months. Elop said the N9 would go on sale later this year, but declined to specify the date or price. Nokia developed MeeGo last year in a partnership with U.S. chipmaker Intel Corp. In February, Nokia turned to Microsoft's Windows Phone software as its main smartphone operating system.

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Gurukul Lutheran Theological College and Research Institute Site Hacked by Bl@ckZero



Gurukul Lutheran Theological College and Research Institute of  Chennai, India Hacked by BlackZero, Pakistani hacker


Hacked Site:-
http://gltc.edu/

Mirror Link:-
http://legend-h.org/mirror/182012/gltc.edu/
http://mirror.sec-t.net/defacements/?id=43524

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

4 Website Hacked by ZCompany Hacking Crew

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-

Related Posts Plugin for WordPress, Blogger...