Read more of this story at Slashdot.
Feeds
31318 items (26805 unread) in 5 feeds
OpenSource
(5373 unread)
-
SourceForge.net: Front page news
(802 unread)
-
Slashdot: IT (4571 unread)
Security
(9896 unread)
-
Digg / Security (9896 unread)
Linux
(11536 unread)
-
-
Slashdot: Linux (1583 unread)
Slashdot: IT (3 unread)
-
Nasty Data-Stealing Bug Haunts Internet Explorer 8
Posted: September 4th, 2010, 11:48pm CEST by Soulskill
Tags: msie
Trailrunner7 writes "There's an unpatched vulnerability in Internet Explorer 8 that enables simple data-stealing attacks by Web-based attackers and could lead to an attacker hijacking a user's authenticated session on a third-party site. The flaw, which a researcher said may have been known since 2008, lies in the way IE8 handles CSS. The vulnerability can be exploited through an attack scenario known as cross-domain theft, and researcher Chris Evans originally brought the problem to light in a blog post in December. At the time, all of the major browsers were vulnerable to the attack, but since then, Firefox, Chrome, Safari and Opera all have implemented a simple defense mechanism. The upshot of this is that if a victim has visited a given Web site, authenticated himself to the site, and then visits a site controlled by an attacker, the attacker would have the ability to hijack the user's session and extract supposedly confidential data. This attack works on the latest, fully patched release of IE8." -
Spammers Attack Apple's Ping Social Network
Posted: September 4th, 2010, 3:29pm CEST by Soulskill
Tags: spam
An anonymous reader writes "Scammers and spammers have deluged the new Ping musical social network, created by Apple and built into the new version of iTunes. Sophos researchers have found that Ping is being overrun by scams and spam messages. 'Apple seems to have anticipated a certain degree of malfeasance, as profile pictures that you upload will not appear until approved by Apple. They are likely filtering for other offensive content as well, so they probably have means in place they could use to stop the spam.' It's ironic that the most common scams on Ping right now revolve around Apple's own iPhone." The Sophos blog post adds that Apple is doing their best to clamp down on the spam, manually deleting many of the offending messages for now. Reader Tootech adds that Facebook integration was quickly disabled, possibly because of blocked API access.Read more of this story at Slashdot.
-
Google Wave To Live On As 'Wave In a Box'
Posted: September 4th, 2010, 5:33am CEST by timothy
Tags: google
snydeq writes "Google Wave will morph into an application bundle for real-time collaboration, according to a blog post by Google Wave engineer Alex North. 'We will expand upon the 200K lines of code we've already open sourced (detailed at waveprotocol.org) to flesh out the existing example Wave server and Web client into a more complete application or "Wave in a Box,"' North said, adding that the future of the recently flat-lined Google service will be 'defined by your contributions. We hope this project will help the Wave developer community continue to grow and evolve,' he said."Read more of this story at Slashdot.