SecurityWeek

Invincea Gets $21.4 Million Contract to Harden Android OS for U.S. Army

Qualys, the soon-to-go-public provider of cloud security and compliance solutions, today said that its flagship QualysGuard Web Application Scanning (WAS) service will be able to help customers identify Web application cookies in order to help organizations comply with the European Union (EU) Cookie Directive that will be enforced in the United Kingdom (UK) effective on May 26, 2012.

Each year, security experts and IT experts take a hard look at the threats that dominated in years past in an effort to prepare for the future. While hacker groups and technology are evolving faster than ever, there are still trends we can spot if we take a far and wide enough step back to see the whole picture. The annual Verizon Data Breach Investigations report shines some holistic light on what’s been happening in the world of cybercrime. Here’s...

Cisco Addresses Code execution and DoS Vulnerabilities Cisco has issued three security advisories that address vulnerabilities within Cisco ASA and ASASM, their AnyConnect Secure Mobility Client, and Application Control Engine (ACE). According to their warnings, Cisco says that the issues could lead to code execution in some cases, or denial of service in others.

Michael Barrett, PayPal's CISO, was initially against the idea of paying people who reported security problems properly. However, after seeing the success of the bug bounty programs launched by Mozilla, Google, and Facebook, he’s had a change of heart. So on Thursday, PayPal officially launched a bounty program of their own, becoming the first financial firm on the Web to do so in the process.

For the last two weeks, based on reports to and observations made by Symantec, an established family of malware has been launching print jobs that do nothing but waste paper.

A Russian security firm, using a combination of TCP scans and Google, found that nearly a quarter of the organizations running vulnerable versions of SAP are tempting fate by leaving them exposed to the Internet. This discovery, the research says, dispels the myth that SAP systems are only available from the internal network, leading to the misconception that they are protected by design.

LinkedIn Law Suit Seeks $5M In Damages Over Lax Security Practices

According to comments made on Iran’s state-ran television by Intelligence Minister Heydar Moslehi, the nation has detected another cyber attack aimed at their nuclear facilities. These claims come shortly after the New York Times and Washington Post independently revealed that the U.S., along with Israel, used Stuxnet and Flame to target Iran’s nuclear program.Iran's Intelligence Minister Heydar Moslehi made the comments Thursday afternoon.

Researchers at ESET have uncovered a new worm that is stealing AutoCAD drawings and designs, and shipping them off to an email account that appears to be in China. Given the hype around Stuxnet and other focused code, the appearance of this worm took ESET researchers by surprise.The malware itself is written in AutoLISP, the scripting language used by AutoCAD. Over the last two months, the worm – called ACAD/Medre.A – has remained focused on Latin America, most notably Peru.

Face.com, the facial recognition start-up recently purchased by Facebook, has patched a vulnerability in its KLIK application that could have enabled attackers to compromise Twitter and Facebook accounts. The vulnerability was reported by independent security researcher Ashkan Soltani. KLIK is an iPhone camera app designed to make it easy for Facebook users to tag their friends in photos using facial recognition technology.

Microsoft Reveals Finalists of BlueHat Prize Security Research Contest

On the 5th of June, a hacker uploaded a file containing approximately 6.5 million of LinkedIn’s passwords (encoded as SHA-1 hashes).

The description leaps off the pages like a Hollywood blockbuster in the making.

Security firm Sophos has issued alerts on to two separate, but related attacks, targeting a European aeronautical parts supplier and a European medical company. In each case, the attackers are using an unpatched vulnerability in Internet Explorer to target their victims.