Mozilla to Enforce Signing for Firefox Extensions Soon

In an effort to head off the problem of malicious or misbehaving browser add-ons, Mozilla is planning to require developers to have their Firefox extensions signed by the company in the near future. As much of users’ computing has moved into their browsers in the last few years, extensions and...

CoolReaper Backdoor Found On CoolPad Android Mobile Devices

A popular Android smartphone sold primarily in China and Taiwan but also available worldwide, contains a backdoor from the manufacturer that is being used to push pop-up advertisements and install apps without users’ consent. The Coolpad devices, however, are ripe for much more malicious abuse,...

FTC Discusses Regulating User-Generated Health Information

The proliferation of wearable devices coupled with smartphone apps that monitor heart rates and other health metrics raises an important question: How exactly should the information generated by these devices be regulated? If there’s a fist fight in a bar can a person’s Fitbit accelerator be...

With a Warning FTC Approves WhatsApp, Facebook Union

Facebook’s acquisition of messaging application WhatsApp was approved by the Federal Trade Commission late last week, but not without a stern notice from the agency, which warned that it would be keeping a watchful eye on the two companies going forward. In a letter addressed to officials at...

Android Vulnerability: Install App Without User Explicit Consent

This vulnerability allows an app to install any number of apps with any type of permissions without user's explicit consent. It is based on two things: 1. You can install an app from Google Play using just the browser, even from PC. 2. An app can embed a browser and automatically login into your...

Information disclosure vulnerability in Sleipnir Mobile for Android

Overview Sleipnir Mobile for Android contains an issue in handling Geolocation API, which may result in the disclosure of a user's location. Sleipnir Mobile for Android is a web browser for Android devices. Sleipnir Mobile for Android contains an issue in handling Geolocation API, which may resul...

Java based cross platform malware found in wild

Other than Windows, Now other platforms are becoming more popular every day and attracting bad guys who are starting to create malicious code for other systems. Java applications can run on multiple platforms with ease, thus no surprise that malicious code written in Java that is designed to targ...

BlackBerry Refutes Claim Private Email Passwords Sent to RIM

BlackBerry is refuting a claim made by a German researcher that private email credentials are sent by the new BlackBerry 10 mobile devices to the company without consent, possibly in the clear, and that they’re also stored without permission. Frank Rieger said that when users enter their POP/IMAP...

Mozilla Delays Third-Party Cookie Patch in Firefox

Mozilla has tapped the brakes on its plans to block third-party cookies by default in the Firefox browser. Test versions of Firefox 22, scheduled for a June release, were supposed to include a patch that blocked third-party cookie drops by default. However, Mozilla CTO Brendan Eich said yesterday...

Instagram Privacy Changes Start Clock Ticking for Users Who Want to Opt-Out

Instagram users have some soul searching to do between now and Jan. 16 when new terms of service kick in that give the photo-sharing social network the right to sell personal photos without the user’s permission or compensating them. The most startling change reads: “To help us deliver interestin...

FreeBSD : bugzilla -- multiple vulnerabilities (0c7a3ee2-3654-11e1-b404-20cf30e32f6d)

A Bugzilla Security Advisory reports : The following security issues have been discovered in Bugzilla : - Tabular and graphical reports, as well as new charts have a debug mode which displays raw data as plain text. This text is not correctly escaped and a crafted URL could use this vulnerability...

Report: FTC Nears Deal with Facebook For Opt-In Privacy Changes

The deal will settle an FTC case alleging privacy violations on the social network by forcing users to opt in to any changes to default privacy settings, according to a report in the Wall Street Journal. The FTC inquiry dates back more than two years, and followed changes to the default privacy...

Cross Site Request Forgery - Deleting User's Dashboards

Security auditing tests performed on a Jira Bug Issue and Project Tracking Software locally running instance shown that the application is succeptible to Cross-Site Request Forgery attacks within this URL:...

Blowback: Microsoft, OnStar Pump the Brakes on Location Tracking

Redmond, Washington software giant, Microsoft, and Detroit based GM subsidiary, OnStar backtracked on policies widely seen as egregious privacy violations following lawsuits and public outcry. Here’s the news: Windows Phone Update Requires User Consent For Tracking Microsoft released their “Mango...

Congress to Apple: You Got Some Splainin to do

In a letter to the chairman of the Federal Trade Commission, Jay Inslee D-Wash. expressed concerns regarding recent revelations that Apple products have been continuously tracking and recording user location information with questionable consent and without an easy way to opt out of such tracking...

Forget Epsilon, Fear the Angry Bird

No doubt you read about the huge email security breach Epsilon announced earlier this month. You may have received letters from companies that use Epsilon services about the possible loss of your email information. A lot of people are justifiably concerned that spear phishing and other nefarious...

Opinion: Google's DroidDream Patch Pushes The Envelope

Google announced plans yesterday to fortify the Android Market in response to the appearance of the DroidDream Trojan, but do the company’s plans cross the line from innovative to intrusive? In a blog post, Kaspersky Labs researcher Timothy Armstrong warns that the search giant’s plans to repair...

Autodesk AutoCAD 2007 dll Hijacking exploit (color.dll)

No description provided by source. / Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Title: Autocad 2007 Professional dll color.dll...

Free Blocking Tool to Thwart Drive-By Downloads

Researchers are preparing to release a free tool to stop “drive-by” downloads: Internet attacks in which the mere act of visiting a Web site results in the surreptitious installation of malicious software. The new tool, called BLADE Block All Drive-By Download Exploits, stops downloads that are...

Internet Explorer vulnerable in handling CDO protocol

Overview Internet Explorer is vulnerable in handling CDO Collaboration Data Objects protocol, which allows the download dialog box to be bypassed. When Internet Explorer IE accesses a website using CDO Collaboration Data Objects, IE processes the contents as CDO data, ignoring their actual conten...