Moz Firefox Shipped Malware Attached to Extention: Security Posted by: comforteagle From the Knowing is Better Than Not dept.: The Vietnamese language pack for Firefox 2 contains inserted code to load remote content. This code is the result of a virus infection, but does not contain the virus itself. This usually results in the user seeing unwanted ads, but may be used for more malicious actions. Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy. While we cannot determine the exact number of compromised downloads, there have been 16,667 total downloads of the Vietnamese language pack since November 2007, so we anticipate the impact on users to be limited. Published May 08, 2008 - 09:45 AM Read more... Comment

Google Starts OS Security Group: Security Posted by: comforteagle From the Help from Above dept.: Google is spearheading a volunteer workforce it hopes will become the centralized authority for responding to security issues in open source software. oCERT, short for the open source computer emergency response team, will aim to remediate security vulnerabilities and exploits in a wide range of open source programs by coordinating communication among publishers. According to Google's security blog, the group "will strive to contact software authors with all security reports and aid in debugging and patching, especially in cases where the author, or the reporter, doesn't have a background in security." Published May 07, 2008 - 09:51 AM Read more... Comment

OpenSSH 5.0: Security Posted by: comforteagle From the foo update openssh dept.: We apologise for any inconvenience resulting from this release being made so shortly after 4.9. Unfortunately we only learned of the below security issue from the public CVE report. The Debian OpenSSH maintainers responsible for handling the initial report of this bug failed to report it via either the private OpenSSH security contact list (openssh@openssh.com) or the portable OpenSSH Bugzilla (http://bugzilla.mindrot.org/). Published Apr 04, 2008 - 09:24 AM Read more... Comment

Source Code for Red Hat Certificate System Released: Security Posted by: comforteagle From the Papers Please dept.: Red Hat Certificate System was acquired from AOL three years ago as part of the Netscape technology acquisition. In keeping with our commitment to open source software, today Red Hat has released all of the source code to Red Hat Certificate System. Much of the technology in Red Hat Certificate System was already open source, including the Apache web server, Red Hat Directory Server and the FIPS140-2 level 2 validated NSS cryptographic libraries, but today’s move further demonstrates Red Hat’s belief that the open source development model creates more secure software. Published Mar 20, 2008 - 01:34 PM Read more... Comment

Ubuntu Gets SELinux: Security Posted by: comforteagle From the Options dept.: I’m really happy to announce that SELinux is now available in Ubuntu 8.04 “Hardy Heron�. This is the result of the amazing work of the ubuntu-security and ubuntu-hardened teams, as well as the huge contributions from the folks at Tresys. Published Mar 19, 2008 - 11:00 AM Read more... Comment

phpBB Massive Hack: Security Posted by: comforteagle Popularity Contest dept.: Hot on the heels of a recent hack in which 10,000 sites were compromised, researchers have disclosed a new large-scale attack.. Researchers at McAfee estimated that the attack has been active for roughly one week, and in that time frame has managed to place itself on roughly 200,000 web pages. Published Mar 18, 2008 - 09:14 AM Read more... Comment

OpenSSH 4.7 released: Security Posted by: comforteagle From the Shhh SSH dept.: OpenSSH 4.7 has just been released. ...Changes since OpenSSH 4.6: Published Sep 05, 2007 - 07:17 PM Read more... Comment

Spyware: Is Any OS Really Safe?: Security Posted by: gundeep Some will argue that Vista is now offering a safe Windows option, and that OS X and Linux were never targets to begin with. This is true enough to a point, but spyware is a big business, and I’m quite sure that it’s a business that has every intention of sticking around for as long as possible. Published Jan 30, 2007 - 08:07 AM Read more... Comment

Alan Cox argues against security liability: Security Posted by: comforteagle From the Unfit dept.: Alan Cox, one of the leading Linux kernel developers, has told a House of Lords hearing that neither open- nor closed-source developers should be liable for the security of the code they write. Published Jan 19, 2007 - 01:19 PM Read more... Comment

Apple Not Scared of Security Holes: Security Posted by: gundeep On Windows, the idea of finding security holes in the operating system is so commonplace that it’s completely ridiculous. When XP was first released, many users had more impetus to report these problems and stay on Microsoft’s case until they were resolved. The OS was relatively new, and we wanted to get the best possible experience out of it. After all, Microsoft continually touted the eXPerience that XP would make possible in its marketing campaigns, and we were going to hold them to it. Published Jan 17, 2007 - 08:46 AM Read more... Comment