Stories by Lucian Constantin

Chrome will block NPAPI plug-ins over stability, security concerns

Plug-ins based on the NPAPI architecture will be blocked by default in Chrome starting early next year as Google moves toward completely removing support for them in the browser.

Apache Struts security update disables vulnerable feature

A new version of the Apache Struts development framework released Friday fixes two problems that had developers worried.

Rogue hardware used in attempted cyberheist at Santander bank branch

A criminal gang attempted to plant a rogue hardware device on the network of a Santander bank branch in London to remotely control a computer and steal money.

Oracle adds long-awaited whitelisting capabilities to Java

Oracle added a feature in Java that lets companies control what specific Java applets are allowed to run on their endpoint computers, which could help them better manage Java security risks.

Cyberspies attack key South Korean institutions, North Korean hackers suspected

South Korean organizations that conduct research on international affairs, national security and Korean unification are under siege from cyberspies whose attack may have its origins in North Korea.

Adobe issues critical security updates for Flash Player, Reader and Shockwave Player

Adobe released security updates for Flash Player, Adobe Reader and Shockwave Player on Tuesday to address critical vulnerabilities that could allow attackers to take control of systems running vulnerable versions of those programs.

Fingerprint sensor in iPhone 5S is no silver bullet, researchers say

The fingerprint sensor in Apple's new iPhone 5S has the potential to enhance the security of the device, but the devil will be in the details.

Email spam campaign distributes Android scareware

Android malware is following in the footsteps of Windows malware with attackers adopting some of the same distribution and monetization techniques despite the major differences between the platforms.

Leaked US spying budget reveals investments in 'groundbreaking' cryptanalysis

The U.S. intelligence community is reportedly using a fifth of its US$52.6 billion annual budget to fund cryptography-related programs and operations.

Cisco fixes critical remote command execution vulnerability in Secure Access Control Server

Cisco Systems released security patches for Secure Access Control Server (Secure ACS) for Windows to address a critical vulnerability that could allow unauthenticated attackers to remotely execute arbitrary commands and take control of the underlying operating system.

vBulletin users warned of potential exploit

The developers of the popular vBulletin commercial Internet forum software are investigating a potential exploit and advised users to delete the "install" directory from their deployments as a precaution.

Spear phishing led to DNS attack against the New York Times, others

The cyberattack that resulted in nytimes.com and some other high-profile websites being inaccessible to a large number of users Tuesday started with a targeted phishing attack against a reseller for Melbourne IT, an Australian domain registrar and IT services company.

Cybercrime service automates creation of fake scanned IDs, other identity verification documents

A new Web-based service for cybercriminals automates the creation of fake scanned documents that can help fraudsters bypass the identity verification processes used by some banks, e-commerce businesses and other online services providers, according to researchers from Russian cybercrime investigations firm Group-IB.

Report: NSA broke into UN video teleconferencing system

The U.S. National Security Agency reportedly cracked the encryption used by the video teleconferencing system at the United Nations headquarters in New York City.

Mozilla considers rejecting long-lived digital certificates following similar decision by Google

Mozilla is considering the possibility of rejecting as invalid SSL certificates issued after July 1, 2012, with a validity period of more than 60 months. Google already made the decision to block such certificates in Chrome starting early next year.