The FORWARD project blog

Imperva announced their Top 10 Security Threats for 2011, which include:

1. Nation-sponsored hacking: Advanced technological threats (hacker industry and APT) from hackers who are funded by a government, like Stuxnet.
2. Insider Threats: A company may be threatened by an employee – hacker, or a hacker outside the workplace, who owns a employee’s profile. Access Control will be a key factor in neutralizing this threat.
3. Man in the Browser Attacks: Similar to the “man-in-the-middle” attacks, where a trojan is used to interrupt the communication between the browser and security mechanisms or libraries. The main purpose is to cause a financial scam in control transactions through the Internet, even if authentication operates well.
4. Misanthropes and anti-socials: Privacy vs. security in social networks: In 2011, popular social networks and tools will make more efforts into security over privacy. This is not the result of resolving privacy issues, but rather an understanding of the real threats to the existence and spread of social networks.
5. Data Loss: All the data we collect on everything needs to be locked down.
6. Cloud Security: Including computer security, network security, information security. References to a wide range of principles, technologies and controls designed to protect data, applications and related infrastructure of cloud computing.
7. Mobile Devices: Τhe mobile internet, online applications, which are usually technologically complex, make mobile devices vulnerable to threats.
8. Hackers and Criminal Networks: The “hacker industry” invests more resources in the attack techniques and detection evasion.
9. Consolidation: Cyber security has become a business process and can not be separated from the business operations.
10. Regulation: Convergence of data security and privacy regulation worldwide as governments tighten the legal screws on enterprises.

Source: http://www.net-security.org/secworld.php?id=10154

Some of the most popular web sites are exploiting a flaw to gain access to read browser’s Web history, according to researchers at University of California, San Diego. Their study tracked the the 50,000 most popular websites and found that 485 sites are exploiting the history-sniffing flaw, and 46 of those sites are actively downloading browser history, including youporn.com, gamesfreak.com, newsmax.com, morningstar.com and espnf1.com.

History sniffing called the combination of JavaScript and Cascading Style Sheet (CSS) properties that enables the sites to figure out where a user has been on the Web by changing the color of the links that the user has visited. The researchers’ findings are published in a new study entitled “An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications.”

According to the researcher’s, about 18, such as Gamestorrents.com, are using the exploit to analyze a user’s past visits to more than 220 sites. YouPorn.com, an amateur porn site and one of the 100 most visited sites on the Web, analyzes the browsing history for more than 21 sites, encoding its JavaScript to hide the sites it searches for and decodes it only when used, to cover its tracks.

The widely known vulnerability that these sites exploit exists in all production version browsers except of Apple’s Safari, which first detected the threat. Google Chrome and Mozilla Firefox soon followed. Internet Explorer may also defend against this attack if browser is used in private browsing mode. Production versions of those browsers are still wide open.

The study also detected sites maintained by Microsoft, YouTube, Yahoo and About.com that employ JavaScript tracking mouse movements on a page to detect what a user does after visiting it.