Autofill Bug In Safari Exposes Personal Information

Apple has left an autofill bug in Safari unpatched that could potentially expose personal information you would never intend for anyone else to see.

Apples Autofill feature allows you to quickly fill out forms that you have previously entered, including credit card information and social security numbers.

A security expert has figured out a way of getting that information by tricking you to hit two keys: the "U" key and the "tab" keys. In theory you could place a hidden form behind a game on a web page that utilizes these keys and tricks you into filling out the form, and stealing your information.

Jeremiah Grossman discovered the bug and you can see a video of the flaw being demonstrated on his site under his entry: The Safari AutoFill Hack Lives!

Cyber Warfare Takes Another Possible Leap Forward, Stuxnet Worm Infecting SCADA Systems and Hit’s Iranian Nuclear Facilities Hard

Updated on Monday, September 27, 2010 at 7:18PM by Keith Erwood

Many people (most security experts aside) who work with industrial SCADA (Supervisory Control and Data Acquisition) and PLC (Programmable Logic Controllers) systems have long considered these systems safe. In fact if you check the reference sources at the bottom, you will notice a recurring theme of, if you asked me if this was possible last week, I would have said no. I have personally had people tell me they are safe from these kinds of threats because they have multiple layers of firewall's and other "robust" cyber security in place. These people are wrong, and I hope this incident serves as a wakeup call to others who work with these systems everyday. Bottom line - All systems are vulnerable. A worm known as Stuxnet has infected systems from several countries including those of the United States, Indonesia, India, and Iran.

Click to read more ...

15 Minutes to Apocalypse – The Cyber Warfare Threat

When most people think of cyber warfare, they are probably thinking of a battle taking place sometime in the future. The other thought most people probably have is they think the United States as a being a leader in this area.

The truth is cyber warfare is already here and the United States is lagging far behind. Not only that but a majority of all services deemed as critical infrastructure are in the hands or under control of the private sector.

Currently 30 countries are known to have viable offensive and defensive cyber warfare capabilities with the top potential threats recognized as being Russia, China, and believe it or not North Korea, which is also the most dangerous country to have these capabilities. North Korea has already taken out systems run by the U.S. Treasury, Secret Service, and Federal Trade Commission.

Cyber warfare is a reality in today's world - Timeline of Cyber Attacks since May 2006 - which will likely be used in combination with conventional attacks and as stand alone attacks far into the future from here on.

While some point to these threats as fear mongering, unrealistic, and even as impossible to pull off I would venture to say they do not fully appreciate just how vulnerable we are should a massive attack bring down much of our infrastructure.

One thing to note about these types of attacks is the social engineering aspect, which no amount of security hardware or software can protect against. We need to better train employees to understand phishing attacks, to guard passwords, what to look and listen for during the social engineer aspect of any attack. Good security practices should incorporate continuous training with real world examples.

As the recent attacks against Google, Rackspace and others showed our private sector is just as much a target for malicious attacks. We must remain vigilant and proper training training is an important part of securing our networks.

See the Reference link below for more detailed information on this.

Possible Human Error Causes Rapid Market Decline

I was going to post something on Human Error in a later post, but in light of today's alleged incident in the U.S. Markets which caused a nearly 1000 point drop in the Dow I thought I would at least touch on it.

Currently here is what we know about the alleged incident - (Which is still being investigated) A trader at Citi entered a "B" for Billion instead of an "M" for Million. This in turn caused a nearly $10 {CORRECTION it was about $20 give or take a few} stock price dip in PG, and subsequently caused the rest of the market to drop before recovering. 

On the good side, these things can be researched, and fixed. However, in an already skittish and heavily volitile market it can easily cause additional panic by the average investor.

In addition to other issues, it has already been proposed that someone else who knows what they are doing could easily manipulate the market and cause an intentional crash (I believe the commentators were implying a cyber-terror event).

Already the investigations by the SEC have begun and we will have to wait and see what the outcome will be.

Look for a future post coming soon about Human Error and the Impact on Business coming soon.

Google Takes New Approach with China Censorship in Response to Hacks

In response to what is being called a sophisticated cyber attack back on January 12th, Google stopped censoring searches in China by redirecting traffic to Hong Kong earlier today.

Here is the full announcement from the Official Google Blog:

A new approach to China: an update

3/22/2010 12:03:00 PM

On January 12, we announced on this blog that Google and more than twenty other U.S. companies had been the victims of a sophisticated cyber attack originating from China, and that during our investigation into these attacks we had uncovered evidence to suggest that the Gmail accounts of dozens of human rights activists connected with China were being routinely accessed by third parties, most likely via phishing scams or malware placed on their computers. We also made clear that these attacks and the surveillance they uncovered—combined with attempts over the last year to further limit free speech on the web in China including the persistent blocking of websites such as Facebook, Twitter, YouTube, Google Docs and Blogger—had led us to conclude that we could no longer continue censoring our results on Google.cn.

So earlier today we stopped censoring our search services—Google Search, Google News, and Google Images—on Google.cn. Users visiting Google.cn are now being redirected to Google.com.hk, where we are offering uncensored search in simplified Chinese, specifically designed for users in mainland China and delivered via our servers in Hong Kong. Users in Hong Kong will continue to receive their existing uncensored, traditional Chinese service, also from Google.com.hk. Due to the increased load on our Hong Kong servers and the complicated nature of these changes, users may see some slowdown in service or find some products temporarily inaccessible as we switch everything over.

Figuring out how to make good on our promise to stop censoring search on Google.cn has been hard. We want as many people in the world as possible to have access to our services, including users in mainland China, yet the Chinese government has been crystal clear throughout our discussions that self-censorship is a non-negotiable legal requirement. We believe this new approach of providing uncensored search in simplified Chinese from Google.com.hk is a sensible solution to the challenges we've faced—it's entirely legal and will meaningfully increase access to information for people in China. We very much hope that the Chinese government respects our decision, though we are well aware that it could at any time block access to our services. We will therefore be carefully monitoring access issues, and have created this new web page, which we will update regularly each day, so that everyone can see which Google services are available in China.

In terms of Google's wider business operations, we intend to continue R&D work in China and also to maintain a sales presence there, though the size of the sales team will obviously be partially dependent on the ability of mainland Chinese users to access Google.com.hk. Finally, we would like to make clear that all these decisions have been driven and implemented by our executives in the United States, and that none of our employees in China can, or should, be held responsible for them. Despite all the uncertainty and difficulties they have faced since we made our announcement in January, they have continued to focus on serving our Chinese users and customers. We are immensely proud of them.

Posted by David Drummond, SVP, Corporate Development and Chief Legal Officer.