News, Reviews and more from Australia's Macintosh Authority

Once thought safe, WPA Wi-Fi encryption is cracked

Security researchers say they've developed a way to partially crack the Wi-Fi Protected Access (WPA) encryption standard used to protect data on many wireless networks.

Robert McMillan | Nov 7, 2008

Adobe fixes ‘clickjacking’ flaw

Adobe Systems has released a new version of its Flash Player software, fixing a critical security bug that could make the Internet a dangerous place for Web surfers.

Robert McMillan | Oct 17, 2008

Kaminsky: many ways to attack DNS

There were 6am calls from Finnish certificate authorities and also some pretty harsh words from his peers in the security community, even an accidentally leaked Black Hat presentation, but after managing the response to one of the most highly publicised internet flaws in recent memory, Dan Kaminsky said Wednesday that he’d do it all over again.

Robert McMillan | Aug 7, 2008

Flash flaw flurry false?

After warning on Tuesday that hackers were exploiting an unpatched bug in Adobe Systems’ Flash Player software, Symantec has backtracked from this claim, saying the flaw is “very similar” to another vulnerability that was patched last month. Symantec’s initial warning described a disturbing threat — a previously unknown and unpatched flaw that was being exploited on tens of thousands of web pages. The flaw allowed attackers to install unauthorised software on a victim’s machine and was being used to install botnet programs and password-logging software, Symantec said.

Robert McMillan | May 29, 2008

Flash flaw fuels fears

An unpatched bug in Adobe Systems' Flash Player software is being exploited by online criminals, Symantec reported Monday. "We've seen a new, previously undisclosed vulnerability in Flash that is actually being exploited in the wild," said Oliver Friedrichs, a director with Symantec Security Response. The attacks are relatively widespread, too, according to McAfee. Criminals have hacked into about 220,000 web pages and added scripts to these pages that redirect victims to one of at least 57 web servers that actually serve up the attack code. Once a computer has been compromised, the attackers try to install several malicious programs, such as remote-control botnet software and programs designed to steal World of Warcraft usernames and passwords.

Robert McMillan | May 28, 2008

PayPal says avoid Safari

If you're using Apple's Safari browser, PayPal has some advice for you: Drop it, at least if you want to avoid online fraud. Safari doesn't make PayPal's list of recommended browsers because it doesn't have two important anti-phishing security features, according to Michael Barrett, PayPal's chief information security officer. "Apple, unfortunately, is lagging behind what they need to do, to protect their customers," Barrett said in an interview. "Our recommendation at this point, to our customers, is use Internet Explorer 7 or 8 when it comes out, or Firefox 2 or Firefox 3, or indeed Opera." Safari is the default browser on Apple's Macintosh computers and the iPhone, but it is also available for the PC. Both Firefox and Opera run on the Mac. Unlike its competitors, Safari has no built-in phishing filter to warn users when they are visiting suspicious Web sites, Barrett said. Another problem is Safari's lack of support for another anti-phishing technology, called Extended Validation (EV) certificates. This is a secure Web browsing technology that turns the address bar green when the browser is visiting a legitimate Web site.

Robert McMillan | Feb 29, 2008