Apple plugs 25 Mac OS X security vulnerabilities   30 Jun 2008 21:10 GMT
Apple has shipped another Mac OS X monster update to fix a total of 25 documented vulnerabilities that could lead to arbitrary code execution attacks. With Security Update 2008-004, Apple fixes code execution flaws in Launch Services, SMB File Server, System Configuration, VPN and WebKit. ...
Source: ZDNet

Big Brother Getting Bigger Part 1: USA   30 Jun 2008 18:01 GMT
Eek, from Slashdot today: The FBI has confirmed to Popular Mechanics that it's not only adding palm prints to its criminal records, but preparing to balloon its repository of photos, which an agency official says 'could be the basis for our facial recognition.' It's all part of a new...
Source: ZDNet

Survey: More than 10,000 laptops lost each week at airports   30 Jun 2008 13:00 GMT
Close to 637,000 laptops are reported lost at 106 U.S. airports each year, according to a survey by the Ponemon Institute.

Source: Computerworld

Apple patches 25 Mac OS X security vulnerabilities   30 Jun 2008 13:00 GMT
Apple today released the fourth Mac OS X security update of the year and issued an update to the operating system that brings it to version 10.5.4.

Source: Computerworld

News to know: Phishing; Gates gone; Google; Hyper-V   30 Jun 2008 09:24 GMT
Notable headlines: Dancho Danchev: HSBC sites vulnerable to XSS flaws, could aid phishing attacks TechRepublic: Most report their IT career has been better than they expected Mary Jo Foley: J Allard gets a new job Mystery explained: Why...
Source: ZDNet

Microsoft Can't Claim Victory in Security Battle   30 Jun 2008 04:43 GMT
Bill Gates changed the way Microsoft develops software in 2002, via his "Trustworthy Computing" memo. But the company has found it harder to alter external views of how secure its products are.

Source: Computerworld

Short Takes   30 Jun 2008 04:43 GMT
Brief news items

Source: Computerworld

HSBC sites vulnerable to XSS flaws, could aid phishing attacks   30 Jun 2008 02:29 GMT
What would the perfect phishing attack from a social engineering perspective? The one that compared to using typosquatted domains impersonating the bank's web application directory structure is in fact using the bank's legitimate domain names as redirectors due to XSS flaws within. It's even more interesting to measure the average...
Source: ZDNet

An effective way to treat Web 2.0 vulnerabilities   28 Jun 2008 13:38 GMT
I'm personally a huge fan of the Matasano blog, and have a lot of respect for their group.  I took a peak over at their blog today and noticed an article by Dave Goldsmith that deals with "Vulnerability Reporting in a Web 2.0 World Continued". In this...
Source: ZDNet

Critical security alert issued for Tor   27 Jun 2008 19:14 GMT
If you use Tor for anonymity/privacy on the Web, you might want to pay attention to this critical security announcement from project leader Roger Dingledine. According to the advisory, a known vulnerability in the Debian GNU/Linux distribution's OpenSSL package could allow an attacker to figure out private...
Source: ZDNet