exploits

Root Pipe and Wire Lurker are two new vulnerabilities hitting computers. Root Pipe is hitting OS X but Leo says it can only be activated by someone sitting at your computer, so it shouldn't really be a huge cause of concern. Meanwhile, the Nigerian scam has been reported to have caused over $12 Billion in loses last year.

Meanwhile, a new report says that consumers are reaching "breach fatigue" over all the security breaches that have happened of late.

OpenSSL is a widely used protocol for providing secure internet traffic. The "Heartbleed" bug takes advantage of a hole in OpenSSL to peer into the memory of SSL servers. It can allow a hacker to ping 64K of random memory repeatedly, thereby allowing them to glean usernames and passwords, and even fake a server certificate.

An analysis of all the patches that Microsoft released in 2013 shows that nearly 100% of all exploits and vulnerabilities could be removed if administrator rights were revoked, and users ran as a limited user.

Admin rights key to mitigating vulnerabilities, study shows (ZDNet)…
http://www.zdnet.com/admin-rights-key-to-mitigating-vulnerabilities-study-shows-7000026428/

There's a flaw in iOS and OS X that allows a "man in the middle" to intercept your credit card information. Apple just put out an emergency update to iOS to patch this. The update is OS version 7.0.6 and users should install it immediately to all iPhones and iPads. Hopefully, the OS X patch will be coming soon as well.

There's a report that someone sitting at your Mac can fiddle with the clock in OS X and gain access to your system. Leo says that having physical access to a computer can create a lot of security issues. It's something to be concerned about if you're going to lunch and leaving your computer open, but 99.99% of the time, this is much ado about nothing. Just create a screen saver password that's really good, and you're golden. Even better, turn on full disc encryption (called "file vault" on the Mac) and everything is safe until you log in.

Microsoft, Apple, Twitter, Facebook and a host of others have fallen victim to the Java exploit that was discovered by the Department of Homeland Security (actually, Leo says it was CERT - Computer Emergency Response Team ) last month. Leo says that it appears to be an Eastern European team that is attacking big American companies to find industrial secrets.