Spyware, viruses, & security forum: NEWS - January 21, 2013

... from college

When 20-year-old Ahmed Al-Khabaz, a computer science student at Montreal's Dawson College, discovered a critical flaw in his college's student web portal, he decided it was his "moral duty" to share the discovery with the institution's leaders so that the bug can be fixed before doing serious harm.

But what he probably could not have imagined at the time is that this - for all intents and purposes - honorable decision will ultimately lead to his expulsion from college.

Al-Khabaz, who was also a member of the college's software development club, and fellow student Ovidiu Mija were working on a mobile app that would facilitate the students' access to their account on the portal in question, when they discovered that the web application's "sloppy coding" allows anyone with a basic knowledge of computers to access all of the student's accounts and the information contained in it: personal information (including Social Security numbers), grades, class schedule, and more.

Continued : http://www.net-security.org/secworld.php?id=14274

Also:
Computer science student first praised, then expelled for poking around
Canadian Student Expelled After Finding Critical Flaw in Software Used by Colleges

... protection

According to the most recently released comparative review by av-comparatives.org, Opera leads competing browsers in anti-phishing protection. Should you make the switch? Not so fast!

The comparative review used 294 phishing URLs and tested the following browsers:

• Apple Safari 5.1.7.7534.57.2
• Google Chrome 23.0.1271.97 m
• Microsoft Internet Explorer 9.0.9112.16421 / 9.0.12
• Mozilla Firefox 17.0.1
• Opera 12.11.1661

It produced the following results:

• Opera - 94,2% detection rate of the phishing URLs used in the test
• Internet Explorer - 82,0% detection rate for the phishing URLs used in the test
• Google Chrome - 72,4% detection rate for the phishing URLs used in the test
• Apple Safari - 65,6% detection rate for the phishing URLs used in the test
• Mozilla Firefox - 54,8% detection rate for the phishing URLs used in the test

None of the browsers triggered a "false phishing alarm". What kind of conclusions we can draw based on the these results, and what should decision makers keep in mind when considering a company-wide browser switch?

Continued : http://www.zdnet.com/comparative-review-opera-leads-in-browser-anti-phishing-protection-7000010039/

"Two new vulnerabilities were apparently found in a day, according to one of the hackers"

Two iPhone hackers hinted they're making progress towards developing a new jailbreak for the latest version of Apple's mobile operating system.

One of the hackers, who goes by "@pod2g" on Twitter, wrote on Sunday that they found two "new vulnerabilities in a day," but what's missing is an "initial code execution" for a public jailbreak.

Pod2g is working with David Wang, known as "@planetbeing" on Twitter, to develop a way to remotely exploit iOS 6, known as a "jailbreak." Jailbreaking a device allows people to install applications that have not been approved by Apple, as well as other customizations.

While legal in the U.S due to an exception in the U.S. Digital Millennium Copyright Act, Apple discourages its customers from jailbreaking their iOS devices and can void the warranties for tampered devices. Apple also tends to quickly fix vulnerabilities that allow a device to be jailbroken.

Continued : http://www.networkworld.com/news/2013/012113-iphone-hackers-hint-at-progress-265982.html