Titan Internet multiple XSS

I've attempted to make them aware of the the multiple (11) XSS that are confirmed active on their hosting site, which include the transactional parts of the website including billing. I did disclose this to them over 4 days ago with no answer.

This is a claim from their 'vulnerability scan'.

• 'On September 14, 2011 secure-gateway.titaninternet.co.uk met the PCI data security requirements by passing a SecurityMetrics® Site Certification vulnerability scan.'

If you're a customer of this hosting company i would ask you to question whether they are conscious of this & what steps they are doing to protect the data they are holding.

OSX & 2fa thoughts

Apple will release a new version of OSX & iOS in the final Q of 2014, one of the features is the unification of SMS and subsequent delivery via OSX & iOS. This poses some interesting scenarios on the ability to maintain 2fa with such services as Google. 

Google provide the ability to authenticate via a SMS to a chosen telephone number, of course the password is still required but this brings a potential new attack vector.

APT

Incredible that it takes an SEC filing for something like this to make headlines. 

FireEye helped source the APT source to China, 4.5m records taken.

Krebs offers the insight we all mumbled in our heads!

Responsible disclosures

Finding a vulnerability will excite some analysts, some will even go as far as disclosing it for free. Do not ever do this unless you're willing to handle the responsibility of fixing it. The reason we exist in this arena is to be able to find and expose vulnerabilities and risks, a responsible disclosure not only endorses you as a analyst it build your reputation.

Fin Spy

A RAT which is used by Government agencies & Law enforcement agencies

FinSpy

Not exactly new, but unsettling none the less, here is good writeup including a price list.

Beats to be Apple

Can't help but think this would not have happened if Ping would have taken off.

On a serious note, the potential purchase of this particular market share shows Apple isn't afraid to spend the cash that it has amassed. Beats isn't a niche market, its not just the wearable market either. This market is full of streaming competitors, what Beats has is a customer base which has already approved of its service. A smart move considering the new iOS integration.