The week in security: Firefox flaws and targeted Chinese attacks

Security news

It has been another busy week in security for V3.co.uk, with new products from major vendors, interesting statistics on the latest threats, and incidents that certain people would rather forget.

The Conservative Party kicked off the week in fine fettle, setting up a web site aimed at embarrassing the Labour Party. But in the end it was the Tories that were on the receiving end of a rather clever hack.

Trend Micro senior security advisor Rik Ferguson explained that the Cash Gordon site was set up to collect any message posted on Twitter that contained the hashtag #cashgordon and republish it in a live stream in a widget on the Cash Gordon home page.

"Obviously this was duly noted and passed around. It was soon discovered that if you tweeted HTML or JavaScript instead of standard messages, this content would be interpreted and rendered by the visitor's browser as a legitimate part of the Cash Gordon site, allowing pranksters to redirect visitors to any site of their choosing," he wrote.

"This latest in a line of social media marketing related fails is a salutary warning not to underestimate the technical know-how of the world wide audience you are inviting."

Next up is Mozilla, which was forced to rush out an update to its Firefox browser to fix a critical security flaw. Version 3.6.2 was originally scheduled for release on 30 March.