Microsoft Fixes Clickjacking Vulnerability in Socl Almost 5 Months After Being Notified

Security researcher Nikhil P. Kulkarni has identified a clickjacking (User Interface redress) vulnerability in Microsoft’s social media website Socl (So.cl). The expert told the company of the flaw back in August, but they addressed it only a few days ago.

“Social Networking sites today are accessed by millions of internet users as it is the best way to stay connected with their near and dear ones. But if they aren’t careful, then they might fall prey for various scams,” the researcher told Softpedia in an email.

Read more

Linux Mint 14 Xfce Edition Is Available for Download

Linux Mint Xfce, a modern, elegant and comfortable operating system based on Ubuntu and Debian, has just reached version 14.

Even though it's a little late to the party, the Xfce version of Linux Mint 14 is finally here and not a moment too soon. It would have been hard to release it after the Apocalypse.


In any case, Linux Mint Xfce shares the same codename with the other releases, Nadia and just like its brethren, it comes with quite a few new features and updates.

As you can imagine, Linux Mint Xfce 14 is based on Xfce 4.10. According to the developers, this is a lightweight desktop environment that aims to be fast and low on system resources, while still being visually appealing and user friendly.

This latest version of Xfce 4.10 features online documentation, an application finder, multiple rows and deskbar mode in the panel, an actions plugin, a MIME type editor, a single-click operation, automated background image cycling and thumbnail rendering on the desktop, not to mention edge-tiling in the window manager.

Highlights of Linux Mint 14 Xfce Edition:

• Thunar is the default file browser of the distribution;
• Xfce Terminal is the default terminal application;
• Xfburn is the default CD/DVD burner application;
• Ristretto is the default image viewer;
• Blueman is used by default for Bluetooth support;
• The default notification daemon is xfce4-notifyd, which is themeable and configurable.

The MDM display manager comes with a lot of themes and the theme format is so trivial that users can make their own very easily and make the login screen look exactly the way they want.

The Software Manager has also received a lot of "under the hood" improvements and it no longer uses aptdaemon, which was responsible for crashing or freezing the application.

Check out the official announcement for a complete list of changes and updates.

Download it here.

Read more

Secondary Twitter “Sign In” Form Found to Transmit Passwords in Plain Text

Zohar Alon, the CEO of security solutions provider Dome9, discovered that the “secondary” Twitter sign-in page transmitted user passwords via HTTP, instead of the secure HTTPS.

Fortunately, Twitter rushed to address the issue immediately after being notified, but until a few hours ago, many cybercriminals could have exploited the flaw.



According to TNW, the bug didn’t affect the main sign-in page – the one that users are presented with when they access Twitter. Instead, it affected the drop-down sign-in form which customers can access when viewing a profile or a tweet without being logged in to their accounts.

The main login page transmitted the information in a secure manner, but this alternative page used HTTP, which meant that all passwords could be easily intercepted by someone who was sniffing a potential victim’s network traffic.

After being notified by TNW and Alon about the security hole, Twitter’s security team patched up the issue. However, this fairly serious vulnerability could have been there for some time, impacting the social media site’s 200 million customers.

While this secondary sign-in page is not used as often as the main page, it’s still utilized by a large number of internauts.

Read more

Microsoft Details Windows Phone 8 Update for Nokia Lumia 920 and 820

Microsoft has just published the changelog for the recently released Windows Phone 8 update for Nokia Lumia 920 and Lumia 820.

The update is currently pushed in Canada at Rogers and in the US via AT&T. Unfortunately, Nokia announced it wouldn't launch the new firmware version in other countries until early February, 2013.

Microsoft also hints to a staggered rollout of this Windows Phone 8 update and states that it “will be made available at different times, depending on your country or region, mobile operator, and phone model.”

Read more