Top 10 Stories

Guardian - The idea that Google’s Android mobile software is both “free” and open-source is so often repeated that it is virtually an article of faith online. There’s only one problem: neither is strictly true. While the basic Android software is indeed available for free, and can be downloaded, compiled and changed by anyone, it doesn’t include the apps that make up Google’s mobile services - such as Maps, Gmail, and crucially Google Play, which allows...

PC World - A number of CNN’s social media accounts and blogs were hacked Thursday by a group styling itself as the Syrian Electronic Army. The cable news network said its main Facebook account, Twitter feeds and some blogs were targeted and content posted on some of them. The posts, including unauthorized tweets, were deleted in minutes and the accounts have since been secured, it said.

IBM - Using bind variables in SQL statements can enhance the overall performance and security of your web application and is a particularly strong defense against SQL injection attacks. This article measures and compares the performance output of using bind variables, substitution variables, and literals in sample SQL statements. It then demonstrates bind variables at work in a Java web application, where they're used to protect the database against two common types of SQL injection attack....

ZDNet - In a notice on its Web site, Neiman Marcus said that malware was installed on its systems and attempted to collect payment card data from July 16 to Oct. 30. The retailer, however, said it has no knowledge of any connection between its data breach and the one disclosed by Target.  

BBC - A technology that constantly changes websites' code to defeat hackers has been unveiled by a US start-up. Shape Security says its product works with the HTML, JavaScript and CSS languages, transforming a site's code into a "moving target" to prevent cybercriminals from carrying out scripted attacks.

Infosecurity - Mobile malware victims may have several reactions upon discovering a smartphone infection, but chuckling is likely not one of them. Nonetheless, a new Android malware threat dubbed "HeHe" has been identified that steals text messages and intercepts and disconnects phone calls.   FireEye Labs researcher Hitesh Dharmdasani wasn’t laughing when he recently discovered six variants of a malicious app that bills itself as “Android Security,” and ostensibly looks to provide the users with an...

BBC - Any computer running the Chrome browser can be subverted to eavesdrop on conversations happening around it, claims a developer. Israeli coder Tal Ater found the bug while working on his own speech recognition software.  

Security Current - In a live chat hosted by The Courage Foundation Edward Snowden called on the US to stop the mass collection of telephone records by the NSA, authorized under section 215 of the Patriot Act. The Courage Foundation is a trust, audited by accountants Derek Rothera & Company in the UK, for the purpose of providing legal defence and campaign aid to journalistic sources. It is overseen by an unrenumerated committee of trustees. Edward Snowden is its first...

Wall Street Journal - Security experts believe the malicious software that infected Target was in part the work of a 23-year-old in southern Russia who counted punk rock as a hobby. Rinat Shabaev, who lives in southern Russia, offered to sell copies of a version of the computer virus used against Target for $2,000 apiece, according to three security researchers who track Russia-linked cybercrime.

Techworld - Google said there's no threat from a speech recognition feature in its Chrome browser that a developer said could be used to listen in on users. Web developer Tal Ater wrote he found the multiple bugs in Chrome while working on a JavaScript speech recognition software library he maintains, called "annyang."