The biggest story that came from the recent Black Hat conference in Las Vegas was the discovery of a major iPhone security flaw that enabled hackers to take over the handset.
This has now been patched, but it has overshadowed another serious problem discovered during the conference.
Hacker Moxie Marlinspike discovered a new way to defeat SSL encryption, which could leave common web apps such as online banking vulnerable to attack.
After initial discoveries at a previous Black Hat event, Marlinspike revealed more vulnerabilities in SSL which our resident security blogger Davey Winder called "really rather worrying".
As Winder describes in his blog post, Marlinspike revealed how man-in-the-middle attacks could fool web browsers and email clients into thinking fake sites were legitimate.
This was courtesy of vulnerabilities in SSL, allowing somebody to intercept traffic with what Marlinspike called a null-termination certificate.
Matt Hampton, chief technological officer at Imerja, said: "It's not just something that can happen with a web browser. Something else needs to have been done beforehand.
He added: "Either a virus or malware has been downloaded on a [targeted user's] machine that has changed the configuration, so the named servers have been changed."
This could mean that a targeted user is pointed to a server where the attacker has created fake web pages, which could come from a location as far away as China or Russia.
"Currently if a user clicked on that link they would get a warning, because the browser doesn't trust the certificate," he added.
"If [the attacker] has managed to install a null-termination certificate, they won't get the warning. It's going to hide the fact that things have been changed."
This could allow attackers to steal passwords or create fake online banking sites where they could steal credit card details.
Firefox 3.5 is currently protected against the attack, but not earlier versions. Chrome and IE8 are not.
The conference also revealed a hacking attack by researcher Dino Dai Zovi that could allow criminals to take control of Apple computers and steal scrambled data.
There was also a detailed report on Russian cybercrime, with a claim that Eastern European mobsters are justifying their crimes by hiding it behind extreme nationalism and anti-western sentiment.
There was even a presentation on lockpicking forensics, as interest in physical security has become an extension of the growing number of people interested in computer security.
The hacker community is thriving, and another hacker convention in the Defcon conference is currently taking place in Las Vegas.
Reports revealed that somebody tried to hit Defcon attendees this week with a fake ATM placed in the Rivera hotel, which is playing host to the annual event.
It was apparently recording the card details and PIN on anybody trying to use it, but the criminals involved probably didn't bank on it ending up centre stage of a hacker-focused security event.
