Aurora Report: Around The Horn vol.1,144

Exploit allows Apple keyboard ownage through firmware

By jeff.smykil@gmail.com (Jeff Smykil) on security

One of the Apple-related talks given at this year's Black Hat security conference dealt with keyboard firmware. Given by "KChen," the talk discussed "Reversing and Exploiting an Apple Firmware Update." While it may not seem like much on the surface, the truth quickly becomes apparent: if someone gains access to your keyboard's firmware, there are a multitude of ways in which they can further compromise your machine.

There are two ways in which this exploit can be perpetrated. The first is if someone has physical access to your computer and your administrative password, and the second is if someone has already gained access to a machine remotely through a rootkit hack. Why would an attacker want anything to do with a keyboard when he already has free reign on a system? The answer, as KChen pointed out, is that an affected user can patch the rootkit exploit and even reformat the drive, but the attacker could still have access to the keyboard.

Twitter warms up malware filter

By Vivian Yeo

Twitter's new malware filter is a sign the social media site is stepping up efforts to stem attacks, but the measure has its shortcomings, say security experts.

Twitter's filtering mechanism was highlighted by Mikko Hypponen, chief research officer of F-Secure, in a blog post Monday. When a user ...

Hanging with hackers can make you paranoid

By Elinor Mills

At a hacker conference no one is safe.

When I first went to Defcon in 1995, the halls were mobbed with teenagers and attendees seemed more concerned with freeing Kevin Mitnick ...

Defcon: What to leave at home and other do's and don'ts

By Elinor Mills

Attending Defcon and Black Hat can make you feel a bit like a deer in a forest full of hunters.

New Firefox patches authentication security holes

By Stephen Shankland

Mozilla on Monday released two new versions of Firefox, 3.5.2 and 3.0.13, to patch two critical security holes.

"We strongly recommend that all Firefox users upgrade to this latest release," Mozilla said in a blog posting about the security issue.

The first vulnerability could let an ...

Report: White House acting cyberspace chief resigns

By Michelle Meyers

Melissa Hathaway, acting cyberspace director for the White House's National Security and Homeland Security councils, has resigned from her post, citing personal ...

Using software updates to spread malware

By Elinor Mills

LAS VEGAS--Two researchers from Israeli security firm Radware have figured out a way to trick computers into downloading malware or take over a computer by hijacking the communications during the update process for Skype and other applications.

Normal service will be resumed

By Rik Ferguson on Opinion

Just a quick note to let regular readers know that I may go a little quiet over the next week or so. I was lucky enough to become a dad again this weekend, so I’ll be spending some time with the family, normal service will be resumed very shortly, never fear.

Dan Kaminsky & Kevin Mitnick Hacked

By Darknet on ~el8

If any of you follow the mailings lists or the ’scene’ as it’s known, you’d be familiar with PHC, Phrack, Gobbles, ~el8, Silvio, gayh1tler and the whole Whitehat Holocaust AKA pr0j3kt m4yh3m. (Back when it went public). The war against whitehats has started up again more vehemently recently with zine known as zero for owned or [...]

Researchers To Release Tool That Silently Hijacks EV SSL Sessions

Black Hat USA session will demonstrate new man-in-the middle attacks on Extended Validation SSL

Tech Insight: It's About DAM Time

Given today's threats to data from targeted attacks and unsavory insiders, it's no longer a question of whether or not to adopt database activity monitoring

DEFCON Attendees Uncover ATM Scams

In Vulnerability Research

Attendees of the DEFCON 17 conference uncovered two malicious ATMs at Las Vegas casinos. It is unclear how long the machines had been there or how many people had been victimized.