Around The Horn vol.1,37

Alerts

8:52 PM (1 hour ago)
CVE 2003-0786, CVE 2008-0891 and CVE 2008-1672 OpenSSL Vulnerability and ESX (1008521)

from VMware RSS Feed by vmtn@vmware.com (VMTN)
CVE 2003-0786, CVE 2008-0891 and CVE 2008-1672 OpenSSL Vulnerability and ESX (1008521)
Security scans might show that an ESX host contains a version of OpenSSL that is vulnerable to the issues described by CVE 2003-0786, CVE 2008-0891 and CVE...

4:11 PM (5 hours ago)
TA09-041A: Microsoft Updates for Multiple Vulnerabilities

from US-CERT Technical Cyber Security Alerts
Microsoft Updates for Multiple Vulnerabilities

3:55 PM (6 hours ago)
MS09-005 - Important: Vulnerabilities in Microsoft Office Visio Could Allow Remote Code Execution (957634)

from Microsoft Security Bulletins
Bulletin Severity Rating:Important - This security update resolves three privately reported vulnerabilities in Microsoft Office Visio that could allow remote code execution if a user opens a specially crafted Visio file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

3:55 PM (6 hours ago)
MS09-004 - Important: Vulnerability in Microsoft SQL Server Could Allow Remote Code Execution (959420)

from Microsoft Security Bulletins
Bulletin Severity Rating:Important - This security update resolves a privately reported vulnerability in Microsoft SQL Server. The vulnerability could allow remote code execution if untrusted users access an affected system or if a SQL injection attack occurs to an affected system. Systems with SQL Server 7.0 Service Pack 4, SQL Server 2005 Service Pack 3, and SQL Server 2008 are not affected by this issue.

3:55 PM (6 hours ago)
MS09-003 - Critical: Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (959239)

from Microsoft Security Bulletins
Bulletin Severity Rating:Critical - This security update resolves two privately reported vulnerabilities in Microsoft Exchange Server. The first vulnerability could allow remote code execution if a specially crafted TNEF message is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could take complete control of the affected system with Exchange Server service account privileges. The second vulnerability could allow denial of service if a specially crafted MAPI command is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could cause the Microsoft Exchange System Attendant service and other services that use the EMSMDB32 provider to stop responding.

3:55 PM (6 hours ago)
MS09-002 - Critical: Cumulative Security Update for Internet Explorer (961260)

from Microsoft Security Bulletins
Bulletin Severity Rating:Critical - This security update resolves two privately reported vulnerabilities. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

3:41 PM (6 hours ago)
More tricks from Conficker and VM detection, (Tue, Feb 10th)

from SANS Internet Storm Center, InfoCON: green
Following my yesterdays diary (http://isc.sans ...(more)...

2:29 PM (7 hours ago)
February Black Tuesday Overview, (Tue, Feb 10th)

from SANS Internet Storm Center, InfoCON: green
Overview of the February 2009 Microsoft patches and their status. # ...(more)...

1:41 PM (8 hours ago)
Java up to date ?, (Tue, Feb 10th)

from SANS Internet Storm Center, InfoCON: green
Roseman wrote in with a link to http://java.com/en/download/installed ...(more)...

Security News

3:42 PM (6 hours ago)
Microsoft Security Bulletin Summary for February 2009

from Microsoft Security Content: Comprehensive Edition
Revision Note: Bulletin Summary published.Summary: This bulletin summary lists security bulletins released for February 2009.

8:44 PM (1 hour ago)
Microsoft Security Bulletin MS09-002

from CGISecurity - Website and Application Security News by Robert A.
"Microsoft published four patches on Tuesday to close serious vulnerabilities in its Internet Explorer browser, Exchange e-mail server and Microsoft SQL server. The fixes, which were released on Microsoft's regular monthly schedule, close two Critical vulnerabilities in Internet Explorer 7 running on Windows XP that could allow a malicious Web site...

1:35 PM (8 hours ago)
Trojan Bundles Legit Social-Network Toolbar with Backdoor

from McAfee Avert Labs by Dennis Elser
Here’s another twist in regionally targeted attacks: A new Trojan (pretending to be a toolbar installer) is spreading that bundles the legitimate toolbar for the German social network “StudiVZ” with a variant of Backdoor-CEP. Among other malicious activities, the backdoor is capable of recording a user’s screen, taking screenshots, and logging keyboard strokes. At first glance, the deliberately modified installer looks perfectly harmless, especially because it refuses to do anything malicious if it detects certain security products or if it thinks it’s being observed through a sandbox or a debugger.

8:33 PM (1 hour ago)
Microsoft takes scissors to Srizbi

from The Register - Security
Botnet's last stand
Microsoft security teams have struck what they hope is a fatal blow at Srizbi, the once-powerful spam botnet that has been fighting for its life since last year's demise of two US-based network providers that offered vital lifelines.…

5:33 PM (4 hours ago)
Fraudsters cream opposition in cybercrime wars

from The Register - Security
Unsafe Internet Day
The celebration of Safer Internet Day on Tuesday was marked by warnings that cybercriminals are staying ahead of defenders in their attempts to defraud or otherwise abuse internet users.…

3:33 PM (6 hours ago)
BitDefender distances self from gaping BitDefender.pt breach

from The Register - Security
Can you trust the gatekeeper?
Comment This piece was updated to reflect information released by BitDefendor after publication.…

5:11 PM (4 hours ago)
Brief: Microsoft plugs eight security holes

from SecurityFocus News
Microsoft plugs eight security holes

5:11 PM (4 hours ago)
Brief: Reports: Obama to tap intel official for cyber post

from SecurityFocus News
Reports: Obama to tap intel official for cyber post

5:11 PM (4 hours ago)
Brief: Kaspersky: No personal info accessed by breach

from SecurityFocus News
Kaspersky: No personal info accessed by breach

5:11 PM (4 hours ago)
News: Kaspersky exposes sensitive database, says hacker

from SecurityFocus News
Kaspersky exposes sensitive database, says hacker

4:02 AM (2 hours ago)
Webtunnel 0.0.2 - HTTP Encapsulation and Tunnel Tool

from Darknet - The Darkside by Darknet
Webtunnel is a network utility that encapsulates arbitrary data in HTTP and transmits it through a web server. In that regard, it is similar to httptunnel, however, it has several key important differences: its server component runs in the context of a web server as a CGI application (with optional FastCGI support) so it does [...]

Feb 10, 2009 (20 hours ago)
Open letter to Obama: Uncle Sam should go open source

from Ars Technica - Front page content by segphault@arstechnica.com (Ryan Paul)

A group of software vendors has published an open letter to president Obama encouraging the new administration to adopt open source software in the government's IT infrastructure. The letter says that open source software can reduce costs when implementing government technology initiatives in areas like healthcare and security.
Open source software is already broadly used by many different branches of the government. The Department of Defense, which has been exploring the benefits of open source software for years, has used Linux and open source technology in a wide range of key projects, including the Army Future Combat Systems program and the Land Warrior program. The DoD also recently launched a Web site on which it hosts its open source projects.

Feb 10, 2009 (15 hours ago)
Obama taps Bush official to head cybersecurity review

from Ars Technica - Front page content by julian.sanchez@arstechnica.com (Julian Sanchez)

The White House announced Monday that Barack Obama has instructed his national security advisors to begin a comprehensive 60-day review of federal cybersecurity initiatives as a prelude to developing an integrated strategy that will coordinate security efforts across government agencies, and between the public and private sectors. The effort will be led by Melissa Hathaway, previously a senior advisor to the Bush administration's Director of National Intelligence, Michael McConnell. Upon completion of the review, Hathaway is reportedly in line for the new post of cybersecurity "czar" in the Obama White House.

1:44 AM (5 hours ago)
Microsoft Update Takes on Spam-spewing Botnet

from PC World Latest Technology News
Microsoft has added detection for the Srizbi botnet to its Malicious Software Removal Tool.

Feb 10, 2009 (13 hours ago)
Must-Have Security Fixes for IE7, Microsoft Servers

from PC World Latest Technology News
Today's Patch Tuesday from Microsoft includes important fixes for IE7 and Visio, and businesses should be sure to apply patches for Exchange and SQL servers.

Feb 10, 2009 (14 hours ago)
Microsoft Releases Monthly Security Updates

from PC World Latest Technology News
Microsoft has released four security updates including critical fixes for Internet Explorer and Exchange.
Feb 10, 2009 (14 hours ago)
Five Tips for Managing Security in a Recession

from PC World Latest Technology News
In the current economic downturn, many companies are cutting costs and security expenses frequently get cut.

Feb 10, 2009 (17 hours ago)
Antivirus Firm Confirms Hackers Breached Site

from PC World Latest Technology News
Kaspersky Lab, a Moscow-based security company, admitted that a database containing customer information had been breached.

Feb 10, 2009 (17 hours ago)
Social Networking's Security Pitfalls

from PC World Latest Technology News
Spending a little time on Facebook and other social networking sites is a ritual for many of us every morning. And afternoon. And evening.

Feb 10, 2009 (19 hours ago)
Online Safety Tips for Facebook Fogeys

from PC Magazine Tips and Solutions
Grownups, take note! Here is what you need to know before "friending" your first Facebook connection.

Around The Horn vol.1,36

Alerts

2:49 AM (3 hours ago)
Critical VMware Security Alert for Windows-Hosted VMware Workstation (1008502)

from VMware RSS Feed by vmtn@vmware.com (VMTN)
Critical VMware Security Alert for Windows-Hosted VMware Workstation (1008502)
Summary There is a vulnerability in a certain ActiveX control in VMware Workstation. Problem Description The following description is from the Common Vulnerabilities and...


Security News

1:48 PM (7 hours ago)
Perimeter Defense-in-Depth with Cisco ASA

from SANS Information Security Reading Room
Category: Firewalls & Perimeter Protection
Paper Added: February 9, 2009

2:44 PM (6 hours ago)
Application Security Vendors Need Help With Reporting

from CGISecurity - Website and Application Security News by Robert A.
I've been reading web application vulnerability reports from tools and services for 6-7 years and found that 99% of these reports are geared towards security engineers or system administrators. Many of the reports I see focus on The type of flaw and what it its impact is The URL affected Links...

11:13 AM (9 hours ago)
New Valentine Scam on the Loose

from McAfee Avert Labs by Micha Pekrul
Following our last week’s warning of the possible scams related to the approaching Valentine’s Day, to no surprise, today we’ve seen another new Valentine theme come up - hosted on the fast-fluxing Waledac botnet. If a user were to follow the link in these spam emails - please don’t do that! -, a web site like the following appears:
A picture with two adorable Shitzu puppies is wishing a Happy Valentine’s Day. The text of the lure is advertizing a “Valentine Devkit” named ‘loveexe.exe’ or ’start.exe’. And regular readers can guess it already: this is a social-engineering trick to convince users to download the real threat. Don’t click the link to the executable, otherwise you will end up with malware.
A close look into the website’s source code currently doesn’t reveal any additional drive-by-infections nor -downloads (but that can change quickly), as seen in past Waledac (or “Storm”) themes. Coverage of this particular malware variant is in the 5522 DATs, plus blocked by Artemis, plus blocked at the (former Secure) Web Gateway as well.

5:10 PM (3 hours ago)
Brief: Reports: Obama to tap intel official for cyber post

from SecurityFocus News
Reports: Obama to tap intel official for cyber post


3:05 PM (5 hours ago)
Brief: Kaspersky: No personal info accessed by breach

from SecurityFocus News
Kaspersky: No personal info accessed by breach

11:04 AM (10 hours ago)
News: Kaspersky exposes sensitive database, says hacker

from SecurityFocus News
Kaspersky exposes sensitive database, says hacker

6:57 PM (2 hours ago)
Conficker Worm Sinks French Navy Network

from PC World Latest Technology News
The French Navy says it was infected by the Conficker worm, according to reports.

6:57 PM (2 hours ago)
A Jailhouse Interview with Terry Childs

from PC World Latest Technology News
Spending a half hour with San Francisco's most famous network administrator.

3:57 PM (5 hours ago)
Kaspersky Says Web Hack 'should Not Have Happened'

from PC World Latest Technology News
Kaspersky Lab says its Web site was hacked Saturday.

7:21 AM (13 hours ago)
Kaspersky, OpenDNS Collaborate to Slow Conficker Worm

from PC World Latest Technology News
OpenDNS has added a feature to its DNS services with help from Russian security company Kaspersky Lab to fight a widespread...

1:26 AM (5 hours ago)
New-age cyber-attack inflicts major damage with modest means

from The Register - Security
Ladyboydolls.com and the new DDoS
A sustained cyber-attack against a handful of niche pornography sites has demonstrated a novel way to inflict major damage on hardened targets using a modest amount of data, a security researcher has warned.…

10:03 PM (8 hours ago)
XSS bug crawls all over PayPal page

from The Register - Security
'Fugitif' strikes again
Online payments site PayPal has been bitten by yet another cross-site scripting (XSS) bug that could be exploited by black hats to phish user passwords or possibly steal authentication cookies.…

12:12 AM (6 hours ago)
Cracking down on Conficker: Kaspersky, OpenDNS join forces

from Ars Technica - Front page content by jhruska@arstechnica.com (Joel Hruska)

The Conficker botnet is proving to be a feisty bit of malware. It may never become a problem of Storm-sized proportions, but Conficker's authors seem determined to keep their system in play. Team White Hat, however, isn't giving up—OpenDNS and Kaspersky Lab announced on Monday, February 9 that they'd be working together to prevent Conficker from spreading once it's infected a network. There are two components to the new approach. First, Kaspersky Labs is capable of predicting what domains Conficker will attempt to contact, while OpenDNS' Botnet Protection feature prevents those domains from resolving internally. The result—at least in theory—is a cooped-up Conficker.

3:28 AM (3 hours ago)
Fight Back Against Cybersquatters

from PC World Latest Technology News
Don't Pay Ransom for Kidnapped Domain Names (and Remember Your Renewals)

9:57 PM (8 hours ago)
Virulent Worm Exploits Missing Patches

from PC World Latest Technology News
The Conficker worm shows why it's so important to keep PCs up-to-date.

9:57 PM (8 hours ago)
Public Greets Massive Data Breach With Collective Yawn

from PC World Latest Technology News
Crooks steal a huge trove of credit card data, but are we too burned out on such news to care?

Around The Horn vol.1,35

Alerts

-- nada black tuesday is tomorrow though.

Security News

Some tricks from Conficker's bag, (Mon, Feb 9th)

from SANS Internet Storm Center, InfoCON: green
There have been a lot of discussions about various aspects of Conficker, definitely the most prevale ...(more)...

12:32 PM (9 hours ago)
Are we becoming desensitized to data breaches?, (Sun, Feb 8th)

from SANS Internet Storm Center, InfoCON: green
Maybe it's just me, but are all of the mass media reports of data compromises causing us to become d ...(more)...

8:55 PM (45 minutes ago)
Windows 7 UAC flaws and how to fix them

from Ars Technica - Front page content by drpizza@quiscalusmexicanus.org (Peter Bright)

Unlike many, I'm a big fan of Vista's User Account Control. Truth is, I don't get a lot of prompts asking me to elevate, and those that I do get are legitimate. Sure, the implementation isn't perfect; there are some scenarios that cause a rapid proliferation of prompts that are a little annoying (such as creating a folder in a protected location in Vista RTM), and there are even a few places where it forces elevation unnecessarily, but on the whole I think it's a good feature.
The basic purpose of UAC is

3:02 AM (3 hours ago)
Kaspersky hacker: Database exposed for days

from The Register - Security
Security Co. mum on Jedi mind trick
Some 24 hours after a hacker claimed to hack a Kaspersky website and access a database containing proprietary customer information, the security provider issued a terse statement confirming it had experienced a security issue.…

Around The Horn vol.1,34

Alerts

Feb 7, 2009 (14 hours ago)
SPAM with a large Word file on the side, (Sat, Feb 7th)

from SANS Internet Storm Center, InfoCON: green
Scott has provided us with a new piece of SPAM with the subject Offshore Banking Investm ...(more)...

Feb 7, 2009 (15 hours ago)
.gif Files Presenting a Not so Pretty Picture, (Sat, Feb 7th)

from SANS Internet Storm Center, InfoCON: green
A Storm Center subscriber has just submitted malware embedded in .gif image files, downloaded from t ...(more)...

Security News

11:10 PM (8 hours ago)
PHP filesystem attack vectors

from CGISecurity - Website and Application Security News by Robert A.
ascii writes"On Apr 07, 2008 I spoke with Kuza55 and Wisec about an attack I found some time before that was a new attack vector for filesystem functions (fopen, (includerequire)[_once]?, file_(putget)_contents, etc) for the PHP language. It was a path normalization issue and I asked them to keep it “secret” [4],...

11:10 PM (8 hours ago)
Revising netflix's CSRF

from CGISecurity - Website and Application Security News by Robert A.
Dave Ferguson writes"Back in 2006, I put out some findings about CSRF on Netflix's web site. I thought people might be interested to know that I revisited the issue recently and was shocked to find Netflixstill hasn't fixed all their CSRF issues, at least when it comes to movie queues. You...

4:33 AM (3 hours ago)
Kaspersky breach exposes sensitive database, hacker claims

from The Register - Security
SQL injection said to strike deep
A security lapse at Kaspersky has exposed a wealth of proprietary information about the anti-virus provider's products and customers, according to a blogger, who posted screen shots and other details that appeared to substantiate the claims.…

Feb 7, 2009 (15 hours ago)
OpenDNS rolls out Conficker tracking, blocking

from The Register - Security
Downadup on notice
With an estimated 10 million PCs infected by the stealthy worm known as Conficker, it's a good bet that plenty of administrators are blissfully unaware that their networks are playing host to the pest. Now, a free service called OpenDNS is offering a new feature designed to alert administrators to the damage and help them contain it.…

Feb 7, 2009 (19 hours ago)
Spam Jumps in January, Study Says

from PC World Latest Technology News
MessageLabs reports that global Internet spam levels increased 4.9 percent in January.

Around The Horn vol.1,33

Alerts

10:32 PM (9 hours ago)
A Rough Day in West Palm Beach, (Sat, Feb 7th)

from SANS Internet Storm Center, InfoCON: green
Not a good day for some in Florida, specifically West Palm Beach, to find out something like this: ...(more)...

Feb 6, 2009 (22 hours ago)
Time to patch your HP printers, (Fri, Feb 6th)

from SANS Internet Storm Center, InfoCON: green
HP have released a security bulletin for certain LaserJet printers. They require firmware updates ...(more)...

Feb 6, 2009 (20 hours ago)
Other patches and updates du jour..., (Fri, Feb 6th)

from SANS Internet Storm Center, InfoCON: green
AREVA e-terrahabitat SCADA systems vulnerabilities, US-CERT Vulnerability Note VU#337569 HP OpenVi ...(more)...

Security News

Feb 6, 2009 (17 hours ago)
Cybercrime, Online Threats, and the Recession

from McAfee Avert Labs by Jeff Green
As the recession continues and unemployment rises, we foresee the top cybercrime trend for 2009 as the continued exploitation of the financial crisis to scam people with fake financial transactions services, bogus investment firms, and fraudulent legal services.

Feb 6, 2009 (18 hours ago)
Fake Licenses on the Rise

from McAfee Avert Labs by Francois Paget
Since at least the year 2000, email scams have circulated around the net for the selling of International Driver Licenses. The authors explained that with their documents buyers could avoid having to pay traffic tickets as well as allowing them to establish new identities for hotel check-ins or bar entrance (if the buyers are underage). Lately these offers have put on weight.

Feb 6, 2009 (15 hours ago)
Geeks.com settles charges claiming its security was crap

from The Register - Security
A decade in the stockade
Geeks.com, a large online seller of computer hardware and software, has agreed to allow federal regulators to monitor its website security for 10 years to settle charges it violated federal laws requiring it to adequately safeguard sensitive customer data.…

Feb 6, 2009 (21 hours ago)
Cisco Enterprise Wireless (Wi-Fi) Equipment DoS Vulnerability Discovered

from Darknet - The Darkside by Darknet
If your organisation is using any kind of Cisco Wi-Fi kit it may be time to get the latest patches for your kit. Although they state there is no proof that hackers have used this attack in the wild - in my experience if Cisco have discovered this now, someone else probably knew about it [...]

Feb 6, 2009 (12 hours ago)
Brief: Data-breach lawsuit follows $9 million heist

from SecurityFocus News
Data-breach lawsuit follows $9 million heist

Feb 6, 2009 (12 hours ago)
Brief: Alleged attacker flaunts details of phpBB hack

from SecurityFocus News
Alleged attacker flaunts details of phpBB hack

Feb 6, 2009 (14 hours ago)
Melih Abdulhayoglu: Don't Blame the Browser

from SecurityFocus News
Don't Blame the Browser

9:40 PM (10 hours ago)
Free Defense Against the Conficker Worm

from PC World Latest Technology News
OpenDNS will expand its free service to pre-emptively block the Conficker worm from phoning home starting Monday.

Feb 6, 2009 (16 hours ago)
Critical Flaw in RealPlayer, Firefox Fixes

from PC World Latest Technology News
Hacked movie files can target a new, unpatched security risk in RealPlayer. Also, be sure you've updated Firefox for critical security fixes.

Feb 6, 2009 (21 hours ago)
Geeks.com Operator Settles Data Breach Complaint

from PC World Latest Technology News
Geeks.com settles data breach complaint by the U.S. FTC.

Around The Horn vol.1,32

Security News

12:30 PM (9 hours ago)
Attacker flaunts details of phpBB hack

from CGISecurity - Website and Application Security News by Robert A.
"In a post on Blogger on Saturday, a person who claims to have breached the Web site of open-source online community software phpBB gave a detailed account of how he did it. Using a vulnerability in PHPlist publicly disclosed on January 14, the attacker gained access to the password and configuration...

1:30 PM (8 hours ago)
Firefox 3.0.6 Released To Address Multiple Security Issues

from CGISecurity - Website and Application Security News by Robert A.
Fixed in Firefox 3.0.6 MFSA 2009-06 Directives to not cache pages ignored MFSA 2009-05 XMLHttpRequest allows reading HTTPOnly cookies MFSA 2009-04 Chrome privilege escalation via local .desktop files MFSA 2009-03 Local file stealing with SessionStore MFSA 2009-02 XSS using a chrome XBL method and window.eval MFSA 2009-01 Crashes with evidence of...

9:31 AM (12 hours ago)
Counting Malware

from McAfee Avert Labs by Marius van Oers
Malware continues to increase at a rapid rate. With the DAT-5516 release, scheduled for 4 February, the number of drivers in the DATs will pass 500,000. Half a million is a huge amount. I remember my first antivirus program, back in the ’80s, that had a count of about 80. I don’t recall the exact number, but it’s easy to place it into perspective. We add way more on a daily basis now.

11:33 AM (10 hours ago)
FlowMatrix - Free Network Behavior Analysis System

from Darknet - The Darkside by Darknet
FlowMatrix is Network Anomaly Detection and Network Behavioral Analysis (NBA) System, which in fully automatic mode constantly monitors your network using NetFlow records from your routers and other network devices in order to identify relevant anomalous security and network events. In addition, the new release of FlowMatrix, (ver.0.9.62 and...Read the full post at darknet.org.uk

3:03 PM (7 hours ago)
Four Security Updates Due From Microsoft Next Week

from PC World Latest Technology News
Microsoft will release critical security patches for IE and Exchange next week and important fixes for SQL Server and Visio.

3:03 PM (7 hours ago)
Microsoft Changes Windows 7 UAC Due to New Exploit Code

from PC World Latest Technology News
A pair of Windows bloggers posted more proof-of-concept code that subverts an important security feature of Windows 7.

6:41 AM (2 hours ago)
MS lines up two critical updates for Patch Tuesday

from The Register - Security
Security gnomes busy on IE
Microsoft is lining up four security updates - two of which earn the dread rating of critical - for the February edition on its regular monthly Patch Tuesday update cycle.…

8:41 AM (14 minutes ago)
Cisco wireless flaws pose DoS risk

from The Register - Security
Wi-Fi kit found wanting
Cisco is urging admins to update their wireless LAN hardware following the discovery of multiple vulnerabilities in its enterprise Wi-Fi kit.…

Around The Horn vol.1,31

Alerts

6:29 AM (2 hours ago)
CVE-2007-3798 Tcpdump Vulnerability and ESX (1008169)

from VMware RSS Feed by vmtn@vmware.com (VMTN)
CVE-2007-3798 Tcpdump Vulnerability and ESX (1008169)
Security scans might show that an ESX host contains a version of tcpdump that is vulnerable to the bug in CVE-2007-3798. This flaw does not affect ESX 3.x because its RPM packages are based on...

Feb 4, 2009 (21 hours ago)
Multiple Vulnerabilities in Cisco Wireless LAN Controllers

from Cisco Security Advisories


Security News

6:40 AM (2 hours ago)
Fake parking tickets lead unwary to malware

from The Register - Security
Fluttery paper route to online scam
Hackers are using fake parking violation warnings to trick motorists into visiting malware-infested websites.…

1:40 AM (7 hours ago)
Pinch Trojan lives on after authors' arrests

from The Register - Security
S'kiddies squeeze suckers
Variants of the Pinch Trojan are infecting users more than a year after the arrest of its original authors.…

5:09 AM (3 hours ago)
Researchers: IT security jobs largely untouched by economy

from Network World on Security
Information security jobs may not be the most glamorous ones in the technology industry. But at least they appear to be a lot more secure than many other IT positions are during the ongoing economic recession .

5:09 AM (3 hours ago)
Cisco warns of four WLAN controller vulnerabilities

from Network World on Security by John Cox
Cisco WLAN security alert warns of four vulnerabilities affecting all of Cisco’s wireless LAN controllers, including the Catalyst 6500 and 7600 wireless modules, with software version 4.2 or higher.

5:09 AM (3 hours ago)
Jailed SF network admin files $3M claim

from Network World on Security by Robert McMillan
The network administrator who was jailed for allegedly holding San Francisco's city government network hostage has filed a US$3 million claim against the city.

5:09 AM (3 hours ago)
Sunbelt pioneers new antivirus technology

from Network World on Security
U.S. company Sunbelt Software is set to become one of the first antivirus vendors to embrace a promising but as yet little-used new technique for malware detection known as 'file emulation'.

5:09 AM (3 hours ago)
SMB Security: 5 Bright Ideas

from Network World on Security
Adam Hansen is that rare bird in the small to midsize business (SMB) realm: He is a CSO. Hansen heads up security for Sonnenschein, Nath and Rosenthal, an 800-attorney law firm in
Chicago.

5:09 AM (3 hours ago)
A New Internet Attack: Parking Tickets

from Network World on Security
Trojan-pushing parking tickets? Yes, really. The Internet Storm Center, which tracks Internet attacks and threats, documented a case in Grand Forks, North Dakota where someone put yellow fliers on cars that claimed to ticket a parking violation. The fliers named a Web site that purportedly had pictures of your supposed violation.

5:09 AM (3 hours ago)
GAO finds more security problems in the Treasury Department

from Network World on Security by Tim Greene
Data used to fight money-laundering and funding for terrorists is at risk because of significant security weaknesses within the networks used by a crime-fighting arm of the U.S. Treasury Department, according to a government study.

Around The Horn vol.1, 30

Alerts

-- Aurora Report has no alerts.

Security News

10:31 PM (8 hours ago)
Titan Shields up!, (Wed, Feb 4th)

from SANS Internet Storm Center, InfoCON: green
There are probably more variants of World of Warcraft (WoW) password stealing malware than there are ...(more)...

Feb 3, 2009 (12 hours ago)
Malware infection that began with windshield fliers, (Tue, Feb 3rd)

from SANS Internet Storm Center, InfoCON: green
I had the opportunity to examine malwarewhose initial infection vector was a car windshield fl ...(more)...

9:05 PM (9 hours ago)
Firefox 3.0.6, (Wed, Feb 4th)

from SANS Internet Storm Center, InfoCON: green
The Firefox update to 3.0 ...(more)...

Feb 3, 2009 (14 hours ago)
PHPBB Server Compromised, Team Apologies

from CGISecurity - Website and Application Security News by Robert A.
"We took area51.phpBB.com down along with phpBB.com to ensure integrity and prevent further damage. While we actively work to bring phpBB.com back online, we would also like to inform you of the damage that has been done.The attacker gained entry through the PHPList application and was able to dump a complete...

8:38 PM (10 hours ago)
Cybersecurity contractor warns of virus on own network

from The Register - Security
When this server's a-rockin'...
SRA International, a government contractor that provides cybersecurity and privacy services, has warned its employees their personal information may have been stolen after hackers planted a virus on its computer network.…

Feb 3, 2009 (12 hours ago)
Ask.com preps Google-like* malware warnings

from The Register - Security
* Internet-breakage not included
Ask.com is prepping Google-like malware warnings - though it hopes to leave out the bit where the Oopma Loopma accidentally blocks access to the entire internet.…

Feb 3, 2009 (12 hours ago)
ASProx botnet dials into Conficker domains

from The Register - Security
Collusion or collision?
The zombie network created by the Conficker worm is yet to go "live", but it's displaying curious behaviour that yields potential clues to its origins and purpose.…

Feb 3, 2009 (19 hours ago)
Unpatched web vulns turn internet into drive-by warzone

from The Register - Security
Can't patch, won't patch
The compromise of corporate websites with malicious code and browser exploits became the preferred method for distributing malware last year, according to the annual security report from IBM's ISS security tools division.…

Feb 3, 2009 (23 hours ago)
Kurdish spyware suspect faces espionage charges

from The Register - Security
Traces of guilt
A suspect who allegedly used spyware to snoop on Turkish government computers on behalf of the Kurdistan Workers Party (PKK) faces charges punishable by up to ten years behind bars in Turkey.…

Feb 3, 2009 (17 hours ago)
Google privacy trial opens in Milan

from Network World on Security
The trial of four Google executives charged with privacy violations opened in Milan Tuesday in a ground-breaking test of European Internet law.

Feb 3, 2009 (17 hours ago)
Is West Wing BlackBerry Security Possible?

from Network World on Security
Former White House Deputy Chief of Staff Joe Hagin is the guy who planned George W. Bush's secret trips to Iraq and Afghanistan and oversaw renovations to the Situation Room and press briefing room. He was also the one in charge of securing every BlackBerry used in the West Wing.

Feb 3, 2009 (17 hours ago)
Google privacy exec faces criminal charges in Italy

from Network World on Security
In what is believed to be the first instance of a privacy executive being held accountable for his firm's actions, Google's global privacy counsel is scheduled to appear before a criminal court in Milan, Italy, on Tuesday on charges of defamation and failure to exercise control over personal data.

Feb 3, 2009 (18 hours ago)
Brief: Data breach costs rise, response costs fall

from SecurityFocus News
Data breach costs rise, response costs fall

12:54 AM (6 hours ago)
ATM Megaheists Reach Epidemic Levels

from Wired Top Stories by Kevin Poulsen
How do you squeeze $9 million from a scant 100 cloned debit cards? By removing the withdrawal limits and sending a army of crooks to ATMs around the world. The FBI is investigating what may be the biggest ATM breach in history, which unfolded in just one day last November.

10:40 PM (8 hours ago)
FBI Warns of 'Money Mule' Scams

from PC World Latest Technology News
The FBI is warning computer users to be wary of money-laundering scams.

10:40 PM (8 hours ago)
New Firefox Release Fixes Critical Security Bugs

from PC World Latest Technology News
Mozilla has released Firefox 3.0.6, fixing critical security bugs in the software.

Feb 3, 2009 (12 hours ago)
Online Job Scams Are on the Rise, FBI Warns

from PC World Latest Technology News
Job-seekers are cautioned to be particularly vigilant against growing work-at-home scams.

Feb 3, 2009 (15 hours ago)
Federal Workers Notified After SRA Virus Breach

from PC World Latest Technology News
Employees at U.S. government security agencies including the DoD and DHS are being notified after a virus breached security at...

Feb 3, 2009 (18 hours ago)
Companies Warned Over 'aging' Firewalls

from PC World Latest Technology News
It turns out firewalls become a security risk as they 'age,' according to a security assessment company.

Around The Horn vol.1,29

Alerts

-- Aurora Report says no alerts today.

Security News

3:23 AM (3 hours ago)
On the importance of patching fast, (Tue, Feb 3rd)

from SANS Internet Storm Center, InfoCON: green
Patching Every month we create an overview of the patches released by Microsoft on black Tuesday. O ...(more)...

Feb 2, 2009 (15 hours ago)
How do you audit your production code?, (Mon, Feb 2nd)

from SANS Internet Storm Center, InfoCON: green
A number of our readers have highlighted the issues at Fannie Mae. One asked an interesting question ...(more)...

Feb 2, 2009 (15 hours ago)
Backtrack 4 headsup, (Mon, Feb 2nd)

from SANS Internet Storm Center, InfoCON: green
Something interesting this way comes! Although its about seven months since the last BackTrack gener ...(more)...

Feb 2, 2009 (14 hours ago)
802.11 Network Forensic Analysis

from SANS Information Security Reading Room
Category: Wireless Access
Paper Added: February 2, 2009

9:45 PM (9 hours ago)
XKCD Security Comic on crypto

from CGISecurity - Website and Application Security News by Robert A.

8:45 PM (10 hours ago)
The security industry needs to re-align its training expectations for QA

from CGISecurity - Website and Application Security News by Robert A.
I've been involved in the security community for over 10 years and have worked for small, medium, andlarge companies. I have also worked in Quality Assurance and base my comments here on my experiences being a QA tester, and speaking with them as an outsider. I've seen advice in articles, and...

7:26 PM (11 hours ago)
Microsoft's SDL and the CWE/SANS Top 25

from CGISecurity - Website and Application Security News by Robert A.
"Bryan here. The security community has been buzzing since SANS and MITRE’s joint announcement earlier this month of their list of the Top 25 Most Dangerous Programming Errors. Now, I don’t want to get into a debate in this blog about whether this new list will become the new de facto...

Feb 2, 2009 (14 hours ago)
A run down of the major security mailing lists

from CGISecurity - Website and Application Security News by Robert A.
Here's a run down of the main mailing lists that I follow. While most of these are known in the security industry, many people who frequent this site are from various backgrounds and may find this list useful.Bugtraq: "BugTraq is a full disclosure moderated mailing list for the *detailed* discussion and...

8:01 PM (11 hours ago)
Default Security Policies For HTC Touch Pro Not So Secure

from McAfee Avert Labs by Kevin Watkins
Recently I bought a new cell phone: the HTC Touch Pro. Great mobile phone. Opera Mobile Web surfing is handled great. The Sprint EV-DO Rev A network is fast and it’s the most stable smart phone I’ve had so far. As a security researcher naturally I had to dig deeper into how secure this mobile phone actually is. I quickly found out things that make me wonder if the mobile handset industry has learned anything from the desktop industry as far as protecting consumers.

8:01 PM (11 hours ago)
The Month of Valentines…Spam

from McAfee Avert Labs by David Scharoun
For those who think the holidays always start too early, well guess what it is time to get your Valentine’s on. Well, at least spammers think so. Avert Labs started seeing Valentine enticing spam on January 22, and has been increasing steadily since. Currently we are tracking Valentine spam to be between 1-2% of the total email sent on a daily basis.

Feb 2, 2009 (13 hours ago)
Microsoft fortifies IE8 against new XSS exploits

from The Register - Security
Catching attacks without breaking the web
Engineers in Microsoft's Internet Explorer group continue to refine a new security feature designed to block malicious scripts that can be injected into trusted websites to steal email and account credentials. Judging from the magnitude of the problem, their task may never be completed.…

Feb 2, 2009 (16 hours ago)
Three hospital worm infection dubbed 'substantive failure'

from The Register - Security
Entirely avoidable
A worm attack that forced three London hospitals to shut down their computer networks late last year was entirely avoidable and represented a major failing by the organizations' IT staff, according to an independent review of the incident.…

Feb 2, 2009 (18 hours ago)
Blind phone phreaker coughs to harassment charges

from The Register - Security
Swatting menace faces long stretch
A legally blind phone phreaker has admitted prank phonecall and hacking charges.…

Feb 2, 2009 (19 hours ago)
Sony taps veins for better biometrics

from The Register - Security
Blood vessel layouts scanned
Sony has unveiled the next step in biometric security: a camera-based system that analyses veins in your fingers.…

Feb 2, 2009 (21 hours ago)
Fresh privacy fears over IE 8 Suggested Sites

from The Register - Security
Promiscuous URL sharing not a great idea, warns top Cambridge researcher
A top security researcher has called for Microsoft to rethink aspects of its Suggested Sites feature in IE8. The optional feature in the next version of Microsoft's browser allows users to "discover websites you might like based on sites you've visited", as Microsoft explains it.…

4:57 AM (2 hours ago)
New disk encryption standards may complicate data recovery

from Network World on Security
When the world's largest disk makers joined last week to announce a single standard for encrypting disk drives , the move raised questions among users about how to deal with full-disk encryption once it's native on all laptop or desktop computers.

4:57 AM (2 hours ago)
Study: Data breaches still getting more costly for businesses

from Network World on Security
Companies that are reluctant to invest what it takes on data security better be prepared to pony up a lot more if their systems ever get breached .

4:57 AM (2 hours ago)
Are You Addicted to Information Insecurity?

from Network World on Security
A recent study has a finding that defies reason: close to half of 154 smokers who had surgery to remove early stage lung cancer picked up a cigarette again within 12 months of their operation, and more than one-third were smoking at the one year mark.

4:57 AM (2 hours ago)
Ex-engineer pleads innocent to server bomb charge

from Network World on Security
The engineer accused of trying to destroy data on 4,000 servers operated by Fannie Mae has pleaded innocent, court documents show.

4:57 AM (2 hours ago)
Spotting a PC Infection

from Network World on Security
It's a common fear, stoked by never-ending news of major threats like the Conficker worm and yet another Monster.com database hack: Is my computer infected with malware?

Feb 2, 2009 (18 hours ago)
NHS worm infection was 'entirely avoidable', says review

from Network World on Security
The infection of 4,700 PCs by a worm at three London hospitals in mid-November was "entirely avoidable," according to an independent security review.

4:57 AM (2 hours ago)
Some Incidents Can Make Life Interesting

from Network World on Security
No security manager wishes for a security incident . They can be costly, disruptive and a professional black mark. But getting to the bottom of a minor event -- one that causes no real harm or has a minimal effect but isn't run-of-the-mill and therefore requires a bit of investigating -- can make the job more challenging. You have to figure out just what happened so that you can prevent a recurrence, and you have to do it quickly so that damage is kept to a minimum. It's a time-sensitive task that requires quick thinking and expertise. We just had an incident of that sort, and it's an interesting story.

Feb 2, 2009 (18 hours ago)
Microsoft denies Windows 7 UAC vulnerability

from Network World on Security
Microsoft is denying that there is a security hole in the User Account Control feature of Windows 7 after a blogger reported it last week and posted what he said was a fix for it.

Feb 2, 2009 (18 hours ago)
2008 was year of the SQL injection attack: IBM

from Network World on Security by Ellen Messmer
2008 was the year of the SQL injection attack, IBM's ISS "X-Force 2008 Trend statistics" report makes note.

Feb 2, 2009 (18 hours ago)
IE or Firefox: Which Browser is More Secure

from Network World on Security
The conventional wisdom in security circles used to be that Microsoft's Internet Explorer was hopelessly attack-prone and that only someone with a cyber death wish would prefer it over such alternatives as Mozilla Firefox, Opera or Apple's Safari browser.

Feb 2, 2009 (18 hours ago)
Drive Makers Agree on TCG Encryption Standard

from Network World on Security
The world's largest disk drive makers have pledged to support three new Trusted Computing Group (TCG) encryption standards for hard disk drives, solid-state drives and encryption-key management applications.

Feb 2, 2009 (18 hours ago)
Ex-employee calls Microsoft spying lawsuit 'desperate'

from Network World on Security
The former Microsoft employee accused of stealing company information is disputing Microsoft's version of events, saying the lawsuit against him is "a desperate attempt" to force him to abandon a patent infringement case.

Feb 2, 2009 (18 hours ago)
Obama still won't say whether he's using a BlackBerry

from Network World on Security
The mystery continues. President Barack Obama said in a television interview broadcast Monday he has a very secure handheld device, but he would not divulge whether or not he's still using his coveted BlackBerry .

Feb 2, 2009 (18 hours ago)
Data losses proving more costly for businesses

from Network World on Security
Data breaches are costing companies more than ever as consumers shun those that have lost information, according to a new study.

7:03 AM (12 minutes ago)
dradis v2.0 Released - Open Source Security Reporting Tool

from Darknet - The Darkside by Darknet
This is more of a tool for the information security professional amongst us, those working in a team carrying out web application audits, penetration tests and vulnerability assessments. It’s useful for a team to use a tool like dradis so everyone is on the same page and the progress and segregation of responsibility can easily be [...]Read the full post at darknet.org.uk

Feb 2, 2009 (18 hours ago)
Chrome and Firefox Face Clickjacking Exploit

from Darknet - The Darkside by Darknet
Just remember that even though Firefox tends to be more secure than Internet Exploder - it’s not immune from vulnerabilities (although they do tend to get fixed much much faster). The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker [...]Read the full post at darknet.org.uk

Feb 2, 2009 (18 hours ago)
Brief: Heartland faces first lawsuit in massive data loss

from SecurityFocus News
Heartland faces first lawsuit in massive data loss

Feb 2, 2009 (16 hours ago)
App Store DRM cracked, but what's the point?

from Ars Technica - Front page content by (Erica Sadun)

Sunday, warez site Funky Space Monkey announced the release of Crackulous 0.9, a GUI front end to xCrack. Crackulous, as the name suggests, removes the DRM from App Store software, allowing users to distribute pirated programs outside of App Store channels without the developers or Apple getting paid. Crackulous was developed at Hackulo.us, a donation-supported forum dedicated to, well, stealing software. There's really no way to put a good spin on it.

12:21 AM (7 hours ago)
Final Guilty Plea Wraps Up Federal 'Warez' Crackdown

from Wired Top Stories by David Kravets
Federal judges in Connecticut have gone soft on as many as 18 so-called 'warez' club copyright scofflaws as part of a nationwide crackdown. All the defendants, accused of participating in a nationwide scheme of uploading thousands of copies of unauthorized video games, software and digital music files, have received probation and not prison time.

8:08 PM (11 hours ago)
Microsoft: Windows 7 Security 'Bug' Is a 'Feature'

from PC World Latest Technology News
Outsiders insist change to UAC in Windows 7 could be exploited by attackers.

Feb 2, 2009 (13 hours ago)
Fannie Mae Engineer Pleads Innocent

from PC World Latest Technology News
Alleged server-bomber is accused of trying to destroy data on 4,000 servers.

Feb 2, 2009 (13 hours ago)
Google Goof Is a PR Nightmare

from PC World Latest Technology News
Analysts predict that Google's snafu may cause loyal users to consider search alternatives.

Feb 2, 2009 (15 hours ago)
Spotting a PC Infection

from PC World Latest Technology News
Security company Sophos has a list of warning signs that can help home users figure out if their computer has been invaded by malware.

Feb 2, 2009 (18 hours ago)
NHS Worm Infection Was 'entirely Avoidable', Says Review

from PC World Latest Technology News
The infection of 4,700 PCs by a worm at three London hospitals in mid-November was "entirely avoidable," according to an independent security review.

-- Aurora Report says spotting malware and WiFi forensics look interesting.

Around The Horn vol.1,28

Alerts

-- Aurora Report says no alerts this morning.

Security News

7:13 AM (19 minutes ago)
Black hats poison Google video search

from The Register - Security
Game for a hack
Miscreants have poisoned Google Video search results in a bid to trick the unwary into getting infected with malware.…

5:20 AM (2 hours ago)
Data-breach costs rising, study finds

from Network World on Security by Ellen Messmer
Data-breach impact's costs are rising, according to the Ponemon Institute's "2008 Annual Study: Cost of a Data Breach," which found the total cost of a reported incident rose to $6.6 million per reported breach, up from $6.3 million last year.

Feb 1, 2009 (21 hours ago)
Brief: Google mistakenly calls entire Net malicious

from SecurityFocus News
Google mistakenly calls entire Net malicious

Feb 1, 2009 (17 hours ago)
How Secure Is Safari?

from PC World Latest Technology News
The newest Windows browser leads the pack in anti-phishing filtering and pop-up blocking, and works on a variety of platforms.

Jan 31, 2009 (2 days ago)
Beware Revived Valentine's Day Virus

from PC World Latest Technology News
A new botnet is resurrecting Storm's Valentine's Day ruse and may originate from the same malware authors, security firms warn.

4:08 AM (3 hours ago)
Video: Hacker war drives San Francisco cloning RFID passports

from Engadget by Thomas Ricker

1:13 AM (6 hours ago)
Passport RFIDs cloned wholesale by $250 eBay auction spree

from The Register - Security
Video demo shows you how
Using inexpensive off-the-shelf components, an information security expert has built a mobile platform that can clone large numbers of the unique electronic identifiers used in US passport cards and next generation drivers licenses.…

-- Aurora Report says better get moving.

UPDATE: Around The Horn vol.1,27.1

Alerts

-- UPDATE: isc.sans.org is now working.

-- Aurora Report says uh-oh seems Google isn't the only one that can make a mistake. Sans Infocon Green website seems to have lost its memory. The site is stuck on it's most recent article preventing navigation to article archives even those with direct links. This is affecting Aurora Report content article links and is not within Aurora Reports control. See for example this link:

2009-01-31

Swa Frantzen

DNS DDoS - let's use a long term solution

Which takes you not to the link expected but rather to the currently posted story:

Date	Author	Title
2009-02-01	Chris Carboni	Scanning for Tribox vulnerabilities

Sorry for any inconvenience despite our inability to affect the outcome. Will post as soon as this is fixed, but right now we can't even comment on the SANS website to determine if they know about the problem.

Around The Horn vol.1,27

Alerts

Jan 31, 2009 (22 hours ago)
Google Search Engine's Malware Detection Broken, (Sat, Jan 31st)

from SANS Internet Storm Center, InfoCON: green
As of right now, it appears any google search you do will come up with all the same results as befor ...(more)...

Jan 31, 2009 (20 hours ago)
DNS DDoS - let's use a long term solution, (Sat, Jan 31st)

from SANS Internet Storm Center, InfoCON: green
The current batch of DDoS attacks continues now for quite a few days. Let's recap a few things and l ...(more)...

Security News

Jan 31, 2009 (14 hours ago)
'Human error' shuts down Google

from CGISecurity - Website and Application Security News by Robert A.
"THE world’s biggest internet search engine temporarily shut down today, leaving hundreds of millions of surfers stranded in cyberspace. Google broke down for forty minutes this afternoon, paralysing everything from internet-dating to people checking out the latest news. Anyone searching for a site using Google was blocked with the warning: “This...

Jan 31, 2009 (22 hours ago)
Google mistakes entire web for malware

from The Register - Security
This internet may harm your computer
Updated A human error at Google caused its main search engine to briefly identify every site on the web as a potentially malicious destination that represented a threat to end users, the company said.…

Jan 31, 2009 (20 hours ago)
Human error caused Google search bug

from Network World on Security
Human error caused a glitch that returned the message "this site may harm your computer" for all Google search results for about an hour Saturday morning, the company said.

Jan 31, 2009 (20 hours ago)
Google bug vexes Saturday morning searches

from Network World on Security
A glitch that apparently occurred in Google's "Stop Badware" program led to what Verizon's security blog called a "self-inflicted denial of service" Saturday morning, with all search results warning "this site may be harmful to your computer."

-- Aurora Report says Google, Google, Google, it's always about Google (Think Brady Bunch).