Prize for zero-day Windows flaws: $20k
234545
A security research company is offering $20,000 for information on undisclosed security flaws in Microsoft&#39;s Windows OS.Digital Armaments, which doesn&#39;t list a phone number or a headquarters address on its Web site, is offering the money as part of the &quot;Hacker&#39;s Challenge&quot; through midnight EST, Feb. 29. The company is also soliciting for flaws in what they term &quot;Windows Diffuse Applications.&quot;Submitters need to illustrate a working exploit and document it, according to the company&#39;s Web site, which is filled with misspelled words.There&#39;s nothing illegal about paying security researchers for flaws, but it does tend to annoy software companies whose products are affected.Wabisabilabi, based in Switzerland,&#160;took the idea of compensating researchers a step further&#160;last year by opening a site for them to sell vulnerabilities in auctions. In response to criticism, company officials countered that researchers could sell zero-day vulnerabilities on the black market.Microsoft, whose security vulnerabilities are generally high profile, advocates that researchers discretely alert it to software problems so users aren&#39;t put at risk. Companies generally refuse to pay for software vulnerabilities.Digital Armaments says on its Web site its research team was founded in 2003, and offices were opened in the U.S. later that year.In addition to paying money for vulnerabilities, Digital Armaments will also apparently pay in stock or credits that can be exchanged for stock under its Digital Armaments Contribution Program.Efforts to reach Digital Armaments on Wednesday morning by e-mail were unsuccessful.
189086
Blog: Within hours of release, veteran researchers find holes in the new Windows browser from Apple.
525318
Is Microsoft's anti-malware giveaway part of a master plan to flush out software pirates?
555338
Security researchers have discovered a serious flaw in Google Inc.'s desktop software that could be used to wreak havoc on a victim's computer.
468220
Security researchers are divided over which Web browser to blame for the latest zero-day threat to Windows-based PCs: Internet Explorer or Firefox.
68810
Rare, out-of-cycle Windows patch fixes one flaw, but attacks through other known, yet-to-be-plugged holes continue.
659896
peeon writes &quot;Right before Christmas, four new Windows NT/2k/XP vulnerabilities were posted to the Bugtraq list. This story discusses two of the vulnerabilities in the LoadImage function (buffer overflow) and
104408
A software patch to protect your system is available from Microsoft.
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
104025
Less than a day after Microsoft detailed the latest Windows vulnerability, hackers were hunting for exploit codes. By Gregg Keizer, TechWeb News.
493600
How your computer could be costing you thousands of dollars.
569551
Software giant plans to issues fixes next week for vulnerabilities in its Windows Mail, Internet Explorer and Windows XP.
241353
The new flaw is unrelated to the help-file flaws discovered by a Chinese security company last week. Microsoft took the Chinese security group to task for disclosing the vulnerability without giving the company a chance to develop a fix.
498738
A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
446936
Hackers take advantage of a flaw in various Microsoft programs that leaves PCs vulnerable to remote attacks. Security experts expect the threat to grow.
224030
An 18-month-old flaw in Microsoft Windows -- patched by Microsoft in 2006 -- continues to allow hackers to infect PCs with advanced rootkits and launch infections from thousands of compromised Web sites.
305121
Watching the defectives Security firm eEye has created what's described as the industry's first site designed solely to track zero-day vulnerabilities, flaws where exploits are available prior to the release of security patches.â¦