Enterasys code for sale on Web&#39;s black market
444522
Enterasys Networks Inc.&#39;s secret sauce is reportedly back on the black market, after an anonymous person or group calling itself the Source Code Club offered to sell some of its software code for $16,000.
567234
CROOKS HAVE reopened their online store to flog the stolen source code of Cisco&#39;s PIX firewall software. The Source Code Club were offering the nicked Cisco code for a mungingly cheap $24,000, also up for
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
407536
The sourcecode to Ciscoâs industry leading PIX firewall system was recently stolen and put up for sale by malicious hackers under the guise of âThe Source Code Clubâ.
204651
This is pretty interesting, seems as though Microsoft has acquired an anti-spyware company noone&#39;s ever heard of. I know spyware and adware removal software is big business now but I&#39;ve never heard of Giant Company Software Inc.
357185
Just one day after&#160;Microsoft issued a massive set of security patches for its software, hackers have begun posting code showing how to exploit one of the flaws.The proof-of-concept code, posted Wednesday to the Milw0rm Web site, exploits a bug in the Microsoft Works file converter software that is part of Office 2003 and can be used to run unauthorized software on a victim&#39;s computer.The flaw also affects Works 8 and Works Suite 2005. To fall prey to the attack, a victim would first have to open a malicious Works attachment.Hackers have uncovered many of these file-format bugs in recent years, and they are generally not used in widespread attacks. In fact, security vendor Symantec predicts that we&#39;ll see fewer of these attacks in the months ahead as online criminals increasingly rely on browser bugs to do their dirty work.&quot;The bad guys, they&#39;re looking for different ways to trick people,&quot; said Wayne Periman, director of development with Symantec Security Response. &quot;The popular method of choice is to exploit plugins in browsers right now.&quot;Still, Periman expects criminals to try out this latest attack code. &quot;It&#39;s so simple,&quot; he said. &quot;All you have to do is get someone to open the document.&quot;As of Wednesday, Symantec had not seen any signs of attackers taking advantage of any of the flaws that Microsoft fixed this week.The software vendor released 11 sets of patches this week, fixing 17 flaws in its products, but this is the first exploit code to pop up following Tuesday&#39;s updates. A second program exploiting one of these vulnerabilities -- this one in an ActiveX control used by the Visual FoxPro database -- was posted to Milw0rm in September, months before Microsoft patched the issue.
384843
(InfoWorld) - Stolen bank account numbers are commanding the highest price in an underground trade of personal details stolen by hackers, according to a survey released Monday by security vendor Symantec. Bank account details command prices of up to $400, while credit card details sell for between $0.50 and $5, e-mail passwords from $1 to $350 each, and e-mail addresses from $2 to $4 per megabyte, according to Symantec's Internet Security Threat Report, which covers the first half of the year. The online trade in stolen details highlights the commercialization ofÂ Internet crime, with gangs researching, developing and marketing nefarious software for other criminals, said William Beer, director of security practice for Europe. There has been an increase in the quality and quantity of malicious code sold on the Internet, driven by well-funded international groups of criminals, Beer said. The hackers are obtaining the information through increasingly targeted attacks on computers that often involve collecting personal information about a person from social networks such as MySpace or Facebook, Beer said. With specific personal details, the hacker can construct a personalized e-mail that entices the victim to either click on an attachment containing malicious software or visit a phishing site. Symantec is also seeing multistage attacks where the attacker places a small piece of software on a target computer that then acts as a beachhead for downloading other software. "The end user will not even notice the attacks have taken place because it's a very gradual process," Beer said. On the spam front, Symantec said it has noticed a 30 percent drop in so-called "pump-and-dump" spam, where e-mails touting penny stocks are sent out, causing a rise in the stock price before the perpetrators sell the stock early. The decline can be attributed to aÂ crackdown by the U.S. Securities and Exchange Commission. Also down is the percentage of spam with images, which started as a highly effective way to bypass spam filters but is now less so. About 27 percent of the spam analyzed by Symantec between April and May contained images, down from 50 percent the first week in January, Symantec said. The decrease is due to an improvement in spam filters as well as the decline in pump-and-dump spam, which often used images, the company said.
49404
October 12, 2004 - By taking advantage of a hole in Microsoft&#39;s Internet Explorer web browser, hackers have been able to introduce âspywareâ or âadware,â which is downloaded on to hard drives without owners&#39; knowledge.
457591
Hackers revealed exploit code for JavaScript vulnerability.
585349
Brisk bidding for German code machine Those of you who didn't have sufficiently deep pockets to bid for the Enigma machine which last year sold on eBay for a cool â¬55k might be interested in another example that's currently going for $16,200 (â¬11,700).â¦
498738
A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
318853
The electronic currency site that the Source Code Club said it will use to accept payment for Cisco Systems Inc.&#39;s firewall source code is confident it can track down the perpetrators.
696623
(InfoWorld) - WabiSabi Labi, a Swiss startup that caused a stir with the creation of an eBay-like marketplace for software vulnerabilities, plans to offer an intrusion-detection system and will open up its auction site to a wider range of intellectual property, according to a company executive. "We are signing an agreement with a hardware producer and we are building, I can't say by when, but we will provide an intrusion detection system device based on zero-day signatures," said Roberto Preatoni, the company's strategist, during an interview on the sidelines of theÂ Hack In The Box conferenceÂ in Kuala Lumpur, Malaysia. WabiSabi Labi allows security researchers to submit unpatched software vulnerabilities, called zero-days, for sale on the company's auction site where qualified buyers can bid on them. The vulnerabilities can be purchased using an exclusivity option, which prevents them from being sold to anyone else, or they can be sold repeatedly to different buyers. In addition, WabiSabi Labi is close to announcing an alliance with "a very well-known security research company" to market its products through the auction site, Preatoni said. He declined to name the company before the deal is made public. "The next step will be to open up the marketplace to any sort of intellectual property, not just security research," he said. The premise behind WabiSabi Labi's zero-day marketplace is that ethical disclosure -- in which security researchers warn vendors about vulnerabilities in their software before disclosing them -- is unfair, because the researchers are not compensated for the work they do. The startup wants to end the "free ride" that software vendors have enjoyed and see that hackers and researchers get paid a market rate for their efforts. WabiSabi Labi isn't the first to offer hackers and researchers a way to earn money for the vulnerabilities they discover. Several security companies, including 3Com's TippingPoint division, VeriSign's iDefense Labs, and Immunity, pay researchers for zero-days. WabiSabi Labi now hopes to combine its efforts to see researchers compensated for the work they do with aspirations of being a security vendor in its own right. Its planned intrusion detection system, a tool that monitors a network or server for suspicious activity, will be based on a database of zero-days sold through the company's auction site, and researchers will receive continuing payments when vulnerabilities they discover are included, Preatoni said. The only vulnerabilities that won't be included are those that are purchased using the exclusivity option. Getting to the point where WabiSabi Labi's zero-day database contains enough signatures for an intrusion detection system will take a couple of years, and requires the company to convince security researchers to sell vulnerabilities they discover through its auction site. That won't be easy. WabiSabi Labi executives face an uphill struggle to win over skeptics who believe ethical disclosure is still the best way to report software vulnerabilities and protect users. "By releasing this zero-day information you put customers at risk," said Alexander Kornbrust, the managing director of Red Database Security and a researcher credited with uncovering dozens of security holes in Oracle databases. Others are worried about how zero-day sales will affect public perceptions of security researchers and hackers. "Having a zero-day eBay is dangerous for the community because it will enforce the idea that hackers are criminals," said Alessio Pennasilico, a security evangelist at Alba S.T. who has uncovered vulnerabilities in the software used to control industrial equipment found in factories and power plants. "I will never buy or sell a zero-day on a site like that," Pennasilico said. But some people are willing to give WabiSabi Labi a try, at least under certain circumstances. "If the vulnerability affects an open-source project, I wouldn't sell it. But if a vulnerability affects a big commercial vendor, and I know that vendor is usually not responsive on security bugs, then I would probably sell it," said Andrea Barisani, chief security engineer at Inverse Path. But Barisani, who discovered a vulnerability that allows false messages to be injected into satellite navigation systems, knows the people behind WabiSabi Labi personally and trusts them. He's quick to acknowledge others may not share that trust. "If I'm a random researcher, and I know I have a very important vulnerability -- and ideally you would sell only vulnerabilities that are very important -- my primary concern would be not to leak that vulnerability. Since most people in the security industry are very paranoid, I wouldn't trust a middleman," Barisani said. Preatoni rejects the notion that selling vulnerabilities through WabiSabi Labi puts users at risk, saying buyers are carefully vetted to prevent zero-days from falling into the hands of criminals. But he acknowledges the company must work hard to win over security researchers by ensuring they get paid for their work and that agreements over how vulnerabilities should be handled are respected. "It's all a matter of trust and we have a long road ahead. We have to build that trust," Preatoni said.
312864
An invitation to chat by Webcam could come with malicious code.
4497
Within days of the release of the security bulletin, there was proof of concept code available on the web. As the exploit was analyzed by various security groups, it was found that it was similar
36812
In a twist, security researchers have discovered a group of hackers who are exploiting a new category of victims -- aspiring Internet scammers.A Moroccan group called &quot;Mr. Brain&quot; is offering free phishing kits on a Web site hosted in France, said Paul Mutton, Internet services developer at Netcraft, a security company in Bath, England.The software packages make it easy to quickly set up a fraudulent Web site mimicking a known brand in order to trick people into divulging credit card details or bank account numbers. Templates for spam e-mail are also included, targeting brands such as Bank of America, eBay, PayPal, and HSBC.Mr. Brain&#39;s Web site lists the kits and what kind of details each one is capable of collecting, such as usernames, passwords or Social Security numbers. Netcraft posted screenshots on its Web site.But what the aspiring scammer doesn&#39;t know is that the phishing kits are designed to send any sensitive information that&#39;s collected back to e-mail accounts controlled by Mr. Brain, Mutton said.&quot;Obviously, that&#39;s why they are offering this stuff for free,&quot; Mutton said. &quot;I was impressed by it.&quot;Mr. Brain hides the special e-mail function in a blend of PHP scripts, one of which is encrypted, Mutton said. Just in case someone decrypts it, Mr. Brain has written at the top of the file &quot;Don&#39;t need to change anything here. Created by Mr. Brain Morocco Team.&quot;The scheme seems to be targeted at new phishers, Mutton said. Mr. Brain benefits since other wannabe scammers shoulder the cost and risk of finding an ISP (Internet Service Provider) to host the phishing site, Mutton said.&quot;Essentially, they&#39;re exploiting all these novice phishers -- basically getting them to do all the hard work,&quot; Mutton said.It&#39;s difficult to tell without further research how many of the free phishing kits linked with this latest scam are live on the Internet, but Mutton said Netcraft noticed one earlier this month targeting Bank of America.&quot;Clearly, these are actively being used in phishing attacks,&quot; Mutton said.
253538
Unethical choices by major tech companies &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29