Researchers ring alarm over Solaris zero-day threat
520698
Security researchers today warned of an easy-to-exploit flaw in Solaris 10's telnet application and said attack code has already been posted online.
143769
Despite widespread attention, Ken Dunham, Director of Malicious Code at iDefense, characterizes the Linux Trojan as a low threat. &quot;It looks like there was a low volume of e-mails that spread over a period of several days,&quot; he said.
442687
Security checks on foreign students in "proliferation-risk" science subjects could deter them, UK researchers warn.
292352
In a story for the Associated Press this afternoon, one of the directors of Microsoft's Windows Client Product Planning team is quoted as saying that a Black Hat security conference demonstration last August scared Microsoft to the point where the company seriously considered removing virtualization capability from Vista entirely.
424958
No end in sight Just when the world thought it was safe to resume use of Microsoft Office, there's word that a new zero-day attack may be targeting the popular productivity package. Like so many of the others, it's capable of all kinds of mischief, including the execution of malicious code on a victim's machine.â¦
460123
Â· Research aimed at producing green fuel  Â· Critics warn of terrorists creating new bioweapons
541363
Security expert express concerns that cash machines could soon fall victim to Windows viruses.
294488
Experts will rate potential severity of business security threats.
461322
There is a security alert floating around (PHP Magazine, php|architect) about a new hole found in the code of PostNuke.
171304
It's storming in the security world this week, as one worm and one Trojan horse emerge to trouble I.T. administrators. The infamous Storm worm is busy posting dangerous links on forums around the Internet and a new Solaris worm is targeting Sun's operating system.
682593
(InfoWorld) - A new version of the IcePack hacker exploit tool kit has been released, security researchers warned Tuesday, and for the first time it includes attack code designed to exploit an unpatched, or zero-day, Microsoft vulnerability. Three of IcePack's eight exploit tools are new, said Roger Thompson, chief technology officer at Exploit Prevention Labs. That's noteworthy in and of itself, Thompson said. "The mix of old and new exploits is to be expected, but three new ones in one update is pretty impressive," he noted. But the new tool kit also sports a first. "The latest iteration has done something original," said Thompson, pointing to an exploit that attacks a zero-day vulnerability in Microsoft's DirectX software development kit (SDK). "The closest to a tool-kit zero-day exploit [before] was for the ANI [animated cursor] vulnerability." He was referring to a Windows bug that surfaced in early April. By the time that Mpack, an IcePack predecessor, added the ANI exploit, however, Microsoft had patched the vulnerability with an emergency out-of-cycle update. The DirectX SDK bug was disclosed by Polish researcher Krystian Kloskowski in a post to the milw0rm.com site in mid-August. Microsoft did not release a fix for the flaw in the regularly scheduled updates issued earlier Tuesday. IcePack is only one of several click-to-attack malware tool kits in circulation. Derived from the earlier Mpack, IcePack joins others boasting monikers such as NeoSploit and WebAttacker that cater to what Thompson called "lazy crooks." "Originally there was just WebAttacker, but they screwed up and then NeoSploit came along," Thompson said as he rattled off the exploit tool kit genealogy. "Then there was Mpack, which everyone at first thought was just WebAttacker, but it wasn't. Now there's IcePack." He estimated that nine to 12 malware tool kits are currently in use. "They all use very similar code, and they're all trying to make a buck out of selling to lazy crooks," said Thompson. Even though the just-updated IcePack features the first zero-day attack code seen in a malware kit, Thompson downplayed the threat. Sort of. "This is not an end-of-the-world kind of thing, since not many people will have the [DirectX] SDK. But no one knows what other software packages use that [vulnerable] ActiveX control. It's a little like Russian roulette that way." Other researchers confirmed Thompson's assessment. Symantec, for instance, warned customers of its DeepSight threat network that it had spotted in-the-wild attacks using the DirectX exploit. Symantec's researchers also confirmed that the other two exploits new to IcePack target vulnerabilities in Yahoo Messenger and Yahoo Widgets. Both of those bugs, however, have been patched. Taking aim at patched vulnerabilities is a common characteristic of multistrike kits, even though it might seem counterintuitive, said Thompson. "They usually go after lesser-known vulnerabilities," he said.
262079
Some users more equal than others Sun Microsystems in the next few days plans to issue an update that plugs a serious security hole in the most recent version of its Java Runtime Environment, more than a week after providing a fix for the same vulnerability in an earlier version of the program. The lag has prompted a prominent security researcher to lambaste the effectiveness of the company's security team.â¦
456602
It might seem like the wildest of paranoid beliefs, but a growing number of scientists suspect it might be true. The reason: Turning on the lights after dark may affect a small number of &quot;clock
372530
A new worm targeting a flaw in Sun Microsystems Inc.'s Solaris 10 OS delivers crude artsy payloads, including a drawing of a turkey in ASCII text.
68608
Security bugs in Sun Microsystems' telnet service could allow attackers to gain unauthorized access to a user's system.
553163
Vendor uncertainty and instability is highly correlated to perceived risk, and there are some big storage vendors out there with some large question marks hanging around their necks, including Sun, Symantec and HP.
527510
Researchers looking to root out computer attacks hope that speed kills.