Another day, another zero-day MS exploit
170602
PowerPoint threat to PCs and Macs Business users are being encouraged to be more cautious when opening PowerPoint files following the discovery of an as yet unpatched flaw in Microsoft's office application.â¦
378682
A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers. The bug only came to light last week, but code is now circulating that could be used to attack vulnerable machines.
70700
A remote attacker could take complete control over computers running many versions of Microsoft software by inserting malicious code in a JPEG image that executes through an unchecked buffer
590366
Virtualized rootkits - Part 2 &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
708807
Blog: Researcher finds a basic cookie-handling error that could compromise Windows PCs.
481653
I'm back, with a very interesting topic too!  Joel Spolsky, ex-Microsoft Manager and software engineering guru has a new essay, How Microsoft Lost the API War that is creating quite a big storm in the blogging communitiy.  Joel posits that the priests in the holy Temple of Microsoft have lost their way, because it has split into two factions, and the wrong faction is winning. One faction worships on the alter of backward compatibility, while the other is led by fervent priests who are proselytizing to raise up the new gods of .NET and Longhorn. Joel suggests that the new gods will cause the destruction of the holy Temple because Microsoft's great victories were built on the altar of keeping customers happy with backward compatibility. Furthermore the old gods of the Windows API continue to grow more grotesque and cruel with the passing of time, driving former worshipers into the arms of the friendlier gods of World Wide Web.  This story sounds extremely plausible. I must admit that i fit the profile of the developer who used to develop on the Window's API, is familiar with COM and Win32 who now develops mostly using PHP and Python. However I continue to develop and maintain Windows apps that keep our customers happy, and we still plan to develop new Windows apps. Some points:  Temple of the Blind? Firstly, Microsoft is still a compelling place to work for to people who feel that they can make a difference. The Temple continues to attract talented people with a Unix background. For example we have the recent hiring of Ward Cunningham, author of the Wiki.  Microsoft is still able to keep talented people like Raymond Chen, and others like him who continue to look after the Windows API, and Longhorn apparently will still give high priority to backward compatibility. Open sourcerers like Miguel Icaza are sufficiently attracted to the .NET vision to stake their careers on Mono. Longhorn and .NET are compelling technologies, so even if Win32 is not so cute anymore, M'soft is providing something that remains very attractive.  What i do see M'soft doing wrong is that they aren't disseminating the .NET runtime fast enough. It remains an optional install in XP Service Pack 2 for example. Also their IE dev team appears to be hog-tied due to political reasons; nevertheless IE remains good enough, particularly when I can embed IE as an activeX control, something I cannot do with Mozilla (AFAIK) - Update: I'm wrong.  Temple of the Spider?  Secondly, people don't merely use a web browser. They run the web browser in the OS.  So let me ask you, if you are using DreamWeaver or HomeSite or Photoshop or vi or emacs or Gimp, how many of you are willing to give it up for a java applet (or whatever your favorite technology is) running in your web-browser? Precisely.  Temple of the Abandoned?  Third, Joel makes the claim that developers are not developing to the Windows API. Well he could be right. But I bet a lot of them are still calling Win32.  If you are using a framework or IDE like Delphi or wxWindows (or .NET or VB) then you certainly are insulated from the Windows API, but that doesn't mean that you're not calling the Windows API all the time. I don't see Borland dropping their Windows version of Delphi at any point in time.   In fact, the fact that many developers are using some form of framework is a compelling argument for Microsoft to enhance the .NET framework to attract developers who are using other frameworks.  Today, not that many students learn x86 assembler, but that doesn't mean that Intel lost the CPU wars. Just because fewer people are learning Win32 doesn't mean Microsoft has lost the API wars, if the frameworks run predominantly on Win32.  Temple of the Lost  Joel even warns you in the beginning that "because I'm talking about big trends, I need to exaggerate and generalize". But you still get sucked in because Joel Spolsky is a first-class writer, in the same order as Philip Greenspun or Eric Raymond. That makes him so persuasive and plausible. But this is not Indiana Jones and doomed temples, but Steve Jobs and reality distortion fields.  Other opinions:  Harry Fuecks (PHP is ASP's upgrade path),  Dennis Hamilton (M'soft is just covering all bases), Robert McLaws (Joel is wrong in 7 points), Oliver Travers (the web is not good enough), One Run-time to Rule them all....
321195
Researchers warn that a number of critical holes have been found in Microsoft Windows XP which could be exploited. Symantec acted after security researchers published the details of the heap overflow vulnerabilities
40132
Not just Windows - Mac too Microsoft has warned of a serious - and as yet unpatched vulnerability - in Word. Hackers (albeit to a limited extent) are exploiting the zero-day flaw in its ubiquitous Office application, Redmond warns.â¦
97618
Code that claims to partially exploit a weakness in Microsoft software&#39;s handling of image files has been published on the Internet.
312110
AS WE PREDICTED last week after a weekend free time, hackers have come up with a method of exploiting the latest hole in Microsoft Windows.
214591
(InfoWorld) - The SANS Internet Storm Center on Friday raised its threat level to yellow after observing an increase in the number of Internet-based attempts to exploit a zero-day vulnerability discovered earlier in the week. Dozens of Web sites are exploiting the vector markup language and the number is growing, said Ed Skoudis, a SANS incident handler. The vulnerability, discovered Monday by Sunbelt Software, is also being exploited by an unknown volume of e-mail, he said. The VML exploit, which allows the remote execution of code, is worrisome to security experts because the only action required for infection is viewing a malicious Web site using Internet Explorer or viewing a specially formatted HTML e-mail with Outlook. So far, there are no reports of trusted Web sites trying to exploit the vulnerability. "We're anticipating that somebody is going to pop a trusted site and then we'll have a big problem," said Skoudis. "We went to yellow so people will do work-arounds." Microsoft said earlier this week it was aware of the problem and planned to issue a patch next month during its regularly scheduled update, "or sooner if necessary." Among the work-arounds is a patch being made available by the Zeroday Emergency Response Team (ZERT). The group also offers a Web page to test whether a machine has successfully been patched. Other temporary remedies include unregistering vgx.dll, the dll file that is targeted in attacks, or simply not using Internet Explorer and Outlook. Scott Deacon, a program manager with Microsoft's Security Response Center, said on the company's Web site that attacks remain limited. "Thereâs been some confusion about that, that somehow attacks are dramatic and widespread," Deacon wrote. "Weâre just not seeing that from our data, and our Microsoft Security Response Alliance partners arenât seeing that at all either." Microsoft cannot vouch for the quality of third-party fixes, and users should always install Microsoft updates as soon as they become available, Deacon added. But other groups also warned that the VML vulnerability was becoming a bigger target. Websense Security Labs said it has monitored attacks that include Trojan backdoors and code that is designed to steal information from end-user machines. Several Web sites are publishing example code, making it easier for others to pull off an attack, Websense said on its Web site.
682593
(InfoWorld) - A new version of the IcePack hacker exploit tool kit has been released, security researchers warned Tuesday, and for the first time it includes attack code designed to exploit an unpatched, or zero-day, Microsoft vulnerability. Three of IcePack's eight exploit tools are new, said Roger Thompson, chief technology officer at Exploit Prevention Labs. That's noteworthy in and of itself, Thompson said. "The mix of old and new exploits is to be expected, but three new ones in one update is pretty impressive," he noted. But the new tool kit also sports a first. "The latest iteration has done something original," said Thompson, pointing to an exploit that attacks a zero-day vulnerability in Microsoft's DirectX software development kit (SDK). "The closest to a tool-kit zero-day exploit [before] was for the ANI [animated cursor] vulnerability." He was referring to a Windows bug that surfaced in early April. By the time that Mpack, an IcePack predecessor, added the ANI exploit, however, Microsoft had patched the vulnerability with an emergency out-of-cycle update. The DirectX SDK bug was disclosed by Polish researcher Krystian Kloskowski in a post to the milw0rm.com site in mid-August. Microsoft did not release a fix for the flaw in the regularly scheduled updates issued earlier Tuesday. IcePack is only one of several click-to-attack malware tool kits in circulation. Derived from the earlier Mpack, IcePack joins others boasting monikers such as NeoSploit and WebAttacker that cater to what Thompson called "lazy crooks." "Originally there was just WebAttacker, but they screwed up and then NeoSploit came along," Thompson said as he rattled off the exploit tool kit genealogy. "Then there was Mpack, which everyone at first thought was just WebAttacker, but it wasn't. Now there's IcePack." He estimated that nine to 12 malware tool kits are currently in use. "They all use very similar code, and they're all trying to make a buck out of selling to lazy crooks," said Thompson. Even though the just-updated IcePack features the first zero-day attack code seen in a malware kit, Thompson downplayed the threat. Sort of. "This is not an end-of-the-world kind of thing, since not many people will have the [DirectX] SDK. But no one knows what other software packages use that [vulnerable] ActiveX control. It's a little like Russian roulette that way." Other researchers confirmed Thompson's assessment. Symantec, for instance, warned customers of its DeepSight threat network that it had spotted in-the-wild attacks using the DirectX exploit. Symantec's researchers also confirmed that the other two exploits new to IcePack target vulnerabilities in Yahoo Messenger and Yahoo Widgets. Both of those bugs, however, have been patched. Taking aim at patched vulnerabilities is a common characteristic of multistrike kits, even though it might seem counterintuitive, said Thompson. "They usually go after lesser-known vulnerabilities," he said.
275233
In my last blog post, I mentioned the work on rubinius (then at a 0.7 release and now at 0.8) and JRuby.  I also promised I&#8217;d follow up on them.  Here&#8217;s what&#8217;s been going on so far.
283610
Nearly two years after Microsoft issued a patch, enough systems remain vulnerable that criminals still including this exploit (and others) in their bag of tricks.
16024
(InfoWorld) - Hackers have released attack code that exploits a critical vulnerability in Microsoft's Word software -- the thirdÂ such bugÂ to be disclosed in the past week. The proof of concept code was posted Tuesday on the Milw0rm.com Web site, making it widely available to the hacking community. It exploits a previously unreported bug in Word. Like the other recent Word bugs disclosed this past week, it could be used by attackers to run unauthorized software on a victim's computer, said David Marcus, security research and communications manager with McAfee Inc.'s Avert Labs Attackers have been using these Word exploits in extremely targeted attacks, where a small number of victims are sent an e-mail with a maliciously encoded Word document attached. The hackers useÂ social engineeringÂ techniques to try to trick the victim into opening the dangerous attachment. For example, in a recent Word attack, first reported Sunday, the malicious e-mail "was sent to a very high-profile company, directly to three people at the company," Marcus said. Microsoft is investigating reports of this latest Word bug, a spokesman for the company's public relations agency said. Though they are not being widely exploited, the unpatched Word vulnerabilities are causing some enterprises concern. At the Port of Seattle, for example, users are being cautioned and e-mail with Word attachments is getting a little more scrutiny, said Ernie Hayden, chief information security manager with the port. "We've done some blocking on our e-mail, and we've had dialogue with people with respect to what our expectations are," he said. Attacks on Microsoft's Office software have been on the rise for months now, said Marc Maiffret, chief technology officer with security vendor eEye Digital Security Inc. Office vulnerabilities were once released "on a monthly basis," he said. "Now we're at the point were it's almost daily." Still, publishing attack code ultimately works contrary to the interests of the bad guys, he added. "It's kind of disruptive, and it creates a panic," he said. "But all it does is make the industry focus and come up with a resolution."
342998
Security experts are warning of a zero-day vulnerability with Sun Microsystems Inc.'s Solaris 10 and 11 OSes.
689796
Zero Day Patches &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29