Veracode pitches backdoor apps security
688297
Veracode launched a new version of its binary code analysis service on Monday that focuses specifically on helping software engineers find potential backdoor vulnerabilities in their programs.
631446
Microsoft guru predicts Vista half as buggy &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
350029
Software maker's first antispyware application is nearly ready for action. It could be released this week.
398139
Makes it possible to remove password protection from Quicken files A Russian firm that provides password-recovery services says it has found a backdoor in the encryption mechanism that Quicken uses to secure password-protected files, a feature that makes millions of users of the personal finance program more vulnerable to government spooks or other highly determined snoops.â¦
239662
&lt;b&gt;Mod Your iPhone &amp;#150; For Fun or Profit?&lt;/b&gt; &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
390760
For the second year running, security researcher Kurt Grutzmacher has found a way to get a free &quot;Platinum&quot; pass to the MacWorld Conference &amp; Expo, being held in San Francisco this week.Thanks to a design flaw in the conference&#39;s Web site, he was able to figure out the special promotional code and award himself a 100 percent discount when purchasing the show&#39;s most expensive pass .The problem was that the site was downloading an encrypted version of the promotional codes to the browser so that it could check for discounts before passing data to MacWorld&#39;s Web server. Site developers may have done this to reduce the time it takes to process conference applications, but in doing so they introduced a serious security vulnerability, Grutzmacher said.Although the promotional codes were encrypted, Grutzmacher used a password-cracking tool called John the Ripper to break the encryption and see the discount codes. &quot;I was very surprised it worked,&quot; he said in an e-mail interview.That&#39;s because it was the same technique that yielded a Platinum pass for the 2007 show . At that time, the show&#39;s promoter, IDG World Expo, &quot;removed all the codes, fixed the site, and said thanks,&quot; Grutzmacher said in a Monday blog posting showing how he cracked the site. &quot;I gave them a few tips (don&#39;t trust user input, don&#39;t give your secret codes to everyone, encryption is not one-way, etc). Did they listen? Nope.&quot;Grutzmacher ran his test in the weeks prior to the show, and the code he obtained stopped working on Jan. 7, he said.Show representatives were not immediately available to comment.The security penetration tester went down to San Francisco&#39;s Moscone Center on Monday to print up his pass, just to see if his trick worked, but he didn&#39;t actually use it to visit the show. &quot;That would be very unethical,&quot; he said.Had he made use of the US$1,895 pass, however, Grutzmacher could have had a free lunch, access to sessions at the conference, entry into the MacWorld party and priority access to Steve Jobs&#39; keynote on Tuesday.&quot;Justin,&quot; a commentator on Grutzmacher&#39;s blog, said he reported a similar bug to IDG in 2003.Grutzmacher said that this is probably not the last we&#39;ll hear of this problem. &quot;I suspect we&#39;ll see this again in 2009,&quot; he said.The MacWorld Conference &amp; Expo is run by IDG Wold Expo, an IDG News Service affiliate.
451531
Code that takes advantage of a Safari flaw could leave an iPhone open to attack.
181963
Watchfire Corp, which takes an ethical hacking approach to uncovering website vulnerabilities, is releasing a new version of its enterprise offering that extends coverage to loosely scripted, highly interactive Ajax-style applications.
99610
Blog: This ambitious suite will go beyond basic antivirus and firewall protection for your mobile device.
194775
Another data security bill in the works &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
42081
Blog: Popular add-ons could have their update process hijacked by man-in-the-middle attacks.
459140
eEye site, launched Tuesday, tracks publicly released unpatched security bugs and offers suggestions for protecting against them.
768077
Will companies that make antispyware software detect key loggers implanted by federal agents? We survey 13 companies and include their answers verbatim.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
29663
Company has started sharing some APIs with security vendors, in a bid to create better ways of securing virtual machines.
285360
Blog: Researcher shows how URLs can be spoofed and content arbitrary within Safari 3.0 beta.