Anonymous researcher boasts of building Mac worm
613037
(InfoWorld) - An anonymous security researcher claimed this weekend to have created a worm that exploits a vulnerability in the Mac OS X operating system which Apple missed in a May round of patches. A poster on theÂ Information Security Sell OutÂ blogÂ said Sunday that he or she had written a proof-of-concept worm "in a few hours" that exploits a variation of a vulnerability patched in May by Apple. According to the researcher (actually, in one posting, "writers" is used so there may be more than one contributing), he or she exploited a still-unpatched bug in mDSNResponder, a component of Apple's Bonjour automatic network configuring service, in the worm's code. "This vulnerability, as with the ones fixed, gives remote root access," the researcher said. Apple'sÂ May security update,Â 2007-005, included a fix for the mDSN bug. Info Sec's blogger(s) said the worm was also "very 'customer' specific" and crafted for cash. "[It] could easily be changed to be more malicious," said the researcher. The same blogger made aÂ minor stirÂ in April when, after a $10,000 security conference contest concluded, he or she claimed to have grabbed the exploit from the conference wireless network and reverse-engineered the vulnerability. Conference organizers, however, denied that the wireless network had been cracked. When asked to back up his or her claims, the Info Sec blogger only replied: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not." In the same comment thread, the Info Sec blogger also promised to post the captured packets and other information "Once this bug is patched by Apple and I am satisfied that I would not be adding additional risk." Apple patched theÂ QuickTime vulnerabilityÂ May 1. The Info Sec blogger has not yet, however, posted the nicked network traffic. Attempts to reach the Info Sec blogger via e-mail were unsuccessful.
427916
One of the first pieces of malicious code targeting Apple's Mac OS X operating system has been discovered.
172825
Huge crowds in social networking sites draw money-minded malware authors.
238166
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs--it wants to invade their homes, too.
503684
Talk about the worst of both worlds: When Jon Espenschied tried to untangle a malware attack on his dual-boot system, he found out just how vulnerable combining open- and closed-source software can leave a machine.
472866
An anonymous hacker who claimed last week to have found a way to generate valid Windows Vista activation codes now says his crack was a joke. But some users who tried it say it worked for them.
298773
Researcher finds two flaws that under unusual circumstances could let a malicious program read private data or render a phone unusable.
437767
Microsoft is moving to counter some scathing comments regarding a security paper authored by researchers at its Cambridge, England, facility.The paper, &quot;Sampling Strategies for Epidemic-Style Information Dissemination,&quot; looks at how worms sometimes inefficiently spread their code.The research explores how a more efficient method could, for example, be used for distributing patches or other software. The advantage would be that patches could be distributed from PC to PC, rather than from a central server.That method would reduce the load on a server, and patches would be distributed faster. But the patches would have the same qualities as a computer worm, a generally malicious file.Since a story about the paper appeared on Thursday in the New Scientist magazine, the paper has been roundly assailed.&quot;This is a stupid idea,&quot; wrote Bruce Schneier, a security expert, author and CTO of Mountain View, Calif.-based enterprise security vendor BT Counterpane, on Tuesday, before quoting a passage from the New Scientist story on his blog.Schneier wrote that the idea of so-called &quot;benevolent worms&quot; comes up every few years.However, a worm is designed to run without the consent of a user, which doesn&#39;t make it a good method of software distribution, Schneier wrote. The worm patching technique could also make the patches hard to uninstall or interrupt during installation, he wrote.Worms designed to distribute software patches could also be hacked to distribute malicious software, wrote Randy Abrams, director of education for security vendor Eset, in his regular e-mail commentary.Forced patching is also troublesome since some patches may not be compatible with critical software, Abrams wrote.&quot;Breaking into computers is a bad idea,&quot; Abrams said.A Microsoft spokesman said on Monday that the New Scientist story is not inaccurate. However, the writer of the story &quot;sexed&quot; up the research paper a bit, particularly with the headline that used the phrase &quot;friendly worms,&quot; the spokesman said.In response to the criticism, Microsoft said it doesn&#39;t intend to develop patch worms.&quot;This was not the primary scenario targeted for this research,&quot; according to a statement.The company also said it will continue to let customers decide how and when they apply security updates.One of the paper&#39;s authors, Milan Vojnovic, said in a statement that there were no plans to incorporate the ideas into Microsoft&#39;s products. Efforts to reach Vojnovic for comment were unsuccessful.
564338
A rootkit based on proof-of-concept code presented at 2005's Black Hat conference is currently infecting thousands of Windows-based PCs, and researchers say it's a remarkably sophisticated -- and hard-to-eradicate -- infection.
638637
Security reseacrhers are warning about the "Srizbi" Trojan, which is being distributed through the Mpack hacker toolkit and is difficult to detect because it hides in the Windows kernel.
598197
Technique lets intruders exploit flaws previously thought to be insignificant, says security researcher.
426070
Researcher who demonstrated the "sidejack" attack at Black Hat USA now says even encrypted Gmail can be compromised.
22051
A researcher at ShmooCon on Saturday demonstrated how browser hotkeys can expose the internal network running behind a Citrix presentation server.
341450
A new MyDoom worm released this week taunts the just-charged author of a rival malware line by including his mug shot. MyDoom.y -- but also called MyDoom.
682949
The newest version of the MyDoom worm now circulating suggests to security experts that the much-anticipated &quot;Zero Day attack&quot; may have arrived.
80703
The MacSweeper site purports to scan Macs for security issues, then sell users a software fix--but researchers have their doubts.
39099
A security researcher establishes his own exit nodes on The Onion Router network and sniffs e-mail of foreign embassy workers around the world.