UN European HQ May Be Full of Bugs - Security Source
6403
The United Nations European headquarters, where a listening device was discovered in a ministerial meeting room, is probably rife with secret spying equipment, a UN security source said on Friday.
387396
Security experts warn that virus writers could be preparing to create havoc using a bug in the way that Windows handles images.
145749
GENEVA - The United Nations said on Thursday a secret listening device had been found in a posh meeting room of its European headquarters in Geneva.
511916
A vulnerability in OpenOffice could allow attackers to remotely execute code on computers running Windows, Linux or Mac OS.
224580
(InfoWorld) - IT systems integrator Unisys Corp. is under fire for allegedly failing to detect the hacking of U.S. Department of Homeland Security computers, an incident that resulted in data being sent to a Chinese-language Web site. Unisys is now under investigation by the U.S. Federal Bureau of Investigation, according to an aide for the House of Representatives' Committee on Homeland Security, which started investigating the DHS and Unisys in April. The committee sent a letter to the DHS on Friday asking for its inspector general to open an investigation, the aide said. The letter said DHS had 844 "cybersecurity incidents" during fiscal 2005 and 2006, which the committee called "high and unacceptable." The data breach adds to the growing chorus of complaints from countries such as France, Germany and the U.K. thatÂ hackers in China have stepped up their game, hunting for sensitive information on government computer systems. In 2002, Unisys won a US$1 billion contract to manage computer systems belonging to the DHS and the Transportation Security Administration, which were created after the Sept. 11, 2001, terrorist attacks to shore up the nation's defense. Unisys received a $750 million contract in early 2006 to continue the work. Under the contracts, Unisys installed six intrusion-protection devices, said Lisa Meyer, Unisys spokeswoman. Those devices, which can detect unauthorized activity on a network, were not installed properly, alleges the committee. Three months passed before clues emerged that malicious software capable of copying and transferring files had been installed on 150 DHS computers. The data, although unclassified, was transferred late at night or early in the morning to a Chinese-language Web site, according to committee evidence and testimony. Two U.S. representatives also accused the DHS and Unisys of ignoring warning signs of the hacking. In a statement , Unisys denied the intrusion protection devices were improperly installed and that the company reported security incidents. Meyer said Unisys has not been notified by either the FBI or the committee of an investigation. She said she could not comment further on specific security incidents. The FBI referred questions to DHS officials, who could not immediately be reached. Â
286409
The U.N.'s European headquarters is  probably riddled with listening devices, a United Nations  security source said on Friday, a day after the organization  disclosed it had found a secret microphone in a meeting room.
732235
InfoWorld - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters
262500
The glitch, which could permit an attacker to secretly search the contents of a personal computer via the Internet, is the kind of flaw that emerges when separate components interact.
600362
The United Nations has called off an internal inquiry into the discovery of a secret listening device at its European headquarters in Geneva without finding out who planted the bug or when.
5970
A panel set up last year by UN Secretary-General Kofi Annan, is looking to make changes that will help combat new security threats in the world and add strength to the United Nations.
661646
Open-source developers have warned of serious security holes in two Linux components that could allow attackers to take over a system by tricking a user into viewing a specially crafted image file or opening an archive. Patches exist for the bugs, which affect LHA and imlib.
321195
Researchers warn that a number of critical holes have been found in Microsoft Windows XP which could be exploited. Symantec acted after security researchers published the details of the heap overflow vulnerabilities
522714
(InfoWorld) - oMicrosoft released six sets of security patches Tuesday that address critical flaws in its products, including a bug in Active Directory software. The software vendor also fixed critical vulnerabilities in Excel and the .Net Framework as well as less-critical bugs in Microsoft Office Publisher, Internet Information Services (IIS), andÂ the Vista firewall. The six updates addressed a total of 11 bugs. The MS07-039 Active Directory update, which is for Windows 2000 Server and Windows Server 2003 systems, should be at the top of enterprise IT administrators' lists, said Eric Schultze, chief security architect with Shavlik Technologies. "That one scares me because those are the crown jewels there. And it looks like you're caught with your pants down at the moment." The flaw deals with the way Active Directory processes LDAP client requests. Attackers could create a malicious LDAP request that would then allow them to "take complete control of an affected system," Microsoft warned in its advisory on the flaw. Active Directory enables LDAP by default, but there are factors that mitigate a possible attack. The flaw can be exploited by an anonymous user attacking a Windows 2000 Server, but with Windows Server 2003 a hacker would need to have user credentials for the attack to work. Also, Windows Active Directory servers are typically protected by the firewall, so the attacker would most likely have to be inside the corporate network, Schultze said. The Excel and .Net Framework updates each fix three vulnerabilities in these products and are both rated critical by Microsoft because they could be exploited by attackers to install unauthorized software on a victim's computer. Two of the less-critical patches are also noteworthy. The MS07-041 patch fixes a flaw that could allow an attacker to take over a Windows XP-based Web server by sending specially crafted URLÂ requests. Microsoft rated this flaw as "important" rather than "critical," however, because it only affects XP systems, and IIS is not installed by default on XP. Microsoft also patched a flaw in the Windows Vista firewall. The bug, which is in Vista's Teredo IPv6 tunneling protocol, would allow an attacker to find out if a Vista computer is on the network. Normally the Vista firewall should simply block unsolicited traffic trying to communicate over the Teredo interface. The bug could not be exploited to take over a Vista machine and is considered low risk, Schultze said. "If Teredo is turned on, something within it would give a response back, even though the firewall is turned on," he said. Microsoft has released 41 updates so far in 2007. That's a little ahead of the 39 updates it had released by this time last year.
367211
Days after sample attack code for a yet-to-be-patched flaw surfaced, malicious sites are popping up that exploit the hole.
390629
The United Nations has ended an internal inquiry into the discovery of a secret listening device at the world body&#39;s European headquarters without finding out who planted the bug or when, officials said Friday.
371979
A study commissioned by the EU calls for a major rethink of security within its borders and beyond.
463748
The United Nations said on Thursday a secret listening device had been found in a posh meeting room of its European headquarters in Geneva.