Infocus: Examining a Public Exploit, Part 2
681077
The purpose of this article is to analyze a public exploit in a lab environment, see the alerts generated by an intrusion detection system, and then do some packet analysis of the malicious binary in order to better understand what it does and how you may have been compromised. Part 2 of 2.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
298773
Researcher finds two flaws that under unusual circumstances could let a malicious program read private data or render a phone unusable.
524524
An attack utilizing a vulnerability in an ActiveX control for the popular RealPlayer media program may be spending in a more more dangerous fashion than anyone realized. Exploit code for the vuln has been found embedded in ads served up from a popular advertising site.
316820
The purpose of this article is to analyze a public exploit in a lab environment, see the alerts generated by an intrusion detection system, and then do some packet analysis of the malicious binary in order to better understand it.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
21973
A formula for Web schemes: a lot of mathematicians, a lax legal system and Western targets.
405731
A security researcher demonstrates a way to use cross site scripting to remotely spam an internal network printer.
498738
A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
94093
An intruder could manipulate a flaw in how the browsers handle image files to see where the user has been surfing.
503684
Talk about the worst of both worlds: When Jon Espenschied tried to untangle a malware attack on his dual-boot system, he found out just how vulnerable combining open- and closed-source software can leave a machine.
383627
A toolkit designed to exploit a recently-disclosed Microsoft JPEG vulnerability has been released onto the net. The toolkit (screen shot from AV firm F-Secure here) makes it trivially easy for maliciously-minded
675996
IT security experts have uncovered a critical vulnerability in the popular Winamp media player, which could be exploited by hackers to compromise a user&#39;s system.
448507
An independent researcher finds an Internet Explorer vulnerability that could turn drag-and-drop into drag-and-infect.
542850
A directory reversal within "flat" extensions could lead to system profile attacks.
613037
(InfoWorld) - An anonymous security researcher claimed this weekend to have created a worm that exploits a vulnerability in the Mac OS X operating system which Apple missed in a May round of patches. A poster on theÂ Information Security Sell OutÂ blogÂ said Sunday that he or she had written a proof-of-concept worm "in a few hours" that exploits a variation of a vulnerability patched in May by Apple. According to the researcher (actually, in one posting, "writers" is used so there may be more than one contributing), he or she exploited a still-unpatched bug in mDSNResponder, a component of Apple's Bonjour automatic network configuring service, in the worm's code. "This vulnerability, as with the ones fixed, gives remote root access," the researcher said. Apple'sÂ May security update,Â 2007-005, included a fix for the mDSN bug. Info Sec's blogger(s) said the worm was also "very 'customer' specific" and crafted for cash. "[It] could easily be changed to be more malicious," said the researcher. The same blogger made aÂ minor stirÂ in April when, after a $10,000 security conference contest concluded, he or she claimed to have grabbed the exploit from the conference wireless network and reverse-engineered the vulnerability. Conference organizers, however, denied that the wireless network had been cracked. When asked to back up his or her claims, the Info Sec blogger only replied: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not." In the same comment thread, the Info Sec blogger also promised to post the captured packets and other information "Once this bug is patched by Apple and I am satisfied that I would not be adding additional risk." Apple patched theÂ QuickTime vulnerabilityÂ May 1. The Info Sec blogger has not yet, however, posted the nicked network traffic. Attempts to reach the Info Sec blogger via e-mail were unsuccessful.
641298
Reports of vulnerabilities found by some peer-to-peer file sharers prompt patch.