online information Computer security community for internet safety and trusted networks – news & articles for windows & other operating systems securiour.com first NEWS breaking in intrusion prevention and security risk management, proactively secures systems, and networks, worldwide
An attacker could launch this type of attack to run unauthorized software on a device connected to the network. In theory, criminals could use this kind of attack to steal sensitive information from mobile phones or redirect Internet traffic on routers, say from a user’s online bank account to a hacker site set up to steal account and password information.
It’s an alternative to hacker techniques like buffer overflow attacks, which attempt to trick the processor into running code that is snuck into the computer’s memory.
Jack plans to disclose details on this attack – and the things that device makers can do to avoid it – at the CanSecWest security conference being held later this month in Vancouver.
The new and upgraded services, set to come out this quarter, are designed to help large organisations protect themselves from threats as well as manage and archive email and instant messaging.
Enhancements to Postini’s archiving services include a new investigation management feature designed to ease the legal discovery process – and comply with the new US Federal Rules of Civil Procedure, for example. These rules, which took effect in December, require businesses to retain and be able to produce electronic records for courts and litigating parties.
Also new are the Postini Personal Archive and Postini Toolbar, which give an organisation’s users access to archived email and instant messages from their desktops without having to get the IT department involved.
New encryption features include the ability to send encrypted mail to consumers who can easily decrypt, view and reply to messages in their in-box, officials said. Postini already offers business-to-business encryption via its Transport Layer Security service.
Mozilla’s Firefox 2.0 is vulnerable to attackers armed with the Windows animated (ANI) cursor exploit, that yesterday (3 March) promoted Microsoft to rush out an emergency patch.
Alexander Sotirov, the vulnerability researcher at Determina who discovered the ANI flaw last December and notified Microsoft of it later that month, yesterday posted a demonstration of an ANI exploit that hijacks a PC when Firefox users are conned into visiting a malicious site.
“It turns out that Firefox uses the same vulnerable Windows component to process .ani files, which can be exploited in a way similar to Internet Explorer,” Sotirov said during the demo.
He showed how both IE7 and Firefox 2.0, when run on a Vista-powered PC, can be hijacked by an attack using the ANI exploit he created in December as a vulnerability proof-of-concept, which he also shared with Microsoft’s security team.
When the attack was run against IE 7, the ANI exploit gave access to all files on the system. “However, we cannot alter any system files” because of IE’s protected mode, which is enabled by default in Vista, said Sotirov.
Vista’s version of IE7 runs in a low-privilege mode — dubbed “protected mode” by Microsoft — that blocks disk write access to all but a temporary files folder.
EEye spokesman Sean Martin confirmed Brown’s departure Tuesday, saying that the company would issue a statement on the management change on Wednesday.
EEye’s board of directors asked Brown to leave, replacing him with Kamal Arafeh, the company’s senior vice president of sales and marketing, said a source familiar with the matter, who asked not to be identified.
Brown came to eEye, based in Aliso Viejo, California, in 2005 from Citrix Systems Inc., and had just been made CEO last September, after first serving as the company’s chief operations officer.
Founded in 1998, eEye is a vendor of endpoint security software. The company counts Citigroup, Continental Airlines, and the U.S. Department of Defense among its customers.
EEye is not the only security vendor to be shifting things at the top. On Monday, San Mateo, California’s Sana Security Inc. announced that former Cisco Systems Inc. executive Don Listwin has taken over as CEO. He replaces John Zicker, who is staying on as President.
Listwin is a Sana investor and board member who at one point had been considered the heir to Cisco CEO John Chambers. He left Cisco in 2000 to run OpenWave Systems Inc.
Sana’s “behavior-based” security software is considered to be technically interesting, but the company has struggled to market its products.
After undergoing a rash of investment several years ago, the security market is now experiencing a wave of consolidation.
In an interview Tuesday, Listwin said that some security companies are going to feel the pinch. “Yes we are going to see a lot of people dropping out and picked up for pennies on the dollar,” he said.
While the month of MySpace bugs project kicked off on schedule to start the month, another hacker campaign turned out to be an elaborate April Fools’ Day joke.
The Week of Vista Bugs project was designed to play a trick on the media, but also to get people to be more security minded and realize that hoaxes such as this can happen in the same way phishing scams can occur, the organizers said.
To get their point across, the hackers spent some time tricking the security world into believing their prank was similar to the whirlwind of bug-a-day campaigns that have become popular since researcher H.D. Moore launched the Month of Browser Bugs last summer.
Protection for data on the move
Fujitsu Europe is offering the optional fitting of its latest hard drive series MHW2xxxBH with a freefall sensor (FFS).
Fujitsu said it has started offering new optional protection mechanism to all SATA-hard disc drives of the MHWxxxxBH-series with a capacity of 40 to 160 GB and all new models. FFS can protect hard drives from potential data loss or damage.
Tricky little blighter but no harm done.
A worm targeting Skype is harvesting email addresses and directing users to a range of sites hosting other malicious software, according to security vendors.
Cross-platform worm shows open source hasn’t learnt from proprietary world.
The first cross-platform worm specifically tailored for the open-source OpenOffice.org and StarOffice productivity suites has raised a few hackles in open source circles, since it appears to tarnish the suite’s reputation for security.
Amid warnings about the risk of identity theft, Canadian insurance companies have begun offering policies that help defray the cost of setting things right, if you fall victim.
Identity theft occurs when a crook uses another person’s name and other personal information such as social insurance number, credit-card number or bank account illegally to make purchases, borrow money or make some other costly transactions without the victim’s consent or even knowledge.
According to research by Phonebusters, a national anti-fraud organization…, thousands of Canadians a year report cases of identity theft — although the rate may be lower now than it was a few years ago.
It can be time-consuming and costly for innocent victims of identity theft to compile the information and get the legal advice required to verify they aren’t at fault. It’s those expenses — such as lost wages, lawyer and notary fees and courier charges — that are covered by identity theft insurance.
“Those are where the real expenses come in. It’s not the $5,000 or $10,000 loan. It’s the expense of clearing everything up,” says Bryan Seaton, spokesman for ING Canada, which recently began offering identity theft protection across Canada.
There has been increased public awareness of the measures — such as shredding documents with account numbers, proper storage of passwords and account numbers and software protections for your computer — that can be taken to prevent your personal information from getting into the wrong hands.
“We have a duty to defend your title. So we do what we can to get it resolved. Or, in a worst-case scenario, we can pay out the money that you’ve lost as a result of this problem,” says Kathleen Waters, vice-president of Title Plus, a service provided by Lawyers’ Professional Indemnity Co.
This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.
Today I added a little simple SQL Injection Detection Heuristic to the development version of the Suhosin extension that can optionally log and block SQL queries. At the moment it is possible to log and/or block mysql(i) SQL queries that contain comments, comments that are not closed, queries with UNIONs or queries with multiple SELECT statements.
While this are very trivial checks they are very powerful and effective against a large number of SQL Injection attacks. Many PHP applications never have comments in their SQL statements, therefore any embedded comment and especially unclosed /* comments could be attempts to truncate the data after the injection point. The same is true for UNION and multiple SELECT statements (in subqueries). Both features are not used in the majority of open source PHP applications because they are not needed for the tasks or because compatibility with old MySQL versions was kept for a long [...]
Windows Vista the latest edition of the Windows product from Microsoft, supposidly the most secure OS yet (so secure Microsoft have quoted as Vista not needing an antivirus software) although many security flaws have been found both by software security firms such as Determina plus many hackers finding exploits in Vista.
Apart from security firms such as Determina discovering flaws, a russian hackers (amongst many others) has discovered a flaw in Windows Vista and posted the details on a hackers website, although Microsoft believe that it is nothing to worry about for the moment as it is simply an initial swipe of their security.
It may be possible that Vista will either be slightly delayed for bug fixes or maybe a service pack released soon after the public release of Vista.
Check back soon for a list of some of the Vista flaws.
The WiFi security protocol WEP should not be relied on to protect
sensitive material, according to three German security researchers who
have discovered a faster way to crack it. They plan to demonstrate their
findings at a security conference in Hamburg this weekend.
Mathematicians showed as long ago as 2001 that the RC4 key scheduling
algorithm underlying the WEP (Wired Equivalent Privacy) protocol was
flawed, but attacks on it required the interception of around 4 million
packets of data in order to calculate the full WEP security key.
Further flaws found in the algorithm have brought the time taken to find
the key down to a matter of minutes, but that’s not necessarily fast
enough to break into systems that change their security keys every five
minutes.
Now it takes just 3 seconds to extract a 104-bit WEP key from
intercepted data using a 1.7GHz Pentium M processor. The necessary data
can be captured in less than a minute, and the attack requires so much
less computing power than previous attacks that it could even be
performed in real time by someone walking through an office.
Anyone using WiFi to transmit data they want to keep private, whether
it’s banking details or just email, should consider switching from WEP
to a more robust encryption protocol, the researchers said.
“We think this can even be done with some PDAs or mobile phones, if they
are equipped with wireless LAN hardware,” said Erik Tews, a researcher
in the computer science department at Darmstadt University of Technology
in Darmstadt, Germany.
Tews, along with colleagues Ralf-Philipp Weinmann and Andrei Pyshkin,
published a paper about the attack showing that their method needs far
less data to find a key than previous attacks: just 40,000 packets are
needed for a 50 percent chance of success, while 85,000 packets give a
95 percent chance of success, they said.
Although stronger encryption methods have come along since the first
flaws in WEP were discovered over six years ago, the new attack is still
relevant, the researchers said. Many networks still rely on WEP for
security: 59 percent of the 15,000 WiFi networks surveyed in a large
German city in September 2006 used it, with only 18 percent using the
newer WPA (WiFi Protected Access) protocol to encrypt traffic. A survey
of 490 networks in a smaller German city last month found 46 percent
still using WEP, and 27 percent using WPA. In both surveys, over a fifth
of networks used no encryption at all, the researchers said in their
paper.
