Ani cursor exploits – Plain text mode is also vulnerable

“A short overview of how the different email clients (in the supported list of Microsoft) are reacting to the animated cursor vulnerability (CVE-2007-1765) depending on the actions and settings of the email client. The surprising element is that read in plain text mode makes some of the clients more vulnerable and actually only offers real added value -for this vulnerability- for Outlook 2003.” http://isc.sans.org/diary.php?storyid=2539 See table which is vulnerable in the above link

Why Encryption Didn’t Save TJX

TJX: It’s the target of the largest known customer record theft of all time, and it’s a case in point that encryption is not a silver bullet. This is the heart of the encryption problem, quoted from the 10-K filing The TJX Companies made to the Securities and Exchange Commission: “Despite our masking and encryption practices on our Framingham system in 2006, the technology utilized in the Computer Intrusion during 2006 could have enabled the Intruder to steal payment card data from our Framingham system during the payment card issuer’s approval process, in which data (including the track 2 data) … Continue reading Why Encryption Didn’t Save TJX

2 ie7.0.exe – different file hashes and file size

I grabbed that fake IE 7 download which is infected and not all antivirus detects them.  I posted the screenshot of the scan results of these 2 ie7.0.exe at http://www.dozleng.com/updates/topic13777 At first, Symantec antivirus does not detect both.  I submitted to them the smaller file (33280 bytes) then after some hours, I updated the definitions using LiveUpdate and I got a daily update.  I re-scanned the file that I submit to them for analysis and it is detected now as “trojan horse” http://www.symantec.com/security_response/writeup.jsp?docid=2004-021914-2822-99 In the Figure 1 at CoU, you can see that VirusTotal show it is detected by Symantec. … Continue reading 2 ie7.0.exe – different file hashes and file size

Genuine Software Initiative’s First Year and Beyond

Q&A: This first year represents only the beginning of a marathon, and Microsoft is committed to this race, says Cori Hartje, Microsoft’s anti-piracy director As an industry leader, Microsoft continues to innovate in the area of software protection technologies and has taken steps on behalf of its customers and partners to reaffirm its commitment to reducing software piracy. http://www.microsoft.com/Presspass/Features/2007/mar07/03-30GenuineSoftware.mspx

Linksys Products Information Disclosure Security Issue

Affected product: Linksys WAG200GLinksys WRT54GC A security issue has been reported in various Linksys products, which can be exploited to disclose certain sensitive information. The problem is that it is possible to disclose certain information e.g. the product model, the web interface password, the PPPoA username, the PPPoA password, the SSID, and the WPA passphrase by sending a UDP packet to port 916 of the device. The security issue is reported in WAG200G with firmware 1.01.03 and earlier, WRT54GC v1 with firmware 1.03.0 and earlier, and WRT54GC v2 with firmware 1.00.7 and earlier. Solution:  The vendor expects to release new … Continue reading Linksys Products Information Disclosure Security Issue

Windows Vista ATI Radeon Kernel Mode Driver Denial of Service

Affected OS: Microsoft Windows Vista A weakness has been reported in Windows Vista, which can be exploited by malicious, local users to cause a DoS (Denial of Service). The weakness is caused due to an unspecified error within the ATI Radeon Kernel Mode Driver (atikmdag.sys) in certain system configurations. This can be exploited to crash the system by e.g. enabling the slideshow feature on certain directories, or loading or quitting certain games. Solution: Do not use the slideshow feature. Use a different driver. http://secunia.com/advisories/24667/

Rootkits outfox old-school malware protection

Security experts now believe that trojan, spam and malware protection software cannot adequately prevent system compromise by increasingly sophisticated rootkits. Rootkits are used to conceal the presence of trojans, hacker backdoors, and botnets by cloaking their files and processes through modifying the output of common operating system routines. They grant administrator access to a system after a hacker installs them typically through obtaining user level access by exploiting known vulnerabilities. Intelligent Security Research Services analyst James Turner said rootkits will be increasingly used in highly targeted attacks as they become more sophisticated and form a critical part of hacker arsenals. … Continue reading Rootkits outfox old-school malware protection

eEye released temporary software to patch a 0-day

eEye released temporary software to patch the 0-day posted earlier here. http://research.eeye.com/html/alerts/zeroday/20070328.html QUOTE eEye Digital Security’s Research Team has released a workaround for the zero-day vulnerability as a temporary measure for customers who have not yet installed Blink. Blink generically protects from this and other vulnerabilities without the need for updating and is available for free (http://www.eeye.com/html/products/blink/neighborhoodwatch/index.html) for personal use. This workaround is not meant to replace the forthcoming Microsoft patch, but rather as a temporary mitigation against this flaw.   The temporary patch mitigates this vulnerability by preventing cursors from being loaded outside of %SystemRoot%. This disallows websites from loading … Continue reading eEye released temporary software to patch a 0-day

Beware fake IE 7 downloads – IE7.0.exe

I received an email that says there’s IE 7 download and email is spoofed. It says from admin @ microsoft.com Alex of Sunbelt received too. See the screenshot and his findings:http://sunbeltblog.blogspot.com/2007/03/beware-fake-ie-7-downloads.html MVP Corrine received it too: http://securitygarden.blogspot.com/2007/03/beware-of-ie7-beta-spam.html http://isc.sans.org/diary.php?storyid=2537 Filename of fake IE is IE7.0.exeOnly few security tool can detect it. F-Secure got it too: http://www.f-secure.com/weblog/#00001155

Top 12 Operating Systems Vulnerability Survey

Have you ever wondered how vulnerable your computer is from the first bit you write to the hard drive all the way until you have a fully patched system? If so, Matthew Vea has posted a concise summary of security strengths and shortcomings for twelve of the major operating systems of 2006/2007 http://www.omninerd.com/2007/03/26/articles/74 http://it.slashdot.org/article.pl?sid=07/03/29/1717234