Tools:
- fimap v0.7A Released – security-database.com
Tool for determining local and remote file inclusion bugs in webapps updated with show-my-ip, experimental HTTP proxy support and experimental blindmode, among others. - Mr-T smbenum and Firefox userprefs – ha.ckers.org
An update to the Master Recon Tool was released to include both the default Firefox preferences and the smbenum of Internet Explorer. - PlayCap: Playback for Wireshark Capture Files (by Joke Snelders) – lovemytool.com
PlayCap plays back capture files made from Wireshark, tcpdump, WinDump, or any other libpcap-based application. - WinScanX – windowsaudit.com
WinScanX is a Windows auditing tool designed to help you get your Windows audit done quickly. It’s easy to use and no installation is required. - Metasploit Framework 3.3.3 Exploit Rankings – metasploit.com
This release focuses on exploit rankings, session automation, and bug fixes. Rankings can be used to prevent exploits below a certain rank from being used and limit the impact to a particular target. - MSDN – Matthieu Suiche Developer Network – msuiche.net
This web interface provides offsets, names, and links to corresponding structures/fields of Windows Kernel. - YASAT v1.70A – Yet Another Stupid Audit Tool – security-database.com
Its goal is to be as simple as possible with minimum binary dependencies (only sed, grep and cut) - Top 10 Nessus Plugins For 2009 – tenablesecurity.com
Tenable lists their favorite plugins for the year. - New MySQL Support in Metasploit – darkoperator.com
Recently HD added a new mixin for MySQL adding support for connecting and executing queries against MySQL using the MySQL library from tmtm.org.
Techniques:
- thoughts on the verizon 2009 dbir supplement – terminal23.net
Some comments about case studies on Verizon’s 2009 data breaches. - Automating My VMware Lab – darkoperator.com
Carlos Perez explains how to utilize VMware for code testing and automate it using vmrun. - Poking at the Neon exploit kit – trail leads to Zeus/Zbot – perpetualhorizon.blogspot.com
An analysis of the Neon exploit with statistics on a specific site’s implementation of this vuln.
Vulnerabilities:
- Another TXT Attack – theinvisiblethings.blogspot.com
This attack exploits an implementation flaw in a SINIT AC module and allows for full TXT circumvention using a software-only attack. - Facebook clickjacking attack spreads – net-security.org
A new attack redirects users from a comment to a fake Turing test so that the same comment appears in friends pages. The goal seems to increase views of a certain Youtube video. - 7-Eleven Hack From Russia Led to ATM Looting in New York – wired.com
A look back at the 7-Eleven website breach that lead to Citibank ATM hacking. - RockYou Hacked: 32 Million (yes, that’s Million), Passwords Stolen – reusablesec.blogspot.com
A detailed analysis of the RockYou breach last week. - Vulnerabilty on Microsoft’s Internet Information Services
By using this vulnerability, an attacker can bypass protection and upload a dangerous executable file on the server.- Microsoft IIS vuln leaves users open to remote attack – theregister.co.uk
- IIS 0 day vulnerability in parsing files – notsosecure.com
- Pressure increasing for Microsoft to patch IIS 0 day – isc.sans.org
- New Google CAPTCHAs now cracked – h-online.com
Text recognition can now crack newer Google CAPTCHAs based on an analysis report by Jonathan Wilkins. - NetBIOS Design Allows Traffic Redirection – slashdot.org
SkullSecurity have demonstrated how the NetBIOS protocol allows trivial hijacking.
Vendor/Software Patches:
- Adobe Explains PDF Patch Delay – infoworld.com
Adobe chose to wait until mid-January to patch a critical PDF bug to prevent the disruption of its quarterly security update schedule. - Intel Patches Flaw In Trusted Execution Tech – slashdot.org
Intel has released a patch for the affected chipsets with flaws in Intel’s Trusted Execution Technology (TXT), whose function is to provide a mechanism for safe loading of system software and to protect sensitive files.
Other News:
- News on the US Cyber Challenge
- Hotshot Hackers Compete In Netwars – cnn.com
CNN’s Jeanne Meserve reports on the U.S. Cyber Challenge, which gathers techies to test the nation’s cyber networks. - Why Is This Hacker So Miserable Looking? – gizmodo.com
Gizmodo comments on one hacker’s candid picture in the Netwars competition.
- Hotshot Hackers Compete In Netwars – cnn.com
- New Chief of CyberSecurity Named
US President Barack Obama has finally chosen a Chief of CyberSecurity – Mr. Howard A Schmidt- US Chief of CyberSecurity – f-secure.com
- US appoints Howard Schmidt as cybersecurity chief – bbc.co.uk
- Cyber-Security Czar To Be Named – slashdot.org
- Rfiddler zapper kills RFID tags dead, the hard way – engadget.com
The device built by Codeninja disables tags by emitting a strong electromagnetic field.
Leave A Comment