Infosec Events » Vendor News http://infosecevents.net Covering the Information Security Economy Mon, 21 May 2012 05:28:36 +0000 en hourly 1 http://wordpress.org/?v=3.3.2 Week 19 In Review – 2011 http://infosecevents.net/2011/05/16/week-19-in-review-2011/ http://infosecevents.net/2011/05/16/week-19-in-review-2011/#comments Mon, 16 May 2011 18:40:58 +0000 Glenn Santos http://infosecevents.net/?p=1668 Resources

  • Hakin9 Magazine Cloud Security Issue – mytalkoot.com
    Comprehensive cloud-centric resources and articles now available for download.
  • Club Hack Magazine May Issue On browser Security – professionalsecuritytesters.org
    Here we are again with the latest issue of ClubHack Magazine. This time also the issue is dedicated to Browser security.
  • Hacking Illustrated – irongeek.com
    In this section I’ll be posting AVIs and Flash files that show step by step how to execute various pen-testing tools. Since most of these videos are 640×480 it would be best if you use a screen resolution that is 1024×768 or better. If you have any requests or comments please let me know.
  • Pentesting Vulnerable Study Frameworks Complete List – felipemartins.info
    It’s very difficult for the beginner security analyst, mainly the ones interested in the area of pentesting, to find good study pentesting resources. Starting from the principle that in pentesting there are many other sub areas of study, it becomes more and more difficult to choose and then find a proper pentesting study application.
  • 25 Questions To Ask During An Information Security Interview – danielmiessler.com
    What follows is a list of questions for use in vetting candidates for positions in Information Security. Many of the questions are designed to get the candidate to think, and to articulate that thought process in a scenario where preparation was not possible. Observing these types of responses is often as important as the actual answers.
  • Secuirty Through Amnesia: A Software-Based Solution to the Cold Boot Attack On Disk Encryption – arvix.org
    Disk encryption has become an important security measure for a multitude of clients, including governments, corporations, activists, security-conscious professionals, and privacy-conscious individuals. Unfortunately, recent research has discovered an effective side channel attack against any disk mounted by a running machine\cite{princetonattack}.
  • Encrypted Google Docs Done Well – rdist.root.org
    There’s a nice new paper out called “Private Editing Using Untrusted Cloud Services” by Yan Huang and David Evans. They also provide a Firefox extension that implements their scheme. I like their approach for a few reasons.
  • Haroon Meer Reveals His Process For Security Research – resources.infosecinstitute.com
    In our ongoing series of interviews, this week Haroon Meer answered a few questions and pulled back the curtain a bit on the methods, tools and motivation for the work he does.
  • Microsoft Virtual Server Security: 10 Tips And Settings – resources.infosecinstitute.com
    Virtualization brings significant value to business managers and engineers attempting to keep pace with business pressure for additional servers. It enables maximum use of hardware resources while introducing an increased flexibility in how organizations design and implement new solutions. However, it also introduces new security concerns.
  • Cisco 1Q11 Global Threat Report – cisco.com/en/US/
    The Cisco 1Q11 Global Threat Report has been released. The report covers the period from 1 January 2011 through 31 March 2011 and features data from Cisco Security Intelligence Operations. This quarter’s contributors includes Cisco Intrusion Prevention System (IPS), IronPort, Remote Management Services (RMS), Security Research and Operations (SR&O), and ScanSafe.
  • Assembly Language for Penetration Tester – r00tsec.blogspot.com
    Below are the useful resources to learn Assembley Language for pentesters to start learning Exploit writing.
  • Quickdraw IDS in Action – scada-hacker.com/igss-video.html
    Joel Langill of SCADAhacker.com has an excellent 18-minute video showing an example of an exploit of the IGSS SCADA HMI and then the Quickdraw IDS signatures. Most of the recently disclosed Luigi vulnerabilities resulted in denial of service, but the IGSS vulnerability he exploits in the video is a directory traversal file execution vulnerability.
  • Exploit Development Framework Design – gnucitizen.org
    Metasploit is great but there are three things that makes the framework sometimes inconvenient: it’s size, it’s dependency of the ruby platform and of course it’s speed. It will be great if for example we can take a single exploit (or a set of exploits) out of the framework and compile it into a standalone executable.
  • Beating Up On Android: Practical Android Attacks – immunityinc.com/presentations/Android_Attacks.odt.pdf

Tools

  • Backtrack 5
    The BackTrack Dev team has worked furiously in the past months on BackTrack 5, code name “revolution”. Today, we are proud to release our work to the public, and then rest for a couple of weeks.This new revision has been built from scratch, and boasts several major improvements over all our previous releases.

  • ZeuS source code anyone? – attackvector.com/viles/ZeuS.tar.bz2
    If you’d like to take a look at the ZeuS/SpyEye botnet source code and see how it ticks, you can download it below. I’m not sure how long this will be up (for obvious reasons), so get it while it’s hot.
  • Release of SWFRet Tools 1.1.0 – the-interweb.com
    Two weeks ago I gave a presentation at SOURCE Boston where I released a new collection of open-source tools for Adobe Flash SWF file reverse engineering. I am developing these tools, called SWFRETools, to help reverse engineers like vulnerability researchers and malware analysts that have to deal with SWF files regularly.
  • Virtualizing Junos On VMWare – darkoperator.com
    Many times when working with a client network or working on our own we have the need to test, document and validate certain networks configurations in a test environment. Sadly not many have the money to have one so as to test different scenarios so as to gage the impact that this changes might have on the production network.
  • UPDATE: Skipfish-1.87b! – code.google.com/p/skipfish/downloads/list
    Skipfish is a fully automated, active web application security reconnaissance tool. Its key features: High speed, Ease of use, Cutting-edge security logic.
  • Mutillidae: A Deliberately Vulnerable Set Of PHP Scripts That Implement The OWASP Top 10 – irongeek.com
    As I figure most people reading this know, I make infosec video tutorials for my site Irongeek.com. I wanted to start covering more web application pen-testing tools and concepts in some of these videos. Of course, I needed a vulnerable web app or two to use for these demos.

Techniques

  • The Buby Script Crash Course
    For those of you who are new to Buby, it is a platform to write Ruby based extensions for the Burp Suite API and I’m going to attempt to cover some of the basics.

  • dRuby For Penetration Testers – blog.recurity-labs.com
    I like Ruby somehow, a nice and shiny programming language. At some point last year, I decided to have a closer look at ‘Distributed Ruby’ (also called dRuby). dRuby is all about easily usable objects and method invocations over the network.
  • Journey Into Exploitation: Awbo2.exe – securityaegis.com
    In this series of blog posts, I will be documenting my journey into the art of exploitation.  My goal for this series is to experiment with some of the challenges that are out there and hopefully provide some guidance for others in my shoes.  I am targeting those of you with moderate amount experience in exploitation.  Hopefully, I will further my own knowledge and yours (the reader).
  • Hijacking NFC Intents On Android – intrepidusgroup.com
    Google IO had a “How to NFC” session today where they demoed and described using NFC on Android. One of the items they pointed out was the desire to use NFC for instant gratification and zero-click interactions. The only default application on the Nexus S that I’ve seen this in before today was Google Maps, but the desire is that other applications will incorporate this feature as well.
  • Keychain Dumper – github.com/Neohapsis/Keychain-Dumper
    In order to build keychain_dumper you must first create two symbolic links to the appropriate iOS SDK directories. At the time the tool was developed the iOS 4.2 SDK was current and you may need to update the target directories based on the current SDK that is installed.
  • Bittwiste: pcap Capture File Editor – lovemytool.com
    In this article I will show you how to replace portnumbers, IP and MAC addresses.
  • Bit-Twist – bittwist.sourceforge.net
    Bit-Twist is a simple yet powerful libpcap-based Ethernet packet generator. It is designed to complement tcpdump, which by itself has done a great job at capturing network traffic.
  • Sorting Packet Captures With Scapy – packetstan.com
    Today I spent a little time looking into a packet capture supplied by Vivek Ramachandran at SecurityTube. This packet capture is part of a series of WiFi hacking challenges he is putting together, and immediately after opening it I got freaked out.

Vendor/Software Patches

Vulnerabilities

  • The Skype Crisis
    Skype has been acquired by Microsoft few days ago and suddenly it inherited Microsoft’s weakness… I ‘m just kidding, of course. As many of you already know, a pretty big problem has been identified on all Skype versions running on Mac OS X pltaforms.

  • Silently Pwning Protected-Mode IE9 And Innocent Windows Applications – blog.acrosssecurity.com
    Those familiar with Windows COM servers know that they come in two types, in-process and out-of-process. For this post, the former type is of interest: an in-process COM server is a dynamic link library (DLL) that a COM client instantiates when needed, usually by calling the CoCreateInstance function with the class identifier (CLSID) of the said COM server.

Other News

  • AusCERT: Cisco IP phones prone to hackers – scmagazine.com.au
    Contact centres and businesses using a popular make of internet phone were at risk of having their communications intercepted and confidential information leaked, a hacking group demonstrated.
  • FBI vehicle Tracking Device: the Teardown – wired.com
    The FBI’s use of GPS vehicle tracking devices is becoming a contentious privacy issue in the courts, with the Obama administration seeking Supreme Court approval for its use of the devices without a warrant, and a federal civil rights lawsuit targeting the Justice Department for tracking the movements of an Arab-American student.
  • Frameworks and how I hack currently (and how I don’t) - carnal0wnage.attackresearch.com
    I got involved with HDM, skape, spoonm, et all and the metasploit project quite a long time ago, probably around msf 1ish time frame. It was an exciting time and metasploit was one of the best open source infosec (if not the best) projects out there.
  • Security Group Claims To Have Subverted Google Chrome’s Sandbox – krebsonsecuirty.com
    A French security research firm boasted today that it has discovered a two-step process for defeating Google Chrome‘s sandbox, the security technology designed to protect the browser from being compromised by previously unknown security flaws.
  • Catch A Clue From An EDU: Universities That Get Security Right – computerworld.com
    Professor Corey Schou was working in his school’s library when he realized his computer was picking up a particularly strong Wi-Fi signal. Normally that would be welcome news. But Schou knew that spot was usually a dead zone, which meant something was probably amiss.
  • “Binary Planting” vs. “DLL Hijacking” vs. “Insecure Library Loading” – blog.acrosssecurity.com
    When a new thing occurs or is invented, or when a previously obscure thing becomes popular, a need emerges to give it a name so we can talk and write about it. It was no different with binary planting, DLL hijacking, DLL preloading, insecure library loading, DLL load hijacking and DLL spoofing.
  • Whitehouse Proposes Cybersecurity Bill – darkreading.com
    The White House today proposed new cybersecurity legislation that would improve the protection of critical infrastructure, expand the sharing of security data, and impose national requirements for disclosing breaches.
]]> http://infosecevents.net/2011/05/16/week-19-in-review-2011/feed/ 0 Week 15 In Review – 2011 http://infosecevents.net/2011/04/18/week-15-in-review-2011/ http://infosecevents.net/2011/04/18/week-15-in-review-2011/#comments Tue, 19 Apr 2011 06:07:47 +0000 Glenn Santos http://infosecevents.net/?p=1613 Events Related:

  • OWASP threat modeling project – myappsecurity.blogspot.com
    We are starting an OWASP threat modeling project to standardize a threat modeling approach which can be used by various companies.

Resources:

Tools:

  • RawCap sniffer for Windows released – netresec.com
    We are today proude to announce the release of RawCap, which is a free raw sockets sniffer for Windows.
  • Spooftooph: The Bluetooth Spoofer – sourceforge.net/projects/spooftooph/
    Spooftooph is designed to automate spoofing or cloning Bluetooth device information. Make a Bluetooth device hide in plain site.
  • sqlmap 0.9 – sourceforge.net/projects/sqlmap/
    sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
  • hackxor – hackxor.sourceforge.net
    Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc.
  • SVN Digger – Better Wordlists for Forced Browsing – mavitunasecurity.com
    DirBuster ships with several wordlists, these wordlists generated via one big crawler which visited tons of websites, collected links and created most common directory / file names on the Internet.
  • Patriot NG – security-projects.com
    Patriot is a ‘Host IDS’ tool which allows real time monitoring of changes in Windows systems or Network attacks.
  • CVE Checker 3.1 – cvechecker.sourceforge.net
    cvechecker reports about possible vulnerabilities on your system by scanning the installed software and matching the results with the CVE database.
  • OllyDbg 2.01 Alpha 3 – ollydbg.de
    OllyDbg is a 32-bit assembler level analysing debugger for Microsoft Windows. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.
  • Microsoft Pushes Out Two New Security Tools – threatpost.com
    In parallel with its release of 17 bulletins on Patch Tuesday this month, Microsoft also unveiled two new tools that are meant to help make a couple of common exploitation scenarios more difficult for attackers.
  • smooth-sec – bailey.st
    Smooth-Sec is a ready to-go  IDS/IPS (Intrusion Detection/Prevention System) linux distribution based on the multi threaded Suricata IDS/IPS engine and Snorby, the top notch web application for network security monitoring.
  • BodgeIt Store – code.google.com/p/bodgeit/
    The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to penetration testing.
  • Qubes OS – qubes-os.org
    Qubes is an open source operating system designed to provide strong security for desktop computing. Qubes is based on Xen, X Window System, and Linux, and can run most Linux applications and utilize most of the Linux drivers. In the future it might also run Windows apps.
  • McAfee ShareScan – mcafee.com
    ShareScan is a free utility that enables IT security personnel to identify open Windows file shares available on the internal network. This tool can help administrators identify systems that have wide open permissions or no permissions — potential vulnerabilities that should be remediated.
  • md5deep version 3.8 – jessekornblum.livejournal.com
    This version adds two new features. First, you can now use a file to indicate the input files to process. For example, you can make a file, foo.txt.
  • Common Vulnerability Scoring System Version 2 Calculator – dueyesterday.net
    Allows for the creations of enums. Thanks to norvig.com/python-iaq.html
  • MS10-070: Padding Oracle applied to .NET framework – bernardodamele.blogspot.com
    I followed the research closely and way before vulnerability scanners like Nessus could detect the security vulnerability on .NET applications anonymously and remotely, I coded a small script to test for the flaw based on Juliano Rizzo’s details. You might still find it useful, so I thought about publishing it on GitHub.
  • IEZoneAnalyzer v3 – technet.com
    IEZoneAnalyzer is a utility for viewing and comparing Internet Explorer security zone settings. It is particularly valuable on systems controlled through Group Policy, on which the standard security settings dialog does not allow viewing of settings.

Techniques:

  • Full Disclosure:Barracuda Networks Hacking via SQL Injection – hmsec.tumblr.com/
    The company’s expansive product portfolio includes offerings for protection against email, Web and IM threats as well as products that improve application delivery and network access, message archiving, backup and data protection.
  • Parsing CDP Packets With Scapy – darkoperator.com
    In this blog post I will cover how to use one of the new parsers  to parse CDP packets included in version 2.2 of scapy. Cisco Discovery Protocol (CDP) is a proprietary Layer 2 Data Link Layer network protocol used to share device information with devices connected on the same subnet.
  • Mozilla Firefox Internals & Attack Strategies – chmag.in
    This paper aims to detail some of the techniques and methods that exist to subvert a fully patched and functioning browser Firefox.
  • BackTrack 5 on a Motorola Xoom – offensive-security.com
    In the past few days we have been toying with some Motorola hardware, and have managed to get a basic build of BackTrack 5 (+ toolchain) on a Motorola Xoom.
  • Things overheard on the WiFi from my Android smartphone – freedom-to-tinker.com
    Today in my undergraduate security class, we set up a sniffer so we could run Wireshark and Mallory to listen in on my Android smartphone. This blog piece summarizes what we found.
  • Execute Metasploit payloads bypassing any anti-virus – bernardodamele.blogspot.com
    Most of the shellcode launchers out there, including proof of concepts part of many security books, detail how to allocate a memory page as readable/writable/executable on POSIX systems, copy over your shellcode and execute it. This works just fine. However, it is limited to POSIX, does not necessarily consider 64-bit architecture and Windows systems.
  • [Video] Playing With Traffic (Squid) – g0tmi1k.blogspot.com
    The attacker installs Squid3 cache proxy via the Operating System (Backtrack 4 R2) repository. Squid is the “backbone” to this attack and after configuring it to work on the Local Area Network (LAN) and to be transparent (the proxy “works” without any configuration to the browser), the attacker chooses which script to first try out (asciiImages.pl is the first one) and adds it to the configuration file.
  • Pulling and finding APKs without root on Android – intrepidusgroup.com
    Since we’re not root, we can’t list the /data/app directory to locate the name of the APK file we want to pull. There’s a few ways you can tackle finding the name of the APK file, but what I find is the quickest way for me is to pull the packages.xml file.
  • Reverse connection: ICMP shell – bernardodamele.blogspot.com
    Allowing traffic only onto known machines, ports and services (ingress filtering) and setting strong egress access control lists is one of these cases. In such scenarios when you have owned a machine part of the internal network or the DMZ (e.g. in a Citrix breakout engagement or similar), it is not always trivial to get a reverse shell over TCP, not to consider a bind shell.
  • KB2506014 kills TDL4 on x64 – eset.com
    Not so long ago, Microsoft released a security patch addressing the way Windows x64 operating systems check integrity of the loaded modules. In our recent report (The Evolution of TDL4: Conquering x64) we described a method used by the TDL4 bootkit to load its malicious unsigned driver on 64-bit systems, even though those systems have an enforced kernel-mode code signing policy.
  • Uh Ah! I Happened To Use POP ESP – ragestorm.net
    I had to call a C++ function from my Assembly code and keep the return value untouched so the caller will get it. Usually return values are passed on EAX, in x86 that is. But that’s not the whole truth, they might be passed on EDX:EAX, if you want to return 64 bits integer, for instance.
  • More certs may indicate less security – rdist.root.org
    If a website has a multiple servers with different certs, the browser may often generate spurious errors for that site. But could this be a symptom of a genuine security problem?
  • Filejacking: How to make a file server from your browser (with HTML5 of course) – r00tsec.blogspot.com
    How can a website access user’s files? Traditionally, user has to upload the file. Users commonly share photos, videos upload their files for online conversion tools etc. You could (theoretically) be tricked into uploading a sensitive file into a malicious website (“please submit your private key for checking it’s strength”), but, seriously, who falls for that?
  • Proxmark3/RFID Goodness – zonbi.org
    There are two “types” of RFID in common use. High frequency runs at the 13.56MHz range. The MiFare stuff is in this range, although it’s slightly different to the ISO14443 A and B standard used in the CSC stuff floating around ie. $train card.
  • Padding Oracle Post-Explotation: Abusing ASP.NET Forms Authentication with Burp – beersec.org
    So you found an web site vulnerable to the ASP.NET Padding Vulnerability, used Minded Security’s web.config bruter and now you have the applications web.config file. Now what?
  • Payload bypass AV. with encoding – r00tsec.blogspot.com
    This script and the relevant project files (Makefile and Visual Studio files) allow you to compile the tool once then run your shellcode across different architectures and operating systems.

Vulnerabilities:

  • Another day, another Flash 0-day attack
    Hackers are embedding malicious Flash Player files in Microsoft Word documents to launch targeted attacks against select businesses, according to a warning from Adobe.

  • MSRT April ‘11: Win32/Afcore – technet.com
    Win32/Afcore comprises two components, a dropper and installed malware that runs as a backdoor. The backdoor component is injected into running processes and connects to a remote server to retrieve commands that are executed on the affected system. Commands could include instructions to steal passwords, attack other computers and so on.

Vendor/Software Patches:

Other News:

  • ATM Skimmers: Hacking the Cash Machine – krebsonsecurity.com
    Most of the ATM skimmers I’ve profiled in this blog are comprised of parts designed to mimic and to fit on top of existing cash machine components, such as card acceptance slots or PIN pads. But sometimes, skimmer thieves find success by swapping out ATM parts with compromised look-alikes.
  • SSL Issues: Solutions, Opinions and News
    What lies ahead for SSL? The recent Comodo hack taught us that what we thought was a robust security protocol is nothing but a house of cards.

  • Apple’s AirTunes/AirPlay private key extracted and published – h-online.com
    Developer James Laird has extracted the AirTunes/AirPlay private key from an Apple Airport Express, opening the way for third-party applications to play back iTunes streams.
  • BREAKING NEWS: Sony’s War On Hackers, Tinkerers And Innovators “Settlement In George Hotz Case” – blog.makezine.com
    Sony Computer Entertainment America (“SCEA”) and George Hotz (“Hotz”) today announced the settlement of the lawsuit filed by SCEA against Hotz in federal court in San Francisco, California. The parties reached an agreement in principle on March 31, 2011. As part of the settlement, Hotz consented to a permanent injunction.
  • How Phishers Will Use Epsilon Data Against You – threatpost.com
    There has been a lot of online venting and hand-wringing in the week since customers of email services provider Epsilon began informing millions of individuals in North America and Europe that their name and e-mail address had  been stolen in a massive data breach.
  • USPS.gov Website Infected with Blackhole Exploit Kit – research.zscaler.com
    As we’ve discussed previously, the Blackhole Exploit kit, a commercial exploit kit developed by Russian hackers, is being seen in an increasing number of attacks.
  • Milw0rm and inj3ct0r Merge Into 1337day.com – greyhat-security.com
    Less than an hour ago, a message was sent out via the Milw0rm.com Facebook group, announcing both a merger for milw0rm.com and inj3ct0r.com, and simultaneously, a move for inj3ct0r.com into a new domain, 1337day.com.
  • Government Agrees With Microsoft: Google Wasn’t Certified [Update] – readwriteweb.com
    Today, the U.S. government agreed with Microsoft’s accusation that Google had provided misleading information about whether or not its Google Apps for Government is certified under the Federal Information Security Management Act (FISMA).
  • DOJ gets court permission to attack botnet – itworld.com
    The U.S. Department of Justice and U.S. Federal Bureau of Investigation have obtained a temporary restraining order allowing them to disrupt a computer virus that created an international botnet controlling more than 2.3 million computers as of early 2010, the DOJ announced Wednesday.
]]> http://infosecevents.net/2011/04/18/week-15-in-review-2011/feed/ 0 Week 14 In Review – 2011 http://infosecevents.net/2011/04/11/week-14-in-review-2011/ http://infosecevents.net/2011/04/11/week-14-in-review-2011/#comments Tue, 12 Apr 2011 04:13:47 +0000 Glenn Santos http://infosecevents.net/?p=1600 Resources

Tools

  • Wappalyzer Web Technology Identifier – darknet.org.uk
    Wappalyzer is an add-on for Firefox that uncovers the technologies used on websites.
  • USBsploit v0.6b! – secuobs.com
    USBsploit is a PoC to generate Reverse TCP backdoors, malicious PDF or LNK files.
  • MOSCRACK-2.04b! – sourceforge.net/projects/moscrack/
    Moscrack is a perl application designed to facilitate cracking WPA keys on a cluster of computers.
  • RETINA Community – eeye.com
    Retina Community is a completely free tool powered by eEye’s renowned Retina Network Security Scanner technology. For up to 32 IPs, the product identifies vulnerabilities (including zero day), configuration issues, and missing patches across operating systems, applications, devices, and virtual environments.
  • Peach v2.3.8 – sourceforge.net/projects/peachfuzz/
    Peach is a SmartFuzzer that is capable of performing both generation and mutation based fuzzing.
  • THC-HYDRA v6.2 – thc.org
    THC-HYDRA is a very fast network logon cracker which support many different services.
  • Skipfish-1.86b – code.google.com/p/skipfish/
    Skipfish is a fully automated, active web application security reconnaissance tool.
  • Cain & Abel v4.9.40 released – oxid.it
    This update includes an added Proxy support for Cain’s Certificate Collector, the ability to specify custom proxy authentication credentials for Certificate Collector, and others.
  • The Social-Engineer Toolkit v1.3.3 – secmaniac.com
    The Social Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing.
  • Kismet-2011-03-R2 – kismetwireless.net
    Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.
  • IDA Pro 6.1 Disassemble Android Bytecode – hex-rays.com
    The new version can disassemble Android bytecode (Dalvik). An IDA user kindly contributed the processor module and file loader.

Techniques

Vendor/Software Patches

Other News

]]> http://infosecevents.net/2011/04/11/week-14-in-review-2011/feed/ 0 Week 6 In Review – 2011 http://infosecevents.net/2011/02/14/week-6-in-review-2011/ http://infosecevents.net/2011/02/14/week-6-in-review-2011/#comments Mon, 14 Feb 2011 10:32:22 +0000 Glenn Santos http://infosecevents.net/?p=1463 Events Related

Resources

Tools

  • PDF Exploit Disguised As A Xerox Scanned Document - labs.m86security.com
    Most office network printers and scanners have a feature that sends scanned documents over email. Cyber crooks however, have imitated email templates used by these devices for malicious purposes
  • The Honeynet Project Releases New Tool: PhoneyC - chuvakin.blogspot.com
    As promised, I will be reposting some of the cool new announcements from The Honeynet Project here on my blogsince I now serve as Project’s Chief PR Officer.
  • MetaSploit Framework 3.5.2 Released – blog.metasploit.com
    On February 1st, Eduardo Prado of Secumania notified us of a privilege escalation vulnerability on multi-user Windows installations of the Metasploit Framework.
  • Open SCAP v0.6.8 released – open-scap.org
    The OpenSCAP Project was created to provide an open-source frameworkto the community which enables integration with the Security Content Automation Protocol (SCAP) suite of standards and capabilities.
  • SSL Diagnosis v0.8.1a released – sourceforge.net
    SSL Diagnos is used to get information about SSL usage (protocols ssl2, ssl3, tls, dtls, and ciphers). It can also be used for testing and rating ciphers on SSL clients.
  • Passwords shared between rootkit.com and gawker – terminal23.net
    This is a classic journo case of an editor-sensationalized title for an article that doesn’t really get reasonable until the last two paragraphs where it kinda puts the brakes on calling password reuse “endemic.”
  • UPDATE: Nmap 5.51! – nmap.org
    Wow! In about two weeks time, another Nmap release! We now have Nmap version 5.51! The last release was Nmap 5.50, which we wrote about here.
  • eEye to Release Free Vulnerability Scanner with Zero -Day Identification and Configuration Auditing – eeye.com
    eEye Digital Security, a provider of IT security and unified vulnerability management solutions, today announced the pre-release of Retina Community.
  • UPDATE: Fiddler v2.3.2.3! - fiddler2.com
    Our first post regarding Fiddler, the web debugger can be found here. On the 13th of February, an update was released.

Techniques

Vendor/Software Patches

Vulnerabilities

Other News

]]> http://infosecevents.net/2011/02/14/week-6-in-review-2011/feed/ 0 Week 3 in Review – 2011 http://infosecevents.net/2011/01/24/week-3-in-review-2011/ http://infosecevents.net/2011/01/24/week-3-in-review-2011/#comments Mon, 24 Jan 2011 09:36:41 +0000 Glenn Santos http://infosecevents.net/?p=1422 Events Related:

Resources:

Tools:

  • w3af: Better, Stronger, Faster – blog.rapid7.com
    By downloading this release you’ll be able to enjoy new vulnerability checks, more stable code and a about 15% performance boost in the overall speed of your scan.
  • R-U-Dead-Yet version 2.2 – chaptersinwebsecurity.blogspot.com
    I forgot the fact that people develop hunger for features and bug fixes even when software is open-source and free. Oh well, I guess that’s a responsibility that comes with the will to satisfy your end users.
  • AutoDiff Online – marcoramilli.blogspot.com
    AutoDiff is a project which performs automated binary differential analysis between two executable files.
  • MS Attack Surface Analyzer Release
    Microsoft unveiled a new tool this week in conjunction with the Blackhat DC conference — the Attack Surface Analyzer.

Techniques:

  • Who’s who of bad password practices – troyhunt.com
    But what happens when the website won’t allow you to create a secure password? Or at least when they severely constrain your ability to create long, random, unique passwords?
  • Share your nmap parameters! – reddit.com
    What parameters do you usually use in your nmap scans? Any interesting combinations? I usually go with: nmap -v -A -p1-65535 -O2 -T4 ipaddress
  • Quickpost: Checking ASLR – blog.didierstevens.com
    Some people asked me for a simple way to check shell extensions for their ASLR support. You can do this with Process Explorer.
  • Finding AES keys - jessekornblum.livejournal.com
    Today I’m publishing a little utility to search for AES keys. It was originally intended for searching memory images, but you can use it to search anything really.
  • How To Crack Just About Any Mac App – lifehacker.com
    By walking through how I can hack your app with only one Terminal shell, I hope to shed some light on how this is most commonly done, and hopefully convince you to protect yourself against me.
  • Episode 266 – pauldotcom.com
    PaulDotCom Security Weekly – Episode 226 – for Thursday January 13th, 2011.
  • Return of the Sprayer - h-online.com
    If they jumped to code injected onto the stack or heap, “just like in the good old days”, data execution prevention (DEP) would trigger an interrupt and the system would terminate the carefully pwned process before it could cause any damage.
  • Exploit in the wild for MS06-014 – research.zscaler.com
    Although 0day vulnerabilities receive all the attention, it’s not unusual to see attackers still taking advantage of old vulnerabilities to attack end users
  • Unrestricted File Download V1.0 – soroush.secproject.com
    I do not want to talk about Insecure Direct Object References without any protection as they are obviously exploitable; Instead, I want to talk about bypassing the protected ones!
  • Exploiting Smartphone-USB connectivity for fun and profit - docs.google.com
    Unfortunately, these new capabilities  coupled with the inherent trust users place on the USB physical connectivity and the lack of any protection mechanisms render the USb an insecure link, prone to exploitation.
  • Mobile Device Security and Android File Disclosure – blog.metasploit.com
    Specifically, he found that it was possible to obtain the contents of files on an Android device by simply persuading its owner to visit a web site under attacker control. The issue only garners a 3.5 CVSS score, but yet it’s still fairly serious.

Vulnerabilities:

Vendor/Software Patches:

Other News:

  • Keyless cars vulnerable to hack, theft - cnet.com
    Keyless car entry and start systems make it easy to get on the road, but they could also make it easier for criminals to take off with your car. And strong encryption won’t solve the problem.
  • Stuxnet vs. Iran nuclear enrichment
    Rather than being proud of its stealth and targeting, the authors should be embarrassed at their amateur approach to hiding the payload.

  • ATM Skimmers, Up Close – krebsonsecurity.com
    Recently, I found a guy on an exclusive online scammer forum who has been hawking a variety of paraphernalia used in ATM skimmers.
  • Coming soon: a new way to hack into your smartphone - itworld.com
    More than three years after the iPhone was first hacked, computer security experts think they’ve found a whole new way to break into mobile phones — one that could become a big headache for Apple, or for smartphone makers using Google’s Android software.
  • Two Charged in AT&T hack of iPad Customer Data - wired.com
    Two suspects have been charged with federal crimes for allegedly hacking AT&T’s website last year to obtain the personal data of more than 100,000 iPad owners.
  • Why you should always encrypt your smartphone – arstechnica.com
    Last week, California’s Supreme Court reached a controversial 5-2 decision in People v. Diaz (PDF), holding that police officers may lawfully search mobile phones found on arrested individuals’ persons without first obtaining a search warrant.
  • Hacking with USBs
    Two researchers have figured out a way to attack laptops and smartphones through an innocent-looking USB cable.

  • Online banking trojan developing fast – h-online.com
    Trojan construction kit Carberp, which first emerged in the autumn, appears to be undergoing rapid development, according to reports from sources that include security services provider Seculert.
  • Android Trojan captures credit card details – thinq.co.uk
    The team, comprised of Roman Schlegel from the City University of Hong Kong and Kehuan Zhang, Xiaoyong Zhou, Mehool Intwala, Apu Kapadia, and Xiao Feng Wang from the Indiana University Bloomington, call their creation ‘Soundminer’ – and its implications are far-reaching.
]]> http://infosecevents.net/2011/01/24/week-3-in-review-2011/feed/ 0 Week 2 in Review – 2011 http://infosecevents.net/2011/01/19/week-2-in-review-2011/ http://infosecevents.net/2011/01/19/week-2-in-review-2011/#comments Wed, 19 Jan 2011 10:35:57 +0000 Glenn Santos http://infosecevents.net/?p=1414 Events Related

Tools

  • OWASP Zed Attack Proxy 1.2.0 Released - vulnerabilitydatabase.com/toolswatch/2011
    The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

Techniques

  • Beginning Mac Hacking – mrspeaker.net
    He was a very mystical fellow, and spoke about reverse engineering with a sense of grand importance and just a pinch of spiritually – all very enticing to a nerdy youngster like myself.
  • Waking up the Sleeping Dragon - thesauceofutterpwnage.blogspot.com
    On September 28, 2010 I notified Beijing based WellinControl Technology Development Co.,Ltd and CN-CERT that one of Wellintech’s products had a very serious security vulnerability, and that if properly leveraged would allow an attacker to exploit the bug and execute arbitrary code.
  • Alexa Illustrates Web Securities Risks (part 1) – research.zscaler.com
    I recently needed to look at some Alexa data related to their tracking of the top web domains visited for a side project that I was working on.
  • Sudo -g privilege escalation (CVE-2011-0010) – blog.c22.cc
    I noticed this bug come across the wire earlier today and thought I’d take a few minutes to take a look.
  • Dumping the RMI Registry with NMAP – www.swende.se
    A while ago, I wrote a NSE script to a Java RMI Registry and dump out information about the objects in the registry. This is a blog-post to shed some light on NSE-development in general and that script in particular.
  • Continuous Web Application Security Scanning With Netsparker and TeamCity – troyhunt.com
    One of the problems with software security is that it’s easy for it to appear a bit like black magic, or at least like an entirely foreign industry to software development.
  • HeapLocker: NOP Sled Detector – blog.didierstevens.com
    When you enable NOP sled monitoring, HeapLocker will create a new thread to periodically check (every second) newly committed virtual pages that are readable and writable.

Vendor/Software Patches

Other News

  • Exploit Packs Run On Java Juice – krebsonsecurity.com
    Today, I’ll highlight a few more recent examples of this with brand new exploit kits on the market, and explain why even fully-patched Java installations are fast becoming major enablers of browser-based malware attacks.
  • The Application Security Spending Conundrum – jeremiahgrossman.blogspot.com
    To obtain a quote, the online insurer asked my age, where I lived, how much I drive and where, the year, make, and model of my cars, about my driving record, and how much coverage I wanted.
]]> http://infosecevents.net/2011/01/19/week-2-in-review-2011/feed/ 0 Week 1 in Review – 2011 http://infosecevents.net/2011/01/10/week-1-in-review-2011/ http://infosecevents.net/2011/01/10/week-1-in-review-2011/#comments Mon, 10 Jan 2011 11:28:10 +0000 Glenn Santos http://infosecevents.net/?p=1408 Events Related:

Resources:

  • Ubertooth video and news – ossman.blogspot.com
    This will be a longer presentation telling the complete story of the development of Project Ubertooth and demonstrating new capabilities of the platform (hopefully with working Ubertooth One prototypes).
  • How To Deploy IPv6 Securely – readwriteweb.com
    The number of available IPv4 addresses is expected to run out in less than a year, as we’ve reported before.
  • MobileSubstrate wiki - iphonedevwiki.net
    MobileSubstrate consists of 3 major components: MobileHooker, MobileLoader and safe mode.

Tools:

  • SSL Diagnos is used to get information about SSL usage – sourceforge.net/projects/ssldiagnos/
    It can also be used for testing and rating ciphers on SSL clients. It has also specific support for pop3s, sip, smtp and explicit ftps.
  • Nessus Viewer v1.0.0 released – vulnerabilitydatabase.com
    Nessus Viewer enables IT Security auditors and penetration testers to quickly navigate inside Nessus reports by sorting and filtering each entry.
  • R-U-Dead-Yet Version 2.1 - chaptersinwebsucirity.blogspot.com
    The forms and their post action url’s are now parsed correctly. So here comes v2.1 with the bug fix.

Techniques:

Vendor/Software Patches:

Other News:

]]> http://infosecevents.net/2011/01/10/week-1-in-review-2011/feed/ 0 Week 50 in Review – 2010 http://infosecevents.net/2010/12/20/week-50-in-review-2010/ http://infosecevents.net/2010/12/20/week-50-in-review-2010/#comments Mon, 20 Dec 2010 10:59:30 +0000 Glenn Santos http://infosecevents.net/?p=1379 Events Related:

  • RSnake, Web Security and a few beers – andlabs.org
    Reminiscing Black Hat Abu Dhabi.
  • DojoCon Follow-Up – novainfosecportal.com
    Although there was a formal CFP, everything else followed a traditional unconference format.
  • SANS SEC660: Post Mortem – c22.cc
    The class is designed to cover the ground between the SEC560 Network Penetration Testing class and the SEC709/710 that Stephen Sims has been running for a while now (Exploit development).

Resources:

  • Will it Blend? – xs-sniper.com
    I’m always humbled when I learn of what others are doing in the security community and even more humbled when asked to present.
  • DOJOCON 2010 Videos – irongeek.com
    Below are the videos from the conference, at least the ones I can show :) , enjoy.
  • IOS Crash Analysis and Rootkit Wiki – recurity.com
    Almost everything you need to know about Cisco IOS Forensics

Tools:

  • Zozzle: Low-overhead Mostly Static JavaScript Malware Detection – microsoft.com
    In this paper, we propose ZOZZLE, a low-overhead solution for detecting and preventing JavaScript malware that can be deployed in the browser.
  • Websecurify 0.8Alpha4 – code.google.com/p/websecurify/
    Websecurify is a powerful web application security testing platform designed from the ground up to provide the best combination of automatic and manual vulnerability testing technologies.
  • All about Heaplocker
    HeapLocker allows you to set a maximum to the amount of private virtual memory a process is using. If the maximum is exceeded, HeapLocker will suspend the process and inform the user.

  • Netglub – netglub.org
    Really Open Source Information Gathering
  • Gruyere – google-gruyere.appspot.com
    This codelab is built around Gruyere – a small, cheesy web application that allows its users to publish snippets of text and store assorted files.
  • Metasploit Framework 3.5.1 Released! – metasploit.com
    This minor version release adds 47 new modules, including exploit covereage for recent bugs in the news: Exim4, Internet Explorer, and ProFTPd.
  • Mantra Security Toolkit – getmantra.com
    The Mantra is a powerful set of tools to make the attacker’s task easier. The alpha version of Mantra contains following tools built into it.
  • Squid-Imposter – github.com/koto/squid-imposter/
    Squid-imposter makes it easy to create Squid based proxy injecting your own content to chosen website URLs.
  • pwnshell – a better jsp shell – i8jesus.com
    The world needs a JSP shell that really helps a blackbox attacker pivot to important assets, so I took a stab at it. It’s called quite lamely called pwnshell.

Techniques:

  • Port Scanning with HTML5 and JS-Recon – andlabs.org
    Since even closed ports can be identified we can extend this technique to perform network scanning as well as internal IP detection.
  • Capturing Windows Logons with Smartlocker – metasploit.com
    One of the most effective ways to capture the clear-text user password from a compromised Windows machine is through the “keylogrecorder” Meterpreter script.
  • Attacking Windows Operating System over PowerShell – sectechno.com
    Now if you are on a penetration testing mission you start by running nmap searching for the live windows hosts on the network basically with 1433 active port (Mssql).
  • Watch out for exim! – skullsecurity.org
    My strategy was to keep running ‘make’ and fixing what it complained about until it shut up and compiled.
  • Conducting a Phishing Campaign in Metasploit Pro – carnal0wnage.attackresearch.com
    Only gripe is the lack of configuration ability in the exploit payload section. I’ve been told this will be addressed shortly even though a lot of work has been put into smart defaults the ability to change it when necessary would be nice.
  • Mallory and Me: Setting up a Mobile Mallory Gateway – intrepidusgroup.com
    Improving the user experience from the initial code checkout to helping users “Mallorize” traffic is a key goal for the project.
  • Metasploit and VNC Password Bruteforcing – carnal0wnage.attackresearch.com
    You probably missed it but jduck recently snuck in a VNC mixin and vnc_login module to the trunk.

Vulnerabilities:

Vendor/Software Patches:

Other News:

]]> http://infosecevents.net/2010/12/20/week-50-in-review-2010/feed/ 2 Week 49 in Review – 2010 http://infosecevents.net/2010/12/13/week-49-in-review-2010/ http://infosecevents.net/2010/12/13/week-49-in-review-2010/#comments Mon, 13 Dec 2010 15:17:40 +0000 Glenn Santos http://infosecevents.net/?p=1370 Events Related:

Resources:

Tools:

  • Runasil – didierstevens.com
    Because I didn’t find a program to start an application with a given integrity level from “Image File Execution Options”, I wrote runasil.
  • JavaSnoop 1.0 FINAL released! – i8jesus.com
    After 6 release candidates, roughly a thousand bugs fixed, dozens of improvements and features added, I finally think the tool is ready for general availability.
  • j0llydmper – code.google.com/p/j0llydmper/
    j0llydmper is a windows service that allows you to dump furtively and automaticaly some content of USB disks just plugged in your computer.
  • OWASP Zed Attack Proxy Project – owasp.org
    The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
  • Armitage 12.06.10 – fastandeasyhacking.com
    Armitage is a graphical cyber attack management tool for Metasploit that visualizes your targets, recommends exploits, and exposes the advanced capabilities of the framework.
  • skipfish-1.82b – code.google.com/p/skipfish
    A fully automated, active web application security reconnaissance tool.
  • Zozzle (Microsoft’s Javascript-Malware Analysis Tool) – kaffenews.com
    In a sentence Zozzle is a static web-page analyzer for detecting ‘Heap-Spray Exploits’.
  • Bluelog v0.9.8 – digifail.com
    Bluelog is a Linux Bluetooth scanner written to do a single task, log devices that are in discoverable mode. It is intended to be used as a site survey tool, determining how many discoverable Bluetooth devices there are in a given environment.
  • Hyenae v0.35-3 – sourceforge.net/projects/hyenae
    Hyenae is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant.
  • OVF Tool Documentation – vmware.com
    VMware OVF Tool is a command-line utility that allows you to import and export OVF packages to and from a wide variety of VMware platform products.
  • VIDigger v1.0 – layeredsec.com
    VIDigger is designed to help administrators check the configuration of ESX server and the virtual machines hosted on ESX server against the VMware Infrastructure Hardening guide and other best practices.”
  • Browser Exploitation Framework v.0.4.2 – code.google.com/p/beef/
    It allows the experienced penetration tester or system administrator additional attack vectors when assessing the posture of a target.
  • owasp-dos-http-post – code.google.com/p/owasp-dos-http-post/
    This tool was created and released GPLv3 Open Source for performance testing of systems and controls.

Techniques:

  • The USB Stick O’ Death – spareclockcycles.org
    I’ve recently been researching and experimenting with USB malware, and I wanted to take a shot at developing my own malicious USB stick.
  • Avoiding AV Detection – spareclockcycles.org
    My main goal in this research was to see how much effort it would take to become undetectable again, and the answer was ‘virtually none’.
  • DOM based Cross-site Scripting vulnerabilities – acunetix.com
    Like server-side scripts, client-side scripts can also accept user input which can contain malicious code.
  • Internet Explorer 9 ad blocking via “Tracing Protection” — no means yes. – jeremiahgrossman.blogspot.com
    User configurations will also be persistent across sessions, even when the browser is restarted, which is opposite to how InPrivate mode behaves. This is huge!
  • Quick and Easy Oracle Default Password Enumeration – digitalbond.com
    For the purpose of this post, the SID enumeration and default account/password auditing are the most important features of oscanner.
  • BlackBerry password cracking: multi-threaded, with hardware-accelerated AES – crackpassword.com
    The reason is pretty simple: we are not able to generate passwords that fast, especially when we perform all those nice mutations of wordlists passwords (changing the letter case, adding or replacing symbols etc).
  • Firefox 3.6.13: damn you, corner cases – lcamtuf.blogspot.com
    As you may recall, one of the more significant shortcomings of the same-origin policy is that it does not give any guidance on handling documents with no inherent origin associated – that is, it fails to account for all the content coming from about:, data:, file:, and similar pseudo-URLs.
  • On the effectiveness of DEP and ASLR – technet.com
    DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) have proven themselves to be important and effective countermeasures against the types of exploits that we see in the wild today.
  • More updates (including RAR) – golubev.com
    Obviously it isn’t possible to reach with 83.5% utilization, so I’ve made some tests with 5xMD5 again and this time speed-up is here.

Vulnerabilities:

  • Canon Original Data Security System Vulnerability – elcomsoft.com
    The credibility of photographic evidence becomes vital in numerous situations for insurance companies and courts, as they may accept digital image as indisputable evidence if it can be proven genuine.

Vendor/Software Patches:

  • New version of OpenSSL fixes two vulnerabilities – h-online.com
    A flaw in an older workaround for Netscape browsers and servers can be remotely exploited to make an OpenSSL server downgrade the ciphersuite to a weaker one for subsequent connections.

Other News:

]]> http://infosecevents.net/2010/12/13/week-49-in-review-2010/feed/ 1 Week 48 in Review – 2010 http://infosecevents.net/2010/12/06/week-48-in-review-2010/ http://infosecevents.net/2010/12/06/week-48-in-review-2010/#comments Mon, 06 Dec 2010 14:27:44 +0000 Glenn Santos http://infosecevents.net/?p=1360 Resources:

Tools:

  • Two New HTTP POST Attack Tools Released – sectechno.com
    Currently there is two free utility that may perform this attack d “R U Dead Yet?” and OWASP HTTP POST Tool tool offers unattended execution by providing the necessary parameters within a configuration file.
  • thicknet – github.com/SpiderLabs/thicknet
    thicknet is a TCP session manipulation and take-over tool. The tool is
    initially aimed at downgrading Oracle sessions and issuing SQL queries
    using an already-established session. This is an early proof-of-concept,
    version, but the basic concepts are there to write modules and do MITM
    against a variety of protocols.
  • Meterpreter scripts for RunAs privilege escalation & other mischief – grep8000.blogspot.com
    send_keystrokes.rb: Meterpreter script to interactively send keystrokes to an open application window using the vbscript SendKeys method. Can be used to escalate privileges into RunAs-invoked command shells on XP.
  • sqlinject-finder – code.google.com/p/sqlinject-finder/
    Simple python script that parses through a pcap and looks at the GET and POST request data for suspicious and possible SQL injects. Rules to check for SQL injection can be easily added. Output can be printed neatly on the command line or in tab delimited format.
  • cvechecker 2.0 – cvechecker.sourceforge.net/
    Version 2.0 is now available for this vulnerability  detection tool.
  • Javasnoop – code.google.com/p/javasnoop/
    JavaSnoop attempts to solve this problem by allowing you attach to an existing process (like a debugger) and instantly begin tampering with method calls, run custom code, or just watch what’s happening on the system.
  • Social-Engineering Ninja v0.4 is out! – grey0.wordpress.com
    This is the new release of ninja phishing framework.

Techniques:

  • Episode #123: Bad Connections – commandlinekungfu.com
    Similar to last week, this week’s challenge comes from Tim’s friend who is mentoring a CCDC team. The mentor was interested in creating some shell fu that lets them monitor all network connections in and out of a system and get information about the executable that’s handling the local side of the connection.
  • Packet Payloads, Encryption and Bacon – packetstan.com
    Over the years I’ve used a couple of techniques to evaluate the content of packet captures to determine if the traffic is encrypted or just obfuscated.
  • Login notifications, pam_exec scripting – stalkr.net
    If you like monitoring, you might want to receive notifications at every (or only root) login, in addition to logs.
  • All your drives are belong to us – fortinet.com
    A new Ransomware module was recently discovered by Fortiguard Labs. When a machine infected with this Ransomware is restarted, the user is greeted with the following boot screen.
  • JavaScript Obfuscation of Metasploit Browser Exploits for AV bypass – grep8000.blogspot.com
    Bam. 0-day with AV bypass? Yeah, you’re on the pwnie express. :} Thanks to Will Metcalf for pointing me in the right direction!
  • Windows PE Header – marcoramilli.blogspot.com
    Each executable file has a Common Object File Format COFF which is used from the OS loader to run the program. Windows Portable Executable (PE) is one of the COFF available in todays OS. For example the Executable Linking File (ELF) is the main Linux COFF.
  • Shearing FireSheep with the Cloud – stratumsecurity.com
    Enjoy surfing open wireless networks or hostile wired network securely!
  • Internal Port Scanning via Crystal Reports – spl0it.wordpress.com
    This is faster than using BeEF’s JavaScript internal portscanning functionality and it doesn’t require client interaction. Pwn dem v0hns!

Vulnerabilities:

  • Exploit Code Out For New Windows Kernel Flaw – threatpost.com
    The new Windows kernel bug is considered a critical vulnerability, even though it can’t be exploited remotely, thanks to the fact that an attacker could use it gain powerful credentials on a compromised system and take complete control of the machine.

Vendor/Software Patches:

  • New Tool Patches Offline VMs – darkreading.com
    Nuwa, named after the Chinese goddess who patched a hole in the sky, aims to fix cloud computing security hole.

Other News:

]]> http://infosecevents.net/2010/12/06/week-48-in-review-2010/feed/ 1