Small windows can be used in several ways to trick users into executing downloads – Opera Security Advisories

When the download dialog is displayed, it should always be visible to the user, to ensure that the user realizes it is there. If the dialog is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can end...

Scientific Linux Security Update : dhcp on SL3.x, SL4.x i386/x86_64

The Mandriva Linux Engineering Team discovered a stack-based buffer overflow flaw in the ISC DHCP client. If the DHCP client were to receive a malicious DHCP response, it could crash or execute arbitrary code with the permissions of the client root. CVE-2009-0692 An insecure temporary file use fl...

Trojan Downloader Determines OS, Infects Systems With Custom Malware

A new downloader uncovered by researchers at the Finnish security firm F-Secure is capable of sniffing out which operating system a user is running and infecting them with a custom malicious payload. F-Secure’s Karmina Aquino discovered the attack on a compromised Colombian transport website. The...

Startup CrowdStrike Launches Crowd-Sourced Platform for Malware Analysis

Venture funded startup CrowdStrike has launched a new platform that will allow security researchers to work collaboratively to reverse engineer and analyze malicious code. The new platform, CrowdRE, was designed to resemble conventional software version control systems, with features that allow...

Sun iPlanet Error Page Link Injection

Sun iPlanet Error Page Link Injection known about long time, but no CVE! probably because this really lame vulnerability! some security pro will say this good for social engineering and give cyberwar example! GET...

Dove Forums 1.0.3 Cross Site Request Forgery

In The Name Of Allah +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Exploit Title:Dove Forums-Add admin CSRF @@@@@ | Date : 2012-06-26 @ @ + Author :Ashiyane Digitl Security Team @ @@@ @ | Vendor :http://www.doveforums.com/ @ @ @ @ + Version: 1.0.3 @ @@ ...

Google Data Shows Attack and Phishing Sites Increasing Rapidly

The number of compromised sites detected each month by Google’s antimalware and anti-phishing systems has been dropping rather steadily from a peak of more than 300,000 in early 2009 and is now down around 150,000. However, the company’s statistics also show that the number of outright malicious...

A combination of clicks and key presses can lead to cross site scripting or code execution

When a user double clicks on a page, they may expect the two clicks to target the same object. If a page uses the first click to open a pop-up window in a predictable location, the second click may focus parts of the new window, such as its address field. If the page can then convince the user to...

Pages can prevent navigation to a target page, spoofing the address field – Opera Security Advisories

When a user types a new URL for the browser to load, the currently active page may detect when the new page is about to load and prevent the navigation, while still leaving the new URL displayed in the address bar. This can then be used to spoof the URL of the target page. The malicious page woul...

A combination of clicks and key presses can lead to cross site scripting or code execution – Opera Security Advisories

When a user double clicks on a page, they may expect the two clicks to target the same object. If a page uses the first click to open a pop-up window in a predictable location, the second click may focus parts of the new window, such as its address field. If the page can then convince the user to...

Hidden keyboard navigation can allow cross site scripting or code execution

When a user is interacting with a window, that window should be visible to the user, to ensure that the user realizes it is there. If a page is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can en...

Pages can prevent navigation to a target page, spoofing the address field

When a user types a new URL for the browser to load, the currently active page may detect when the new page is about to load and prevent the navigation, while still leaving the new URL displayed in the address bar. This can then be used to spoof the URL of the target page. The malicious page woul...

Apple Details iOS Security Features in New Guide

Apple has released a detailed security guide for its iOS operating system, an unprecedented move for a company known for not discussing the technical details of its products, let alone the security architecture. The document lays out the system architecture, data protection capabilities and netwo...

IXESHE Malware Avoids Easy Detection to Remain a Persistent Threat

Trend Micro today issued a report on an advanced persistent threat that uses stealthy data-stealing malware called IXESHE “i-sushi” to infect machines. So far it’s hit East Asian governments, Taiwanese electronics manufacturers and German telecommunications firms operating across Asia. Though the...

DHS Warns of Potential Scams and Attack in Run-up to London Olympics

Hacktivists, malware, scams, data theft and DDoS attacks are among the Department of Homeland Security’s concerns regarding this summer’s Olympic Games set to take place in London, according to the DHS Cybersecurity and Communications Integration Center’s Strategic Outlook. The document focuses...

Tatanga Trojan Mixes MitB with Social Engineering

Cybercriminals are using the Tatanga trojan to carry out a complicated man-in-the-browser MitB attack that enables the circumvention of SMS authentication for financial transactions, according to Trusteer’s Amit Klein. The attack is targeting the customers of a number of banks in Germany. How man...

Forget 'Brogrammers,' Women Have The Edge In DEFCON Social Engineering Contest

Men may dominate the ranks of vulnerability researchers and hackers. But could women be the superior social engineers? Its a question that the organizers of the annual Social Engineering Capture the Flag CTF contest at DEFCON will try to answer. In a break from recent years, the third annual DEFC...

New P2P Zeus Variant Targets Popular Sites with Bogus Offers

Facebook, Gmail, Yahoo and Hotmail users should beware of rogue rebate offers and new secure payment options aimed at getting them to part with their debit card information. Earlier this week Amit Klein, CTO of Trusteer, announced the discovery of a peer-to-peer variant of the Zeus platform that...

extmail找回密码带来的可提供交互性社工的问题

简要描述： 大部分的extmail产品用户在使用该产品时并不会注意到该问题,以至于许多这种页面都可以直接通过外网进行访问,由于该产品是属于邮件系统,使用者本身会在网络上留下邮件地址,通过web界面访问得知该系统之后就会给其带来可被交互性社工的危险。呵呵,最近挺忙,事情挺多的 详细说明：...

The Hackers Conference 2012 Call For Papers #THC2012

We are extremely delighted to announce the Call for Papers for The Hackers Conference 2012 It is a unique event, where the elite of the hacker world, leaders in the information security industry and the Internet community meet face to face to join their efforts to cooperate in addressing the most...