LinkedIn Asks for Transparency on National Security Letters

LinkedIn on Tuesday joined the fray of Internet companies requesting permission from the Foreign Intelligence Surveillance Court to publish data on the number of National Security Letters it receives. Unlike Google, Microsoft and others that have petitioned the FISA court to lift its ban on the...

Researchers Build Undetectable Dopant Hardware Trojans

Is it so outlandish anymore to consider that an attacker interested in military, political or corporate espionage would be able to infiltrate a supply chain and drop malware onto an integrated circuit? Evidence of hardware-based Trojans is anecdotal at best, and experts believe a change in...

Apple Fixes 30 Bugs With Mountain Lion Update

Apple pushed a handful of patches late last week and updated its OS X Mountain Lion to 10.8.5, improving “stability, compatibility and security” issues and fixing 30 different vulnerabilities in the operating system. The update fixes multiple vulnerabilities in Apache that could have led to a...

Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components : - Apache - Bind - Certificate Trust Policy - CoreGraphics - ImageIO - Installer - IPSec - Kernel - Mobile Device Management -...

Bruce Schneier on the NSA, Cryptography and Trust

Dennis Fisher talks with cryptographer Bruce Schneier about the revelations of the NSA’s capabilities to subvert and weaken cryptographic algorithms, security products and standards, and what it will take to help defeat these capabilities. Download: digitalunderground125.mp3 Subscribe to the...

Can we Trust Google ? Company Speeding up Strong Encryption Program in response to NSA surveillance

Trust is something that's earned, not given. We trusted tech companies with our data because they promised to keep it secure. That trust was called into question after former NSA contractor Edward Snowden revealed that NSA is snooping on us with the help of same tech companies. Today Google...

Can we Trust Google ? Company Speeding up Strong Encryption Program in response to NSA surveillance

Trust is something that’s earned, not given. We trusted tech companies with our data because they promised to keep it secure. That trust was called into question after former NSA contractor Edward Snowden revealed that NSA is snooping on us with the help of same tech companies. Today Google...

Cisco IP Communicator Certificate Trust List Manipulation

The version of Cisco IP Communicator is 8.61. Such versions are potentially affected by a data modification vulnerability. By performing a Man-in-the-Middle attack, a remote, unauthenticated attacker could replace the original Certificate Trust List with a modified one. C Tenable Network Security...

Java Code-Signing, Security Prompts Fail with Developers

Why would a software company require developers to sign code, thereby ensuring a modicum of trust—but not security—and then shatter that trust by allowing signed applets to bypass their own application sandbox? Welcome to the world of Oracle and Java, where a once healthy programming language has...

Features Gem for Ruby /tmp/out.html Local XSS

Features Gem for Ruby contains a flaw that allows a local cross-site scripting XSS attack. This flaw exists because the application does not validate certain input upon submission to /tmp/out.html. This may allow an attacker to create a specially crafted request that would execute arbitrary scrip...

Google, Mozilla Considering Limiting Certificate Validity to 60 Months

In the wake of a parade of problems with certificate authorities and attackers using stolen digital certificates, both Google and Mozilla are poised to enforce new rules in their browsers for how long end-entity certificates should be trusted. The changes will begin taking effect at the beginning...

Active Directory - Enumerate Directory Trusts

Binary data adsienumdirectorytrusts.nbin...

Mixed Reaction to DEF CON Ban of Feds

For over two decades DEF CON has been an open nexus of hacker culture, a place where seasoned pros, hackers, academics, and feds can meet, share ideas and party on neutral territory. Our community operates in the spirit of openness, verified trust, and mutual respect. When it comes to sharing and...

CVE-2013-2879

Google Chrome before 28.0.1500.71 does not properly determine the circumstances in which a renderer process can be considered a trusted process for sign-in and subsequent sync operations, which makes it easier for remote attackers to conduct phishing attacks via a crafted web site...

CVE-2013-3171

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application XBAP or 2 a crafted .NET Framework...

Design/Logic Flaw

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application XBAP or 2 a crafted .NET Framework...

CVE-2013-3171

The serialization functionality in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 does not properly check the permissions of delegate objects, which allows remote attackers to execute arbitrary code via 1 a crafted XAML browser application XBAP or 2 a crafted .NET Framework...

[EMET v4.0] Enhanced Mitigation Experience Toolkit

The Enhanced Mitigation Experience Toolkit EMET is designed to help prevent hackers from gaining access to your system. Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of...

EMET 4.0 now available for download

We are pleased to announce that the final release of version 4.0 of the Enhanced Mitigation Experience Toolkit , best known as EMET, is now finally available for download. You can download it from http://www.microsoft.com/en-us/download/details.aspx?id=39273. We already mentioned some of the new...

Threat, Attack Data Intelligence Sharing Efforts Fall Short

DENVER – When it comes to information sharing, are companies too scared or too selfish to trade attack data? A number of information security officers from high-profile companies debated the topic this week at the NG Security Summit and came to the conclusion that it’s a little bit of both. Shari...