ZDNet Security Blogger Goes Missing in Bulgaria

A prominent blogger and security researcher, Dancho Danchev, has gone missing and security publications, including Threatpost.com, are asking for help in locating him. Danchev, who contributed regular posts to ZDNet’s Zero Day blog, part of CBS Interactive, has been missing since late October...

White House E-Card Scam Part of Larger Zeus-Related Attack !

The simplistic spam campaign that hit around Christmas and purported to be a holiday greeting from the White House not only included a piece of Zeus-related malware that searches hard drives for documents and uploads them to a remote server, but also appears to be connected to a similar attack fr...

WikiLeaks Prompts Federal Agencies to Assess Infosec Programs for Sensitive Data

In response to the embarrassment and perceived threat resulting from the WikiLeaks disclosures in recent months, the Office of Management and Budget has issued a hefty memo with pages of questions that federal agencies must use to conduct an initial assessment of their programs to handle and...

White House E-Card Scam Part of Larger Zeus-Related Attack

The simplistic spam campaign that hit around Christmas and purported to be a holiday greeting from the White House not only included a piece of Zeus-related malware that searches hard drives for documents and uploads them to a remote server, but also appears to be connected to a similar attack fr...

Wikileaks: Controversial, But is it NSFW?

As government agencies and the military bar access to the WIkileaks documents, a poll of Web filtering providers finds most label the leak site more “newsy” than “naughty.” HED: Wikileaks: Controversial, But is it NSFW? DEK: As companies look to bar access to the WIkileaks documents or not Web...

Sign of the Times: Shmoocon Tickets Scalped on eBay

How do you know when your alt.hacking conference has arrived? Maybe when scalpers are offering tickets for the event on eBay for almost three times the face value. That’s the situation the organizers of hacking conference Shmoocon have found themselves in, as illicit auctions for tickets to next...

CBI Website Hacked by Pakistani Cyber Army, NIC Security Questioned

The recent hacking of the Central Bureau of Investigation's CBI website by a group called the 'Pakistani Cyber Army' has raised concerns about the security measures of servers maintained by the National Informatics Centre NIC. The NIC is responsible for government server maintenance. While the NI...

Infected Web sites double in 2010 : A Report

The number of Web sites infected with malware has doubled from a year ago to more than 1.2 million, according to a study released today by Internet security company Dasient. Not only are social-media sites getting targeted, but sites of larger government agencies increasingly are hit, including t...

Canada Aims to Strengthen Cyber Defense with $90 Million Security Plan

Canada released its Cybersecurity Strategy this month, emphasizing the immense challenge of protecting government and corporate computer systems. “There is no simple way to detect, identify, and recover from attackers who cannot be seen or heard, who leave no physical evidence behind them, and wh...

VUPEN Security Research - Microsoft Office Excel Out-of-Bounds Memory Write Vulnerability (CVE-2010-3241)

VUPEN Security Research - Microsoft Office Excel Out-of-Bounds Memory Write Vulnerability CVE-2010-3241 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Excel is a powerful tool you can use to create and format spreadsheets, and analyze and share...

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability (CVE-2010-2750)

VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability CVE-2010-2750 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Word, included in the Microsoft Office suite, is a powerful authoring program that gives the ability t...

California Bill Ups the Ante on Breach Notifications

The new bill requires that the company include the type of personal information exposed in the breach; the date or estimated date of the breach; a general description of the incident itself; and toll-free numbers and addresses for credit reporting agencies if the breach included social security...

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability (CVE-2010-2558)

VUPEN Security Research - Microsoft Internet Explorer "CIframeElement" Object Use-after-free Vulnerability CVE-2010-2558 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Internet Explorer is a web browser developed by Microsoft and included as part of the...

Microsoft Says No to Paying Bug Bounties

Microsoft has no plans to follow in the footsteps of Mozilla and Google and pay researchers cash rewards for the bugs that they find in Microsoft’s products. In the wake of both Mozilla and Google significantly increasing their bug bounties to the $3,000 range, there have been persistent rumors i...

VUPEN Security Research - Adobe Acrobat and Reader "newfunction" Memory Corruption Vulnerability (CVE-2010-2168)

VUPEN Security Research - Adobe Acrobat and Reader "newfunction" Memory Corruption Vulnerability CVE-2010-2168 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Adobe Acrobat and Reader are the global standards for electronic document sharing. They are used to create,...

VUPEN Security Research - Apple Safari WebKit HTML Button Use-after-free Vulnerability (CVE-2010-1392)

VUPEN Security Research - Apple Safari WebKit HTML Button Use-after-free Vulnerability CVE-2010-1392 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Safari is a web browser developed by Apple. As of February 2010, Safari was the fourth most widely used browser, with...

Software Insecurity is Our Biggest Weakness

ST. PAUL, MINN.–If the United States wants to remain competitive in the global economy and prevent widespread penetrations of its strategic, corporate and commercial networks, enterprises and government agencies should stop relying on commercial software and go back to writing more of their own...

Cisco Hardware Counterfeiters Caught By Feds

A joint investigation by federal agencies leads to the conviction of several individuals trading in counterfeit Cisco network hardware. Read the full article. eWEEK...

AVCON 4.6.8.7 Buffer Overflow

!/usr/bin/perl Exploit Title: AVCON Buffer Overflow Date: 5/7/10 Author: Dillon Beresford URL: http://www.avcon.com.cn/ Version: 4.6.8.7 Tested on: XP SP2 and SP3 CVE : NONE Code : exploit.pl Twitter: http://twitter.com/D1N Dork: site:gov.cn "AVCON" There are other bugs... This is just for fun ;-...

AVCON Buffer Overflow

Exploit for windows platform in category local exploits ===================== AVCON Buffer Overflow ===================== !/usr/bin/perl Exploit Title: AVCON Buffer Overflow Date: 5/7/10 Author: Dillon Beresford URL: http://www.avcon.com.cn/ Version: 4.6.8.7 Tested on: XP SP2 and SP3 CVE : NONE...