Microsoft Windows automatically executes code specified in shortcut files

Overview Microsoft Windows automatically executes code specified in shortcut LNK and PIF files. Description Microsoft Windows supports the use of shortcut or LNK files. A LNK file is a reference to a local file. A PIF file is a shortcut to a MS-DOS application. Clicking on a LNK or PIF file has...

Understanding The Porn + Malware Connections

CAMBRIDGE — For a minimal investment of about $160, a single porn site operator can infect more than 20,000 computers with malware for use in cybercrime, according to an academic study presented at the Workshop on the Economics of Information Security WEIS 2010. The research team presented a...

Research: 1.3 Million Malicious Ads Viewed Daily

The true extent of the malvertizing scourge became much clearer this week with the release of new research by Dasient which shows that about 1.3 million malicious ads are being viewed online everyday, most pushing drive-by downloads and fake security software. Dancho Danchev sums up the findings...

Secunia Flags 'Highly Critical' Safari Zero Day Flaw

A zero-day vulnerability in Apple’s Safari browser could expose millions of Windows users to drive-by download malware attacks. The flaw is currently unpatched. According to an alert from Secunia, the issue is rated “highly critical” because of the risk of remote code execution attacks that can...

Affinity Health Warns 409K Customers of Breach

Affinity Health Plan, a New York managed care service, is notifying more than 400,000 current and former customers employees that their personal data might have been leaked through the loss of an unerased digital copier hard drive. Read the full article. Dark Reading...

iomega Home Media Network Hard Drive unauthorized access

Web interface allows SMB access to device and network it's connected to...

Unauthenticated Filesystem Access in iomega Home Media Network Hard Drive

----------------------------- Advisory ----------------------------- Unauthenticated File-system Access in iomega Home Media Network Hard Drive ----------------------------- Affected products ----------------------------- iomega Home Media Network Hard Drive Firmware versions 2.038 - 2.061...

Inside the Java 0-Day Exploit

The Java Web Start vulnerability that has been getting so much attention of late is being attacked by a number of different sites now, with a relatively simple and easily reproducible exploit, researchers say. The Java flaw, which Google researcher Tavis Ormandy disclosed publicly on April 9, was...

Iomega Home Media Network Hard Drive v.2.038-2.061 File-system Access

Exploit for hardware platform in category remote exploits =========================================================================================== Unauthenticated File-system Access in Iomega Home Media Network Hard Drive v. 2.038 - 2.061...

Iomega Home Media Network Hard Drive 2.038 2.061 - File-system Access

Iomega Home Media Network Hard Drive 2.038 2.061 - File-system Access ----------------------------- Advisory ----------------------------- Unauthenticated File-system Access in iomega Home Media Network Hard Drive ----------------------------- Affected products ----------------------------- iomeg...

iOmega Home Media Network Drive Arbitrary Access

----------------------------- Advisory ----------------------------- Unauthenticated File-system Access in iomega Home Media Network Hard Drive ----------------------------- Affected products ----------------------------- iomega Home Media Network Hard Drive Firmware versions 2.038 - 2.061...

Java Zero-Day Attacks In The Wild

Just days after Google researcher Tavis Ormandy released details on a dangerous new Java vulnerability, malicious hackers have pounced and are exploiting the flaw in the wild to launch drive-by download attacks. Virus hunters have spotted the attacks on a popular song lyrics Web site. Any visitor...

Microsoft Plugs Critical Drive-By Download Holes

Microsoft today released 11 security bulletins with fixes for a total of 25 security vulnerabilities, including several flaws that expose users to browse-and-you’re-hacked malicious drive-by download attacks. Two of the bulletins are rated “critical” for all versions of Microsoft’s flagship...

Microsoft Plugs IE Drive-By Download Flaws

Microsoft today shipped a cumulative Internet Explorer update with patches for 10 security holes, including a drive-by download vulnerability that’s already being used in malware attacks. The critical MS08-018 update patches security holes that could lead to code execution attacks on all versions...

Win Update Scareware Pushes Drive-By Downloads

Cybercriminals are using a fake Windows Update installation dialogue box to sell a bogus security product called Anti-malware Defender, security researchers have warned. Read the full article. Computer Weekly...

Exploit Code Published for Latest IE Zero-Day

Using obvious clues from a McAfee blog post, an Israeli hacker was able to pinpoint the latest Internet Explorer zero-day vulnerability and create working exploit code. The exploit code, which provides a clear roadmap to launch drive-by download attacks against IE 6 and IE 7 users, is being fitte...

Free Blocking Tool to Thwart Drive-By Downloads

Researchers are preparing to release a free tool to stop “drive-by” downloads: Internet attacks in which the mere act of visiting a Web site results in the surreptitious installation of malicious software. The new tool, called BLADE Block All Drive-By Download Exploits, stops downloads that are...

Cacls mention the right to command-and-vulnerability warning-the black bar safety net

The Cacls command parameters: cacls.exe c: /e /t /g everyone:F put the c drive set to everyone can browse cacls.exe d: /e /t /g everyone:F The d drive set to everyone can browse cacls.exe e: /e /t /g everyone:F The e drive set to everyone can browse cacls.exe f: /e /t /g everyone:F The f drive is...

Design/Logic Flaw

SanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time...

CVE-2010-0229

Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captured in a USB data stream at an earlier time...