Dan Geer: Security at the Forefront of Policy Decisions

LAS VEGAS – Dan Geer carried his version of computer security’s Ten Commandments to a rapt Black Hat 2014 audience today, offering up 10 personal recommendations and observations related to the current state of security in the context of government surveillance and eroding privacy. Adorned in...

Chip and PIN EMV Protocol security vulnerabilities found

Chip-and-PIN payment cards are coming to the United States after a long head start as a standard card-present payment method in Europe and Asia. Already, retailer Target accelerated its plan to move its branded debit and credit cards to chip-and-PIN, also known as EMV Europay, MasterCard and Visa...

SonicWALL GMSVIEWPOINT 6.x Analyzer 7.x - Remote Command Execution

SonicWALL GMSVIEWPOINT 6.x Analyzer 7.x - Remote Command Execution !/usr/bin/perl Title: SonicWALL GMS/VIEWPOINT 6.x Analyzer 7.x Remote Root/SYSTEM exploit Name: sgmsRCE.pl Author: Nikolas Sotiriu lofi Use it only for education or ethical pentesting! The author accepts no liability for damage...

Appeals Court Calls Bank's Security "Commercially Unreasonable"

The United States Court of Appeals on Tuesday reversed a lower court’s decision, ruling that the IT security system used by a domestic bank was not “commercially reasonable” to protect its customers. The ruling PDF, in the case of People’s United Bank formerly Ocean Bank of Maine versus Patco...

Visa, MasterCard Warn Of Breach At Card Processor

UPDATE–MasterCard and Visa have confirmed that they are investigating a potentially huge data breach at one of the companies’ payment processors, which the Wall Street Journal has identified as Global Payments Inc. The credit card giants are alerting banks about a breach at a U.S. based card...

Twitter, As secondary publisher could be sued for an illegal tweet

Twitter, As secondary publisher could be sued for an illegal tweet If a Twitter user posts an illegal tweet, they could get sued, but Twitter could be sued itself as a secondary publisher according to Zack Whittaker. Legal analysis site Out-Law published a very interesting, theoretical piece, whi...

FBI Conducts Search Warrants At 40 "anonymous" Supporters Wikileaks !

The FBI announced today that they have executed over 40 search warrants in connection with the UK Metropolitan Police against Wikileaks DDoS'ing participants of "enemies." Unlike police met, the FBI did not reveal many details about who may have executed the arrest warrants against, or more...

MS10-070 ASP.NET Padding Oracle File Download

!/usr/bin/ruby -w aspxpochotextattack.rb Copyright c 2010 AmpliaSECURITY. All rights reserved http://www.ampliasecurity.com Agustin Azubel - [email protected] MS10-070 ASPX proof of concept Decrypt data using Vaudenay's cbc-padding-oracle-side-channel Encrypt data using Rizzo-Duong CBC-R...

Malwarians at the Gate: Banks, Businesses and ACH Fraud

Banks and their customers are on opposite ends of a feud over which is responsible when online banking accounts get hacked and pillaged. But where does the fault really lie? Banks and their customers are on opposite ends of a feud over which is responsible when online banking accounts get hacked...

Malwarians at the Gate: Banks, Business Customers and ACH Fraud

Banks and their customers are on opposite ends of a feud over which is responsible when online banking accounts get hacked and pillaged. But where does the fault really lie? And is there a cure for the plague of online banking fraud? You left your car unlocked. When you return, it was vandalized...

De-perimeterization and open standards

From Cnet, by Jon Oltsik The openness and universal connectivity that helped break down the barriers between coporate networks has also turned out to be a security liability. Jon Oltsik, an analyst at Enterprise Strategy Group, writes that there’s now a need for open standards in security Cnet...

ARPUS/Ce - Local File Overwrite (setuid)

/ Copyright Kevin Finisterre - ripped from my perlex.c DISCLAIMER I am in no way responsible for your stupidity. DISCLAIMER I am in no way liable for any damages caused by compilation and or execution of this code. WARNING DO NOT RUN THIS UNLESS YOU KNOW WHAT YOU ARE DOING WARNING overwriting...

FreeBSD : openoffice -- document disclosure (131)

The following package needs to be updated: ar-openoffice %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkgc62dc69f05c811d9b45d000c41e2cdad.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

FreeBSD : Apache 2 mod_ssl denial-of-service (12)

The following package needs to be updated: apache %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg492f889670fa11d8873f0020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

FreeBSD : rsync path traversal issue (168)

The following package needs to be updated: rsync %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg73ea07069c5711d893660020ed76ef5a.nasl. Disabled on 2011/10/01. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-20...

sun_bof.txt

Subject: Sun Security Bulletin 00189 fwd To: [email protected] -- Kis-Szabo Andras Technical University of Budapest -----------------------------/ Schonherz Zoltan Dormitory [email protected] /-------------------------------3OO---.Info Fingerprint = 97 D7 32 CE F9 74 5C A0 E5 F4 09 29 67 9...