FACT : One in five Microsoft logins controlled by hackers

About 20 percent of Microsoft Account logins are found on lists of compromised credentials in the wake of hack attacks on other service providers, Eric Doerr, Group Program Manager for Microsoft's Account system said. A significant proportion of compromised credentials Microsoft sees from other...

Yahoo Patches Vulnerability that Led to 450,000-Password Breach

Yahoo announced today it’s fixed the security hole that allowed a hacker group this week to post some 450,000 email addresses and passwords belonging to freelance writers. “We have taken swift action and have now fixed this vulnerability, deployed additional security measures for affected Yahoo!...

Exploit JBoss vulnerability to get webshell method-vulnerability warning-the black bar safety net

JBoss is a large application platform, ordinary users is difficult to come into contact with. The more difficult to contact something the more I advanced, to borrow a Beijing bus driver Lee su Li of the word“force can only dry out the incompetent, hard to dry out outstanding”, in security is also...

Social Site Formspring Says 420k User Password Hashes Posted Online

Hackers broke into a development server at Formspring, a social Q&A site, and made off with the password hashes for 420,000 users and later posted them online. The company has reset all of the users’ passwords and said it also has changed the way that it handles passwords. Formspring officials sa...

Optimalog Optima PLC Multiple Vulnerabilities

Overview Independent researcher Luigi Auriemma identified a NULL Pointer Dereference and an Infinite Loop and released proof-of-concept exploit code for Optimalog’s Optima PLC application without coordination with ICS-CERT, the vendor, or any other coordinating entity known to ICS-CERT. Optimalog...

NYT: When Hackers Strike, Small Business Owners Hit Hard

Independent business owners may find themselves deep in debt after hackers wipe out their bank accounts, with banks reluctant to recoup losses caused by online attacks, according to a report in the New York Times. The article, in the Thursday edition of the Times, details several so-called...

Survey Shows 85 Percent of Small Business Owners Convinced a Data Breach Unlikely

If a newly released survey is any indication, publicized data breaches aren’t enough to prompt small businesses to better protect their customer or employee data. A survey released this week by The Hartford found 85 percent of small business owners believe a data breach is unlikely and often lack...

eHarmony, Last.fm Emerge as Latest Victims in Wake of LinkedIn Hack

The online dating site eHarmony announced Wednesday that passwords for some of its members have been leaked, making it the second major social network site to announce the theft of user passwords in the last 24 hours. According to an entry posted on the eHarmony Blog, the company reset the affect...

GarrettCom - Use of Hard-Coded Password

Overview Independent security researcher Justin W. Clarke of Cylance Inc. has identified a privilege-escalation vulnerability in the GarrettCom Magnum MNS-6K Management Software application via the use of a hard-coded password. This vulnerability could allow a remote attacker with any level of...

Through the Zend directory permissions are not strict get execute permissions-bug warning-the black bar safety net

On the server a lot have installed Zend Even if C:\Program Files\ set permissions, install Zend, Zend will auto-configure directory permissions C:\Program Files\Zend\ZendOptimizer-3.3.0\ under the directory permissions for the Everyone full,which leads to the intruder can be written into the file...

A CISO's Guide To Application Security – Part 5: Justifying an Investment in AppSec

This post is the last in a 5-part series on Application Security, or “AppSec”. This blog post series has examined the growing threats to software, defined the components of a sound AppSec program, described an evolutionary path to AppSec maturity, and considered a number of tools and technologies...

Sony Engineers Met With PS3 Hacker - Geohot

Sony Engineers Met With PS3 Hacker - Geohot George Hotz aka "Geohot" first made a name for himself in the PS scene when he not only managed to hack a PlayStation 3, but then proceeded to publish a guide that shared with others how to do it as well. In an effort to improve their security measures,...

zDefender - Enterprise smartphone IDS/IPS released by Zimperium

zDefender - Enterprise smartphone IDS/IPS released by Zimperium Do you recall the security firm Zimperium which came out with ANTI, the killer Android app that allowed even the clueless to hack and pwn like a pentester? Zimperium, an Israeli security start up founded by Zuk Avraham, a...

Security Concern : Internet Enabled TV can be hacked !

Security Concern : Internet Enabled TV can be hacked ! Is your Internet TV vulnerable to hackers? Internet TVs could be the newest avenue for cybercriminals to infiltrate your home or business. Last year, Researchers at Mocana, a security technology company in San Francisco, recently discovered...

TigerBot - SMS Controlled Android Malware Stealing Information

TigerBot - SMS Controlled Android Malware Stealing Information A new form of Android malware controlled via SMS messages has been discovered and the malware can record phone calls, upload the device's GPS location, and reboot the phone, among other things. Researchers at NQ Mobile, working...

Google Fixes Second Set of Chrome Bugs Used in Pwnium Contest

Google has pushed out a patch for the second full sandbox escape exploit used in the Pwnium contest at CanSecWest. The Chrome vulnerabilities that the exploit targeted were discovered by an anonymous researcher who used the name PinkiePie and claimed a $60,000 reward from Google. The attack that...

EUVD-2012-1563

Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service memory corruption by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012...

Measuresoft ScadaPro DLL Hijack

Overview Independent researcher Carlos Mario Penagos Hollmann identified a remotely exploitable, uncontrolled search path element vulnerability, commonly referred to as a DLL hijack, in Measuresoft’s ScadaPro application. Measuresoft has produced an upgrade to address this vulnerability. Mr...

GE Intelligent Platforms Proficy HTML Help Vulnerabilities

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: Intelligent Platforms Vulnerabilities: Stack-based Buffer Overflow, Command Injection 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled...

Update: Verisign Admits To Security Breaches in 2010

Verisign, the Internet security company responsible for management of the .COM domain, told federal regulators that it was the victim of several successful attacks in 2010, but that those incidents were not reported to the company’s management until September, 2011. The news was first reported by...