IE 11 Stands Up to Pwn2Own Exploit Attempt

VANCOUVER – Successful exploits at the Pwn2Own contest get all the glitz, but the rarities are the exploits that fail. A group of four young South Korean hackers from ASRT, all of them well shy of their thirtieth birthdays, stood in proxy for Jung Hoon Lee. Lee was home fulfilling a military...

Charitable Prelude to Pwn2Own Not Without Its Critics

VANCOUVER – The prelude to the annual Pwn2Own contest between sponsor HP’s Zero Day Initiative and Pwnium contest sponsor Google produced not only zero-day exploits for Internet Explorer and Safari, but some skepticism about whether the exploits and details on the vulnerabilities were held for th...

Vupen Cashes in Four Times at Pwn2Own 2014

VANCOUVER – It’s become a familiar walk for Chaouki Bekrar. Year after year at the Pwn2Own contest, the controversial Vupen founder is scurried from a small room in the basement of the Sheraton hotel to a suite several floors above. It’s a short journey from where a string of zero-day exploits ar...

Joomla Fixes Critical SQL Injection Vulnerability

The open-source content management framework Joomla pushed out version 3.2.3 of its product last week, fixing a SQL injection zero-day vulnerability that could have let attackers steal information from databases or insert code into sites running the CMS. While little is being disclosed by Joomla,...

Microsoft Resolves IE Zero Day with Patch Tuesday Release

UPDATE: a previous version of this story mistakenly stated that Microsoft’s March patch Tuesday would be the last one providing support for Windows XP. Windows XP’s last patches will in fact be shipped with next month’s patch Tuesday release. Microsoft has finally pushed a fix for a stubborn and...

IE Zero Day Exploits Increase Just Before Patch

Attackers have increased their exploitation of an Internet Explorer zero day vulnerability CVE-2014-0322 set to be fixed by Microsoft in its regularly scheduled patch Tuesday release later this afternoon. According to a Websense report, the exploit source code deployed in at least two incidents –...

Microsoft to Patch IE 10 Zero Day March 2014 Patch Tuesday

Microsoft will patch a lingering zero-day vulnerability in Internet Explorer next Tuesday, one of five bulletins it will release as part of its March 2014 Patch Tuesday security updates. The IE 10 zero-day was disclosed close to a month ago when researchers at FireEye reported on Operation SnowMa...

Researchers Investing in EMET Bypasses More than Hackers

Exploits bypassing Microsoft’s Enhanced Mitigation Experience Toolkit, or EMET, are quickly becoming a parlor game for security researchers. With increasing frequency, white hats are poking holes in EMET, and to its credit, Microsoft has been quick to not only address those issues but challenge a...

[security bulletin] HPSBST02937 rev.1 - HP StoreVirtual 4000 and StoreVirtual VSA Software dbd_manager, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03995204 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03995204 Version: 1 HPSBST02937 rev....

APPLE-SA-2014-02-25-3 QuickTime 7.7.5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-02-25-3 QuickTime 7.7.5 QuickTime 7.7.5 is now available and addresses the following: QuickTime Available for: Windows 7, Vista, XP SP2 or later Impact: Playing a maliciously crafted movie file may lead to an unexpected application...

Avaya to Patch one-X IP phone zero-day vulnerability

SAN FRANCISCO — Two zero-day vulnerabilities in Avaya’s latest one-X 9608 IP telephones have been discovered and are expected to be patched on Friday by the provider. Researcher Ang Cui, a Ph.D. candidate at Columbia University and chief scientist at Red Balloon Security, will demonstrate an...

Microsoft EMET 5.0 Technical Preview Released

SAN FRANCISCO – Enterprises beat up by wave after wave of Java exploits and calls to disable the platform may soon have some relief in sight. Microsoft’s free Enhanced Mitigation Experience Toolkit will soon have a new feature that allows users to configure where plug-ins, especially those target...

Complete Microsoft EMET Bypass Developed

SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...

Adobe releases another Emergency Security Patch for Flash Player

Security Firm FireEye has uncovered yet another critical zero-day vulnerability in widely used Adobe Flash Software and Adobe has been forced to issue a second emergency patch update in less than a month. All versions of Adobe Flash Player released before today's patch are vulnerable to the...

Emergency Adobe Flash Update Handles Zero Day Under Attack

Adobe rushed out an unscheduled Flash Player update today to counter exploits of a zero-day vulnerability in the software. A number of national security, foreign policy and public policy websites are hosting exploits that redirect to espionage malware, including the Peter G. Peterson Institute fo...

Microsoft Ships IE 10 Zero Day Fix-It Tool

Microsoft last night released a Fix-It tool as a temporary mitigation for a zero-day vulnerability in Internet Explorer 10 being exploited by two hacker groups against the Veterans of Foreign Wars in the U.S. as well as a French aerospace manufacturer. IE 9 also contains the same use-after free...

Second Group Seen Using IE 10 Zero Day

There are at least two different groups running attacks exploiting the recently published zero day vulnerability in Internet Explorer 10, and researchers say one of the groups used the bug to impersonate a French aerospace manufacturer and compromise victims visiting the spoofed Web page. The...

CVE-2014-0322: Internet Explorer zero-day exploit targets US Military Intelligence

Hackers are using a zero day vulnerability in Microsoft's Internet Explorer IE web browser and targeting US military personnels in an active attack campaign, dubbed as 'Operation Snowman'. FireEye Researchers have discovered that a U.S. veterans website was compromised to serve a zero day exploit...

New IE Zero Day Found Targeting Military Intelligence

Attackers were able to compromise the U.S. Veterans of Foreign Wars’ website this week and serve up a previously unknown zero day exploit in Internet Explorer 10, and while motivation behind the campaign is still unclear, experts are speculating its aim was to procure military intelligence...

New APT Campaign Dubbed The Mask Called Most Sophisticated Seen to Date

PUNTA CANA–A group of high-level, nation-state attackers has been targeting government agencies, embassies, diplomatic offices and energy companies with a cyber-espionage campaign for more than five years that researchers say is the most sophisticated APT operation they’ve seen to date. The attac...