Malware

John Bambenek had a great post over at the ISC a few days ago about the importance of patching and mitigating against “passive exploits” (i.e. Man in the Middle attacks, KARMA, Airpwn, etc). John certainly raises some very good points, and I agree with him whole heartedly. As security professionals, we need to remain vigilant […]

If you are wondering just how easy it is to exploit the latest VNC vulnerability, check out this flash demo put together by Larry: VNC Exploit in Action Cheers, .com

The trojans are definitely coming. As many have probably noticed security researchers found a flaw in OS X that allows attackers to execute arbitrary code. The most popular way is to use Safari and take advantage of the “Open safe files after downloading” feature. The best write-up is from the SANS ISC: Serious flaw on […]

Well, we are certainly starting off the new year in an exciting and scary way. In case you haven’t come out from under your rock, there is a new zero day exploit in the wild that affects all versions of windows. Frsirt is lists two different exploits on their site. You can find them here […]

Just getting back into the swing of things and reading all I can about the WMF vulnerability and exploits. I’ve summarized everything (I think) we know so far, if I’m missing anything please drop me a note (paul /at/ securityweekly.com): Update – 01/06/2006 – Added the official patch section, corrected the IDS statements, added the […]

“Security researchers have published a zero-day exploit for Internet Explorer this week that allows remote code execution on most variants of Windows. The vulnerability targeted by the exploit was originally announced in May as a stability issue resulting in the browser closing. “ So, a DoS vulnerability that turns out to be a remote exploit. […]

“Infocon has been raised to Yellow due to the exploit being publicly available, combined with the lack of a patch for this specific vulnerability. Disable Javascript in your Internet Explorer browsers, or switch to another browser.” We started Episode 3 of Security Weekly with some good ‘ole fashioned IE bashing. While we may joke about […]