Saturday, May 10th, 2008
Security researchers have developed a new type of malicious rootkit software that hides itself in an obscure part of a computer's microprocessor, hidden from current antivirus products.
Called a System Management Mode (SMM) rootkit, the software runs in a protected part of a computer's memory that can be locked and rendered ...
Posted in Hardware, Internet, Privacy, Security | No Comments
Thursday, May 8th, 2008
It takes the average attacker less than 10 seconds to hack in and out of a database -- hardly enough time for the database administrator even notice the intruder. So it’s no surprise that many database attacks go unnoticed by organizations until long after the data has been compromised.
And surprisingly, ...
Posted in Internet, Security | No Comments
Wednesday, May 7th, 2008
Since version 4.2.0 PHP automatically seeds the random number generators on the first usage of rand() and mt_rand(). This is done with the help of the GENERATE_SEED() macro.
Unfortunately it was discovered that the GENERATE_SEED() macro contains several problems that can lead to a weaker seed than expected. In the worst ...
Posted in Coding, PHP, Security | No Comments
Monday, May 5th, 2008
Researchers have discovered a new, complex spam attack that uses a sophisticated ruse to fool users into downloading malware.
The exploit, which researchers at BitDefender call "a spam-sending scheme of Byzantine complexity," features spam messages that claim to contain links to videos. When users try to click and see the video, ...
Posted in Internet, Privacy, Security | No Comments
Monday, May 5th, 2008
Nowadays, who understands Di-Di-Di-Da-Da-Da-Di-Di-Dit (S.O.S., Save Our Souls)? Few people do, but your web browser just might. In his blog, security expert Nathan McFeters has reported the discovery of a cross-site scripting (XSS) vulnerability on an Italian website that allows attackers to inject malicious JavaScript encoded in Morse code in ...
Posted in Coding, Internet, Privacy, Security | No Comments
Thursday, May 1st, 2008
The fundamental problem with two factor (2FA) session authentication is that the approach is vulnerable to Man in the Middle and Man in the Browser attacks. 2FA requires that customers present not only a password (something they know) when they log into online banking, but also demonstrate that they possess ...
Posted in Internet, Privacy, Security | No Comments
Thursday, May 1st, 2008
I am pretty sure that there are a number of you out there reading this blog over a wireless network. Given that wireless is so widely distributed these days, its not uncommon that users are unaware of how insecure their wireless setup maybe.
Unfortunately one other reality is that a number ...
Posted in Hardware, Internet, Privacy, Security, Software | No Comments
Monday, April 28th, 2008
Wireless networking technologies are a rich playground for hackers -- both ethical penetration testers and malicious attackers. There are many avenues of attack, ranging from attacking the infrastructure, the clients, or the actual traffic through man-in-the-middle sniffing and manipulation. Rich Mogull covered the wireless “Evil Twin” attack in his recent ...
Posted in Hardware, Internet, Networking, Privacy, Security | No Comments
Monday, April 28th, 2008
Microsoft has provided security advice to web developers using its products after many such sites were compromised. Last week, hundreds of thousands of web pages were infected with a malicious iframe which tries to infect visitors with a trojan. Many high profile sites including the United Nations (un.org), the UK ...
Posted in Internet, Security | No Comments
Sunday, April 27th, 2008
Many people are switching from Internet Explorer to alternative browsers such as Firefox and Safari. Though that might make them feel more secure, the shift has also opened new doors for bad guys.
Case in point: We have no IE bugs to report this month, but both Firefox and Safari have ...
Posted in Internet, Linux, Security, Windows | No Comments
