‘Long-Term’ Phishing Attack Underway

Monday, April 28th, 2008

The notorious Rock Phish gang has added a new twist to its phishing exploits that doesn’t require its victim to visit a malicious Website -- instead, it just loads a malicious keylogging Trojan onto the victim’s machine that steals information or credentials. Both Trend Microand F-Secure over the past few days ...

YubiKey – One-time Password and Authentication Device

Saturday, April 26th, 2008

It works seamlessly with any hardware and operating system combination supporting USB keyboards such as Windows, MacOS, Linux and others. The Key generates and sends unique time-variant authentication codes by emulating keystrokes through the standard keyboard interface. The computer to which the Key is attached receives this authentication code character ...

WordPress 2.5 Cookie Forging Explained

Saturday, April 26th, 2008

WordPress 2.5.1 came out recently. It includes a critical security fix for a cookie integrity bug that would allow an attacker to impersonate other users, including WordPress admins, by manipulating the contents of an HTTP cookie. Whenever I read about a vulnerability predicated on the user identity being embedded ...

Linux: Windows Made Hard

Monday, April 21st, 2008

For the past few months, we've shown how Linux has emerged from its early murky reputation of being cool to have but impractical to use. And there's no question it's refreshing to use an entire desktop system with nary a Microsoft or Apple product. But as some of our readers ...

Deciphering the PHP-Nuke Captcha

Monday, April 21st, 2008

The Captcha used in the current version 8.1 of PHP Nuke can be deciphered with 100% accuracy. more information can be found here: http://www.rooksecurity.com/blog/?p=6 Exploit Code: http://www.rooksecurity.com/exploits/php_nuke_captcha.zip What is so interesting about this captcha is that it is incredibly wide spread. Variants of this captcha are being used by big names like Paypal. ...