Five steps to successful and cost-effective penetration testing

Tuesday, May 27th, 2008

Whether you hire outside consultants or do the testing yourself, here are some tips for making sure your time and money are well spent. 1. Set goals. Make sure you know before you start your penetration testing what you want the results to encompass. Adding in too many systems can be ...

Vista’s UAC spots rootkits

Saturday, May 24th, 2008

Love or hate its nagging prompts, Vista's Account Control feature (UAC) has a security feature that marks it out from any other type of Windows security programme -- it can spot rootkits before they install. This is one finding buried in a report published in two German computer ...

Critical holes in Trillian Instant Messenger

Thursday, May 22nd, 2008

Security service Zero Day Initiative (ZDI) has found three critical vulnerabilities that allow attackers to infect the computers of Trillian Instant Messenger users with malicious code. The vendor has responded by releasing an update to close the holes. When processing XML through functions of the talk.dll dynamic link library, malformed ...

HTTP Proxies Bypass Firewalls

Tuesday, May 20th, 2008

This may seem painfully obvious to some people, but I looked around and couldn’t find a reference to it, so I apologize ahead of time for anyone who already knew this. When we normally think of how attackers use proxies they are almost always just trying to hide their IP ...

Permanent Denial-of-Service Attack Sabotages Hardware

Tuesday, May 20th, 2008

You don’t have to take an ax to a piece of hardware to perform a so-called permanent denial-of-service (PDOS) attack. A researcher this week will demonstrate a PDOS attack that can take place remotely. A PDOS attack damages a system so badly that it requires replacement or reinstallation of hardware. Unlike ...