Larry Loeb

This has been a fairly slow week for security issues, probably because all the l33t hax0rs took off to go to the beach for one last chance to ogle underdressed girls. I can just imagine the pickup lines: “Hey n00b, Id like to escalate my privileges with you!” What this means for this here column […]

Cisco has had a summer just chock-full of security problems in many of its products. Keeping up the tradition of the “annus horribilis,” the company just this week had to reveal a problem in one of its core products that the French Security Incidence Response Team has labeled as “critical.” The problem is with Ciscos […]

Julio Cesar Fort of Recife, PE, Brazil, found an undocumented feature in QNX (that Real Time Operating System for the PC platform that is so beloved of the embedded systems folk it was even used by NASA to safeguard the shuttle Discovery on its return to space) that he wants to share it with all […]

In the aftermath of Hurricane Katrina, T-Mobile USA Inc. said it will offer its Wi-Fi services without charge to the general public of the tri-state area, including Louisiana, Mississippi and Alabama. T-Mobile said that the services will be free until the end of the week, and possibly beyond that if the situation warrants it. T-Mobile […]

The Hardened-PHP Project of Germany is at it again. They found a bug in XML-RPC for PHP and PEAR XML_RPC. The project was looking for these kinds of problems in the libraries in a security audit they conducted because of previous flaws that had been found in these same PHP libraries earlier in the year. […]

Acrobat Stumbles Adobe announced that the core application plug-in for Acrobat and Acrobat Reader had this teensy, tiny, small problem in that if a “specially crafted” PDF file is read, arbitrary code could be executed due to a buffer overflow caused by an unspecified boundary error. So, just by reading a PDF file, a Windows, […]

As was to be expected once the software got out of the lab, OS X for Intel has been hacked to make it run on generic Intel platforms, not just the Apple-approved Developer Transition Kit machines. This is, at this stage, less of an event than it appears at first blush. Getting around the TPM […]

I guess we should be careful what we wish for. After musing yesterday how close Zotob was to a ZeroDay event (in the wild with no patch available), it seems we have a real ZD exploit out today. It needs Microsoft Internet Explorer and MSDDS.DLL (a component installed by Visual Studio .net and other apps) […]

It may be just schadenfreude, but nothing makes me chuckle more than seeing media outlets get nailed by Windows malware. The sense of barely suppressed outrage that CNN talent exhibited on air over the fact that their systems were attacked by Zotob (and the variants) was a hoot. (ABC and The New York Times were […]

Power to the People The energy bill signed into law last week by President Bush has some large security implications for power companies. The feds will be able, according to the law, to enforce some new (and more stringent) security standards developed by NERC (the North American Electric Reliability Council) based in Princeton, N.J. NERC […]

Cisco, those folks that make professional-style routers so beloved by Internet types, beat up a fellow trying to share some research (done while he was employed by Internet Security Systems) at the recent Black Hat security conference in Las Vegas. Cisco filed a request on July 27 for a temporary restraining order in the U.S. […]

How a computer interfaces with the outside world is always a defining characteristic. One of the main differences between early PCs and early Macs was that the PC had two serial ports called COM1 and COM2 and a parallel port for the printer, while the Mac had a 9pin serial port for the printer and […]