Larry Seltzer

A new release of the Windows version of the Skype VOIP program fixes a bug that could allow a remote attacker to compromise a Skype users computer. The new version, 1.0.0.100, can be downloaded from the Skype Web site. An advisory from Secunia based on the bug report from Skype calls the bug “highly critical.” […]

Sometimes I just cant believe peoples lack of perspective, and the best current example is the resistance to adopting Windows XP Service Pack 2. For a very long, long time now, long before SP2 was released, its been known that as a direct result of solving security problems in Windows it would cause application problems. […]

Sobig hit the world on Aug. 18, 2003, and was an immediate success. The sixth variant, Sobig.F, may have been the most successful endemic mass-mailer worm. Estimates of the damages it caused were in the tens of millions of dollars, and the reward posted for the author was similarly fat. Anonymous authors have released a […]

Anti-virus companies are reporting a worm that spreads via a new vulnerability in Internet Explorer. The vulnerability is not present in Windows XP Service Pack 2, but in all earlier versions of Internet Explorer 6, and no patch is available. It involves a buffer overflow triggered by an IFRAME or EMBED tag, which has an […]

Microsoft has issued a patch for a flaw in ISA (Internet Security and Acceleration) Server 2000 and Proxy Server 2.0. According to the advisory on the bug, it could allow an attacker to spoof trusted Internet content. Microsoft Small Business Server 2000 and 2003, both of which include ISA Server, are also affected. If a […]

One year after a vulnerability in the Wi-Fi Protected Access encryption algorithm was reported, a proof-of-concept program for the attack has been released. The attack affects only Wi-Fi networks using WPA in pre-shared key mode. It is a dictionary attack, meaning that it cycles through a list of words and combinations of words attempting to […]

A new phishing attack is utilizing a vulnerability in Internet Explorer, patched early this year, to hide its true source. /zimages/2/28571.gifA serious hole in IE opens PCs up for attacks. Click here to read more. The attack, called Citifraud.A by Panda Software, takes the form of a Web page or HTML e-mail. It has no […]

Many assume that malware programmers are good programmers, and this isnt hard to understand. Its sort of like being impressed with a magician who does something that shouldnt be possible. But its also like assuming that bullies must be good fighters. Closer analysis shows that many of them dont—or perhaps cant—do their job well. Malware […]

In its first use of a new policy on security-update disclosure, Microsoft on Wednesday announced that next weeks scheduled security updates for the month of November will consist of a single fix for ISA Server. The new Microsoft Security Bulletin Advance Notification is the first example of a new monthly practice the company announced Thursday. […]

Its easy for administrators and computing professionals to get frustrated with users for all kinds of reasons, but security has to be one of the biggest reasons these days. Lets consider the recent release of a malicious script for Mac OS X. This script itself is not really much of a threat because it has […]

A series of HTML-based exploits allow a malicious HTML programmer to direct a user to a different Web site than the one indicated in the users browser status line. Two separate but similar issues affect Internet Explorer. The first, reported by Benjamin Franz of Germany on the Bugtraq mailing list, involves an improper mixture of […]

Its only a little over a month since the collapse of the MARID working group and the apparent death of the Sender ID specification on which it had focused. But now, from the secret workings of Microsoft and Meng Wong (playing here the role of Victor von Frankenstein), a stitched-up version of the spec has […]