Lisa Vaas

McAfee Avert Labs has uncovered a new zero-day in Yahoo Messenger Webcam and are warning people not to accept invites from people they dont trust until a patch is out. Avert Labs is calling this a “classic heap overflow” that can be triggered when a victim accepts a webcam invitation. The issue was first discovered […]

First there was Atsiv, the kernel driver that served as a welcome mat for unsigned and potentially malicious drivers to load into Vista and other Microsoft operating systems. Then came the ATI driver that could allow arbitrary memory writes to the Vista kernel—a vulnerability that has been introduced to potentially millions of laptops, given that […]

The Ubuntu community had to yank five of the eight Ubuntu-hosted community servers sponsored by Canonical offline Aug. 6 after discovering that the servers had been hijacked and were attacking other machines. It was suggested during an IRC (Internet relay chat) meeting of the Ubuntu colocation team Aug. 14 that the source of the troubles […]

Microsoft is working with AMD to fix a bug in an ATI driver that ships preinstalled on millions of laptops and which leaves the Vista kernel open to arbitrary memory writes by malicious driver authors. Its not just ATI—virtualization security researcher Joanna Rutkowska said during her presentation at Black Hat earlier in August that ATI, […]

Patch Tuesday brings with it a host of security issues with Vista, issues with virtualization and a fun time for system administrators who deal with clients using some wildly popular Microsoft applications: Internet Explorer and Excel. On Aug. 14, Microsoft released nine security patches for 14 vulnerabilities, with six of the updates rated critical, in […]

Social networking site Facebook on Aug. 12 exposed part of its source code. The code was then posted onto a newly created blog named Facebook Secrets, and Facebook is now telling people not to use it. Facebook, based in Palo Alto, Calif., issued a statement about the incident, stressing its minimal impact. “A small fraction […]

On July 5, Transportation Security Administration airport screeners found a bag with two ice packs inside. The ice packs had clay inside them, rather than blue gel, were covered in tape and matched a description of materials on a TSA bulletin warning of dry runs for terrorist attacks. According to news reports, the 66-year-old grandmother […]

Microsofts August Patch Tuesday will bring nine security bulletins to fix problems—six of which are rated “critical”—in Microsoft Windows and Office, according to Christopher Budd of the MSRC (Microsoft Security Response Center) on Aug. 9. The six bulletins that will affect Windows will require a restart and can be detected using Microsofts Baseline Security Analyzer […]

The largest spam attack ever tracked wound down Aug. 9 after delivering enough big, fat PDF files to increase total spam size 445 percent in one day, according to Postini, a hosted e-mail filtering company thats been tracking the attack since it started Aug. 7. Postini tracked a 53 percent jump in spam volume from […]

Carrier -Funded Report: Internet Could Choke if Lawmakers Intrude”> In a thinly veiled attempt to talk policy makers out of legislating for Net neutrality, an AT&T-backed report suggests that the net managers who have kept the machine growing all these years have innovated, know best how to keep innovating, and should be left alone to […]

LAS VEGAS—Immunity, a company already well-known for making pen testing easy, demoed a new tool that will make writing exploits near-automatic. Immunity released the tool, called Debugger, here at the Defcon hackers convention on Aug. 3. Debugger is free for download, with its revenue being driven by paid ads from companies looking to hire the […]

The Good, the Bad, the Net Neutrality Detector”> LAS VEGAS—A creaky old DNS rebinding design flaw has been dragged out of the Internets attic, had the dust blown off and shown to be freshly poisonous. As Dan Kaminsky, IOActives director of penetration testing showed at the Black Hat conference Aug. 1, all he needs to […]