Lisa Vaas

A security vendor is questioning whether the IOS FTP Server vulnerabilities Cisco reported on May 9 may constitute an intentionally planted backdoor, as opposed to a series of programming errors that inadvertently led to a backdoor. Chris Eng, director of security services at Veracode, is suggesting that possibility given that a remote attacker would need […]

The U.S. Computer Emergency Response Team is reporting a network evasion technique that uses full-width and half-width unicode characters to allow malware to evade detection by an IPS or firewall. The vulnerability affects virtually every major firewall and intrusion prevention system available, including products from Cisco Systems. Given Ciscos major share of the market, at […]

The American Federation of Government Employees is suing the Transportation Security Administration after the TSA lost a hard drive containing employment records for some 100,000 individuals. The union represents employees throughout the Department of Homeland Security, including the TSA. Its class action lawsuit, filed within a day of the TSA announcing the missing hard drive, […]

Microsoft once again invited hackers to its home and laid out its wares to be stomped on in its fifth Blue Hat security conference, which ran May 9-10. The Blue Hat conferences are meant to get Microsoft executives and engineers from across the company to sit down with the members of the security research community […]

More than a month after Microsoft patched the .ANI vulnerability, the geek favorite e-tailer Toms Hardware has found the W32.ani Trojan lurking in one of its banner ads. ScanSafe, a managed Web security services company, on May 8 noticed a spike in traffic blocks that had a common theme. The company found that Tomshardware.com was […]

Apple has updated its open-source Darwin Streaming Server to fix two critical security holes that can allow a remote attacker to hijack the server. Darwin is an open-source version of Apple’s QuickTime Streaming Server that enables users to send streaming media to clients across the Internet using the industry standard RTP and RTSP protocols. It’s […]

At least one Trojan virus writer is now using an integral part of the Windows operating system—BITS (Background Intelligent Transfer Service)—to download files to already infected systems. Windows Update uses BITS as an asynchronous download service to fetch patches, updates and other files—and, in this instance, malware. Security researcher Frank Boldewin, along with Symantecs Elia […]

Would you trust eBay to keep your name, address and taxpayer identification number safe? What about uBid.com, or what about an obscure online broker youve never heard of? The Center for Democracy and Technology is raising a red flag over the prospect after language appeared in the President Bushs budget that would require brokers of […]

A year ago at JavaOne, Fortify Software Founder and Chief Scientist Brian Chess gave a presentation titled “12 Java Technology Security Traps and How to Avoid Them.” A year later, how far have we come in addressing those inherent vulnerabilities, which include XSS (cross-site scripting), SQL injection and native methods that allow the import of […]

TJX: Its the target of the largest known customer record theft of all time, and its a case in point that encryption is not a silver bullet. This is the heart of the encryption problem, quoted from the 10-K filing The TJX Companies made to the Securities and Exchange Commission: “Despite our masking and encryption […]

Microsoft has released patches for 19 vulnerabilities, 14 of which are critical, hitting at holes in Excel, Word, Office, Exchange, Internet Explorer, cryptographic technology and the whopper of them all, the zero-day vulnerability in the DNS Servers use of RPC. Michael Sutton, a security evangelist for Atlanta-based SPI Dynamics, said the “pretty high percentage” of […]

A hard drive containing 100,000 employee records has been lost or stolen from the Transportation Security Administration, the agency announced on May 7. The TSA discovered that the hard drive was missing last week, on May 3. It contained records of people employed at the agency between January 2002 and August 2005. The records included […]