Ryan Naraine

Exploit code for a third, unpatched vulnerability in Microsoft Word has been posted on the Internet, adding to the software makers struggles to keep up with gaping holes in its popular word processing program. The attack code, available at Milw0rm.com, contains sample Word documents that have been rigged to launch code execution exploits when the […]

A “sophisticated computer hacker” has broken into a restricted UCLA campus database containing personal information about current and some former students, faculty, and staff, the university confirmed in an e-mail to those affected.

Microsofts use of code-scrambling diversity to secure Windows Vista is getting crucial support from OEM partners. The Redmond, Wash. software giant has convinced major U.S. computer makers—including Dell, Gateway and Hewlett-Packard—to make default changes at the BIOS level to allow a new Vista security feature called ASLR (Address Space Layout Randomization) to work properly. ASLR, […]

Microsofts security response center has confirmed that a second zero-day vulnerability in its Word software program is being targeted by unknown attackers. The latest flaw comes just days after the software maker issued a security advisory to warn customers against opening Word documents from untrusted sources. The two vulnerabilities are entirely unrelated. The flaws were […]

UPDATE: More than 48 hours after the confirmation of active exploits of a zero-day vulnerability in Microsoft Word, anti-virus protection remains largely nonexistent — even through Microsoft’s own Windows Live OneCare security product.

Microsoft on Dec. 5 warned that an unpatched vulnerability in its Word software program is being used in targeted, zero-day attacks. A security advisory from the Redmond, Wash., company said the flaw can be exploited if a user simply opens a rigged Word document. Affected software versions include Microsoft Word 2000, Microsoft Word 2002, Microsoft […]

UPDATE: Microsoft’s official RSS blog was temporarily defaced today with a semi-edited image of Goatse, a well-known Internet shock meme.

The OnSecurity podcast this week is an interview I did with hackmeister Dave Aitel of @stake/Immunity/DailyDave fame. We talk about Halvar Flake’s claim that Windows Vista is the death knell for client-side vulnerabilities; new penetration testing tools and techniques; his unique take on the vulnerability disclosure debate; and Silica, a handheld PDA that doubles as […]

Links du jour: An assortment of security stories floating around blogland that you should be reading…

Identity thieves are manipulating a feature in Apple Computers embedded QuickTime player to launch phishing attacks on the popular MySpace.com social networking portal. According to a warning by San Diego-based Websense Security Labs, a fast-spreading worm is exploiting the JavaScript support in QuickTime and targeting a MySpace vulnerability to lure users to phishing sites. The […]

UPDATED: EveryDNS, a company that offers free domain name management services, has been hit by a massive DDoS (distributed denial-of-service attack) that affected thousands of sites, including OpenDNS (a sibling startup that runs the PhishTank anti-phishing initiative).

Outgoing Gartner analyst Amrit Williams is leaving with a bang, boldly declaring that stand-alone, signature-based anti-virus is dead.