Ryan Naraine

What started as an amusing eBay listing of an Excel vulnerability for sale has developed into an all-out hacker assault on Microsoft Office applications. Security researchers and malicious hackers have zeroed in on the desktop productivity suite, using specialized “fuzzing” tools to find a wide range of critical vulnerabilities in Word, Excel and PowerPoint file […]

The first wave of malicious attacks against the MS06-040 vulnerability is underway, using malware that hijacks unpatched Windows machines for use in IRC-controlled botnets. The attacks, which started late Aug. 12, use a variant of a backdoor Trojan that installs itself on a system, modifies security settings, connects to a remote IRC (Internet Relay Chat) […]

A network worm attack exploiting a critical Microsoft Windows vulnerability appears inevitable, security experts warned Aug. 10. Just days after the Redmond, Wash., software maker issued the MS06-040 bulletin with patches for a “critical” Server Service flaw, Microsofts security response unit is bracing for the worst after exploit code that offers a blueprint for attacks […]

Less than 24 hours after Microsoft shipped a dozen bulletins with security fixes for 23 serious software vulnerabilities, the U.S. governments Department of Homeland Security issued a firm notice to Windows users: immediately apply the patches in the MS06-040 bulletin. In a somewhat unusual move, the DHS warned that the patches cover a remote code […]

AOL on Aug. 7 blamed an internal “screw-up” for the embarrassing release of detailed keyword search data for roughly 658,000 anonymized users. Dulles, Va.-based AOLs mea culpa comes in the midst of a firestorm of criticism from privacy advocates that the information—which amounts to about 20 million search queries—could be traced back to AOL users. […]

LAS VEGAS—Remember the LSD—or Last Stage of Delirium—hacking group? Back in 2003, the group of four Polish security researchers discovered the RPC (Remote Procedure Call) interface vulnerability that would later be used to unleash the Blaster worm, but because of distrust over Microsofts willingness to address software flaws at the time, LSD members had to […]

LAS VEGAS—Ben Fathi slipped into the darkened, standing-room-only conference room and took a seat on the carpeted floor. On the Black Hat stage, malware researcher Joanna Rutkowska, of COSEINC, was discussing a new technique that could plant an offensive rootkit in Windows Vista, Microsofts “most secure ever” operating system. As corporate vice president for Microsofts […]

LAS VEGAS— Michael Lynn, the security researcher who provoked a firestorm of controversy at the 2005 Black Hat conference, just wants to fly under the radar this year. Lynn, who quit his job at Atlanta-based Internet Security Systems to discuss a serious flaw in Cisco IOS (Internetwork Operating System), was spotted attending sessions and gabbing […]

LAS VEGAS—Wi-Fi-enabled computers are sitting ducks for code execution attacks because of gaping flaws in wireless drivers shipped on both Mac and Windows systems, security researchers warned at the Black Hat Briefings security conference here. A pair of hackers—David Maynor and Jon Ellch—demonstrated such a break-in on an Apple MacBook laptop fitted with a wireless […]

Microsoft plans to issue a dozen security bulletins on August 8 to cover a wide range of security vulnerabilities affecting Windows and Office users. The Redmond, Wash., software maker said that 10 of the 12 bulletins will contain patches for bugs in its flagship Windows operating system. Some of those will be rated “critical,” Microsofts […]

LAS VEGAS—The FBIs point man for Internet crime wants hackers to join the fight against international gangs of Web mobsters. Dan Larkin, unit chief of the FBIs Internet Crime Complaint Center, used the spotlight of the Black Hat security conference here to call for a new level of trust and cooperation between security researchers and […]

A code execution vulnerability in software products sold by Internet security vendor McAfee could put millions at risk of computer takeover attacks, according to a warning from eEye Digital Security. The flaw affects fully patched versions of all McAfee consumer security products, including the companys flagship McAfee Internet Security Suite 2006. eEye Chief Hacking Officer […]