Ryan Naraine

[[ UPDATE: Here are the slides from Cerrudo’s HiTB talk (.pdf) that prompted Microsoft’s advisory. At the company’s request, Cerrudo has opted not to release exploit code. ]] Last month, when I wrote about hacker Cesar Cerrudo’s (left) plans to punch holes in the security model of Microsoft’s brand-new Windows Server 2008, Redmond officials pinged […]

A serious security flaw in the Cisco NAC (Network Admission Control) appliance can allow an attacker to obtain the shared secret that is used between the two internal components, according to a warning from the network and switching vendor. The vulnerability, which carries a CVSS base score of 10.0 (the highest possible severity rating), could […]

Apple has made a small but significant tweak to its Automatic Software Update utility to make a clear distinction between security patches and new products being pushed out to Windows users. The UI redesign, which adds a new box labeled New Software, follows intense criticism of Apple’s recent decision to bundle its new Safari for […]

Hackers have posted attack code for what appears to be a zero-day vulnerability in Microsoft Works, the productivity software suite aimed at small businesses and home offices. The basic details, via McAfee analyst Kevin Beets: “The flaw lies in an ActiveX component of Microsoft Works Image Server (WkImgSrv.dll). Yes, it appears successful exploitation would allow […]

PayPal, one of the brands most spoofed in phishing attacks, is working on a plan to block its users from making transactions from Web browsers that don’t provide anti-phishing protection. The eBay-owned company, which runs a Web-based payment system that allows the transfer of funds between bank accounts and credit cards, said browsers that do […]

It’s Patch Day in the land of Web browsers. In separate warnings, Apple and Mozilla confirmed — and fixed — critical vulnerabilities affecting users of the Safari and Mozilla browsers. The Apple Safari patch (available for Windows and Mac OS X), provides cover for at least four vulnerabilities (including Charlie Miller’s winning CanSecWest contest exploit). […]

Apple has slapped a Band-Aid on its Safari for Windows browser to cover four vulnerabilities that could lead to code execution, cross-site scripting and URL spoofing attacks.The Safari 3.1.1 update includes a patch for the flaw the allowed the hijack of a MacBook Air laptop at this year’s CanSecWest “PWN to OWN” security contest.According to […]

OpenDNS has added a new filtering option to its free DNS service to help protect against poisonous DNS rebinding attacks. The new feature, which is turned “OFF” by default, is available to OpenDNS account holders to help filter out suspicious responses that contain data that might be malicious or otherwise unwanted. When enabled, the new […]

Less than a week after the release of patches for a pair of code execution flaws in Microsoft’s Windows graphics device interface, malicious hackers are firing in-the-wild exploits against those vulnerabilities.According to virus hunters tracking malicious Internet activity, a booby-trapped file named TOP.JPG is in circulation, exploiting one of the vulnerabilities described in Microsoft’s MS08-001 […]

Database server giant Oracle plans to ship a major security update on Tuesday, April 15 to cover more than 40 vulnerabilities in a wide range of products.The fixes are part of the company’s quarterly CPU (critical patch update) and will cover severe vulnerabilities across hundreds of Oracle products. According to Oracle’s advance notice, 17 of […]

Adobe Systems has released a major Flash Player update to fix at least seven cross-platform vulnerabilities that put users at risk of PC takeover attacks. One of the vulnerabilities covered in the APSB08-11 update was used to hijack a Windows Vista laptop at the CanSecWest “Pwn to own” hacking contest March 26-28. The update is […]

SAN FRANCISCO-Microsoft plans to make a key Internet Explorer default change to thwart attackers trying to hack into its Web browser. The software maker will enable DEP/NX (Data Execution Prevention/No Execute) by default in IE 8 when the browser is running on Windows Vista and Windows Server 2008, a major tweak aimed at mitigating browser-based […]