February 5, 2010 - Dion Blazakis provided me with a formal paper on the techniques he revealed yesterday to bypass ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) in Windows. (continue reading...) Read more
February 4, 2010 - New attack techniques have proven capable of penetrating the state of the art in Windows systemic defenses, specifically DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization). A demonstration was made (continue reading...) Read more
February 4, 2010 - Microsoft has released their advance notification for the February, 2010 Patch Tuesday, and it's a doozy. An unlucky 13 updates to Windows and Office will be released addressing 26 vulnerabilities. 11 of (continue reading...) Read more
February 3, 2010 - Microsoft has disclosed a vulnerability in Internet Explorer that can allow an attacker to cause local files on the system to be displayed as HTML. Technically, all versions of IE are affected, (continue reading...) Read more
February 2, 2010 - 5 critical flaws in the OS software for the iPhone and iPod Touch have been fixed in the just-released iPhone OS 3.1.3 for those devices. CoreAudio (CVE-2010-0036)—Due to a buffer overflow, playing (continue reading...) Read more
February 2, 2010 - A mysterious flood of SSL packets from the Pushdo botnet, possibly an attempted DDOS attack, is not succeeding, according to the Internet Storm Center. None of the attacked sites are experiencing (continue reading...) Read more
January 30, 2010 - 49 web sites of members of the US House of Representatives were hacked following the State of the Union address recently. The defacement contained a vulgar insult and a claim of (continue reading...) Read more
January 30, 2010 - Google has announced a number of security enhancements that are being implemented in Chrome. Some have already been implemented in other browsers, including Firefox and IE and in significant add-ons like (continue reading...) Read more
January 27, 2010 - The Tools-Internet Options dialog box in Internet Explorer has a wealth of important settings in it, some which affect the system outside of Internet Explorer. This dialog box is also available as (continue reading...) Read more
January 27, 2010 - A report in Computerworld describes how an unpatched vulnerability in Internet Explorer could allow an attacker to read arbitrary files on the user's computer. Jorge Luis Alvarez Medina, a security consultant with (continue reading...) Read more
January 25, 2010 - Inspired by Jack Schofield (by way of Ed Bott on Twitter), I opened up Process Explorer on my own system to examine the DEP status of programs running on my (continue reading...) Read more
January 21, 2010 - Web site defacements have been in the news lately and site owners are blaming their vendors. The first one came on January 12 when Baidu, the top search engine in China (especially if (continue reading...) Read more
January 20, 2010 - Microsoft has announced that tomorrow, Thursday January 21, they will release an out-of-band update to Windows and Internet Explorer to fix the vulnerability that was exploited in the infamous Aurora attacks. (continue reading...) Read more
January 17, 2010 - I've written it many times before: Nobody is more generous with (continue reading...) Read more
January 12, 2010 - It's an eventful day. Just as they release an important new version of Acrobat, Adobe has also revealed that "...a sophisticated, coordinated attack..." was mounted "...against corporate network systems managed by (continue reading...) Read more
January 12, 2010 - Adobe has released versions 8.2 and 9.3 of Acrobat and Reader, making significant new security changes in all variations. Windows, Mac and UNIX versions are all available. We haven't yet seen any blog (continue reading...) Read more
January 12, 2010 - A vulnerability in the Windows Embedded OpenType Font Engine could lead to remote code execution as explained in MS10-001: Vulnerability in the Embedded OpenType Font Engine Could Allow Remote Code Execution, (continue reading...) Read more
January 5, 2010 - I haven't made any hard predictions for 2010 yet, but it could be the first year of Internationalized Domain (continue reading...) Read more
January 4, 2010 - Symantec has revealed a bug in SEPM (Symantec Endpoint Protection Manager) that prevents new updates to AV/AS/IPS definitions. All such updates dated after December 31, 2009, 11:59 P.M. (continue reading...) Read more
January 3, 2010 - Since the death of Milw0rm, The Exploit Database has been one of the hotter spots for researcher and malcoders to find the latest exploit code. Their latest post takes a (continue reading...) Read more