Installation of IIS malware through ColdFusion flaw

Attackers used an authentication bypass vulnerability in Adobe's ColdFusion software as a stepping stone in an attack that infected web servers with malware. Additional details about the attack emerged in recent days as researchers from Trustwave's SpiderLabs continued to dig into reports of malware disguised as modules for Microsoft's Internet Information Services (IIS) software. According to Trustwave, the malware - which they have dubbed ISN - is designed to steal data and targets information in POST requests. The vulnerability the attackers used was CVE-2013-0629, which Adobe actually patched back in January. "It is important to also highlight the criticality of having an expedited patching life-cycle," Trustwave's Ryan Barnett blogged, noting that in one incident, the targeted organizations was compromised less than two months after Adobe disclosed the vulnerability. <more>

IE exploit used in operation Aurora still in action

Regular software patching is often touted as one of the best things you can do to keep your computer safe against malware infection. Unfortunately, not all users follow that advice, and that realisation often demoralises IT security professionals. Cyber attackers are, on the other hand, overjoyed that some users don't even know what software patching means and entails, because this allows them to recycle old exploits and still succeed in their attacks. Zscaler's Pradeep Kulkarni has recently unearthed an attack taking advantage of the Internet Explorer zero-day vulnerability that has been exploited in the infamous Aurora attacks against Google and many other big Internet, finance, technology, media and chemical companies. <more>

Microsoft December Patch Tuesday fixes 24 vulns

Microsoft on last Tuesday released fixes for critical vulnerabilities in Internet Explorer, Microsoft Office, SharePoint, and the Windows operating system, including patches for two different zero-day vulnerabilities. But it has yet to patch a zero-day vulnerability that was first spotted in late November. The fixes came as part of Microsoft's regular patch-release cycle, which this month addressed 24 different vulnerabilities, as documented in 11 Microsoft security bulletins. Five of those bulletins were rated as "critical," meaning the flaws could be exploited remotely by attackers to take full control of a vulnerable system. Multiple information security experts have recommend starting with the fix for a zero-day Microsoft Graphics component memory corruption vulnerability (CVE-2013-3906), which was first discovered in early November via in-the-wild attacks. "The vulnerability could allow a remote-code execution if a user views TIFF files in shared content," said Microsoft. Exploit code for this bug has also already been built into the open-source Metasploit penetration testing tool. <more>

Chrome OS eyes on Password-free authentication

Google has a vision for how Chrome OS users will one day be able to lock and unlock their devices, without requiring a password. The Chromium OS team is building support for unlocking and locking devices running the operating system with a new Chrome API called "chrome.screenlockPrivate." The API was first spotted by developer and Google open-source Chromium evangelist François Beaufort, who points to a Chromium code review with a very short description: "The chrome.screenlockPrivate API allows select apps to control the ChromeOS ScreenLocker." Thankfully, it also includes a Google Docs link titled "chrome.screenlockPrivate - New Chrome API Proposal." <more>

Google's Nexus phones vulnerable to SMS attacks

Google is reportedly looking into a problem with the latest versions of Nexus smartphones that could force the devices to restart, lock or fail to connect to the Internet. All Galaxy Nexus, Nexus 4 and Nexus 5 devices that run Android 4.0 contain a flaw that can render the phones vulnerable to a denial-of-service attack when a large number of Flash SMS messages are sent to them. According to a description on the programming site Stack Overflow, Flash SMS messages, also known as Class 0 SMS, are messages that show up - or flash - on screens immediately and dim the screen around the text. The messages are part of the GSM messaging infrastructure and are often used for sending emergency messages. Since the messages are not saved in phone's inboxes by default and simply appear, users can select to read or dismiss them. If a message is received on top of another however, they can stack up quickly. <more>

D-Link patches router back-door vulnerability

D-Link has released firmware patches for a number of its older routers sporting a critical authentication security bypass vulnerability discovered in October. The flaw was discovered and its exploitability proved with a PoC by Tactical Network Solutions' security researcher Craig Heffner. D-Link confirmed the existence of the problem a few weeks later. "Various D-Link routers allow administrative web actions if the HTTP request contains a specific User-Agent string. This backdoor allows an attacker to bypass password authentication and access the router's administrative web interface," D-Link explained in a security advisory. <more>

MS Windows XP is now officially declared 'less secure'

Windows XP is considerably more prone to malware infection than newer operating systems, Microsoft has said. The company has warned on the dangers of running an unsupported operating system, ahead of its April deadline for ending extended support for Windows XP SP3 next year. Microsoft found that while PCs running newer versions of Windows were just as likely as XP to come across malware, XP's chances of actually being infected were higher. Compared with Windows 8, XP's infection rate was almost six times higher. Microsoft added that XP's infection rate was 1.5 times worse than Vista and three times worse than Windows 7. The company compared PCs running Windows XP SP3, various versions of Windows Vista and Windows 7, and Windows 8 during the second quarter of this year. <more>

Firefox 25 comes with 10 security fixes

Mozilla released 10 patches for three versions of its Firefox browser on Tuesday, five of which are considered critical and could be used to remotely install malicious code. The U.S. Computer Emergency Readiness Team warned that the problems "could allow a remote attacker to execute arbitrary code, bypass intended access restrictions, cause a denial-of-service condition or obtain sensitive information." The Mozilla products affected are Firefox 25, Firefox ESR 24.1, Firefox Extended Support Release (ESR) 17.0.10, Thunderbird 24.1, Thunderbird ESR 17.0.10, and Seamonkey 2.22. Among the flaws fixed were several memory safety bugs in the browser engine, which is also in Mozilla's Thunderbird email client and Seamonkey, a suite of applications and web development tools. <more>

Google Anti DDoS Weapon - Project Shield

Google has begun testing a new distributed denial of service (DDoS) protection service, codenamed Project Shield, to help fight back against this growing cyber threat facing digital businesses. Google confirmed Project Shield is currently running on a trial basis and is open for use on an invite-only basis. "Project Shield is an initiative to expand Google's own distributed denial of service (DDoS) mitigation capabilities to protect free expression online. The service is currently invite-only. We are accepting applications from websites serving news, human rights or elections-related content." The service works using a variety of existing Google technologies, the firm explained: "Project Shield is a service that currently combines Google's DDoS mitigation technologies and Page Speed Service (PSS) to allow individuals and organisations to better protect their websites by serving their content through Google's own infrastructure, without having to move their hosting locations." <more>

Oracle Quarterly Patch Update Fixes 127 Security Bugs

Oracle has released a whopper of a critical patch update for October, with 127 security fixes across several of the company's products. Of these, 51 are fixes for Java SE, and all but one of those will allow remote exploitation of a computer without authentication. Oracle recommends the patch be applied as soon as possible, as many of the vulnerabilities cross product family lines, and its products are interdependent. However, the patch applies only to products whose licensees have premier support or extended support. 40 of the 51 Java vulnerabilities apply to client deployment of Java. Of these, one is exploitable only during the act of deploying Java clients; the rest apparently can be exploited on Java clients at other times. Eight of the Java flaws impact both client and server-side implementations. Of the remaining three, one applies to the Java Heap Analysis, and two apply to sites that run the Javadoc Tool as a Service. <more>

October's Patch Tuesday fixes IE, Word and Excel vulns

The monthly security update, which also marked the 10th anniversary of Microsoft's Patch Tuesday releases, included eight patches: four deemed "critical" and four ranked "important."  In total, the patches addressed 28 vulnerabilities in the company's products, including two zero-day flaws affecting Internet Explorer: CVE-2013-3893 and CVE-2013-3897. Security bulletin MS13-080 fixed both remote code execution bugs in IE, along with eight other privately reported bugs. <more>

vBulletin exploit in the wild

vBulletin CMS is under attack by cyber criminals which exploited the vulnerability that allows to create new administrative accounts. Back in August, users of versions in the 4.1+ and 5+ series were advised to delete the /install/ or /core/install/ directories (depending on version) as a workaround against the bug, but vBulletin didn't advise of the impact of the problem. The vulnerability allows admin account injection using vulnerable PHP code. The author of the article, Barry Shteiman of Imperva, notes that the exploit code and technique were found on hacker forums, meaning that the exploit is in the wild. <more>

Google Chrome 30 fixes 50 security bugs

Google is out with its latest Chrome stable browser release, providing one of the highest security fix counts in the history of Google's popular open source browser. The Chrome 30.0.1599.66 release, available for Windows, Mac and Linux, provides 50 security fixes. Google is paying security researchers a total of $19,000 in bug bounties for responsible disclosures about flaws that have been fixed in the new Chrome stable release. The Chrome 30 fix list is double the 25 flaws that Google fixed in the Chrome 29 stable update in August. Google paid out $6,174 in reward money for that release. <more>

Cisco IOS patched 10 DoS vulns

Cisco Systems issued 10 fixes for different flaws in its IOS software. While the manufacturer says hackers haven't been exploiting these vulnerabilities as of yet, now that the information is in the public sphere it is definitely a possibility. But detailed instructions are online from Cisco that detail fixes or workarounds for the Network Time Protocol (NTP), the Internet Key Exchange protocol, the dynamic Host Configuration Protocol (DHCP), the Resource Reservation Protocol (RSVP), the virtual fragmentation reassembly (VFR) feature for IP version 6 (IPv6), the Zone-Based Firewall (ZBFW) component, the T1/E1 driver queue and the Network Address Translation (NAT) function for Domain Name System), and Point-to-Point Tunnelling Protocol (PPTP). The patches were issued on last Wednesday as part of Cisco's ongoing program to release iOS security advisories on the fourth Wednesday of every March and September. Cisco recommends user to apply patches on earliest basis. <more>

Serious Javascript flaw in Mailbox iPhone app

Italian Researcher Michele Spagnuolo recently revealed a serious vulnerability in the popular Mailbox iPhone app. Mailbox is a tidy iOS the email app recently purchased by Dropbox, has a pretty wide-open hole that could allow bad actors to hijack your device. The flaw occurs in the latest version of Mailbox (1.6.2) currently available from the App Store, that executes any Javascript which is present in the body of HTML emails. With exploitation of this vulnerability, users could be subject to account hijacking, spam and phishing attacks by simply opening an HTML email containing embedded javascript. <more>

Microsoft releases fix for 0-day IE browser bug

A vulnerability in Microsoft Internet Explorer (IE) browser is leaving thousands of businesses open to targeted attacks. Microsoft group manager of response communications Dustin Childs revealed the threat in a security advisory, confirming that hackers are actively exploiting a weakness in the browser. "Today we released Security Advisory 2887505 regarding an issue that affects IE. There are only reports of a limited number of targeted attacks specifically directed at IE8 and 9, although the issue could potentially affect all supported versions," Childs said. "This issue could allow remote code execution if an affected system browses to a website containing malicious content directed towards the specific browser type. This would typically occur when an attacker compromises the security of trusted websites regularly frequented, or convinces someone to click on a link in an email or instant message." Since being revealed numerous security vendors have released their own advisories warning of the potential damage an attack targeting the vulnerability could do. noted the vulnerability could be used for a variety of purposes by hackers. <more>

Self-healing BIOS for HP Systems

HP has released a self-healing computing startup software that can repair a PC from a malware attack. HP BIOSphere with SureStart technology is a new kind of startup software that runs when a PC is turned on. The BIOS, basic input output software, runs on every PC and loads before even the operating system. HP has created its own BIOS software because hackers have been able to get around other BIOS software underneath the OS or gain root access to compromise OS security protections. The new HP BIOS makes it so the PC can heal itself by comparing the BIOS attempting to load against an image of the BIOS that is supposed to run on the PC. <more>

Microsoft issued 13 bulletins in September's Patch Tuesday

Microsoft has dispatched 13 patches for 47 bugs in its Windows, Office, Internet Explorer and SharePoint Server products. The Patch Tuesday release includes four critical patches, or Microsoft "bulletins," with the bug of utmost concern being a privately reported vulnerability in Microsoft Outlook. The bug could allow a remote attacker to execute code if a user merely previews a malicious email message in Outlook or opens it, a Tuesday bulletin summary said. On Tuesday, Dustin Childs, group manager of response communications for the Microsoft Trustworthy Computing team, wrote in a blog post that the patch for Outlook was the "first bulletin that caught [his] attention." <more>

Adobe patches Flash Player, Shockwave Player & Reader

Adobe released security updates for Flash Player, Adobe Reader and Shockwave Player on Tuesday to address critical vulnerabilities that could allow attackers to take control of systems running vulnerable versions of those programs. The Flash Player updates address four memory corruption vulnerabilities that can lead to arbitrary code execution. The updates are version numbers 11.8.800.168 for Windows and Mac OS X; 11.2.202.310 for Linux; 11.1.115.81 for Android 4.x; and 11.1.111.73 for Android 3.x and 2.x. The same Flash Player vulnerabilities were patched in Adobe AIR, a runtime for rich Internet applications that also bundles Flash Player. Adobe released version 3.8.0.1430 of AIR and AIR SDK (software development kit) for Windows, Mac OS X and Android. <more>

Windows 8 Picture Passwords CrackABLE

The "picture passwords" used in Windows 8 machines are more vulnerable than Microsoft hoped, a research team claims. An analysis of more than 10,000 picture passwords found that a significant percentage could be cracked - due to the predictable "points of interest" that users chose. The "gesture" passwords allow users to pick points in an image, instead of using a text-based password. People tend to choose faces, colourful points and eyeglasses, so it's often possible to "guess" such passwords, the team from Arizona State University and Delaware State University said. The team developed algorithms which could crack picture passwords with a high success rate. In a paper presented at the Usenix Conference, "On the Security of Picture Gesture Authentication," the reseearchers, computer science doctoral student Ziming Zhao and computer science master's degree student Jeong-Jin Seo, along with Hongxin Hu, now an assistant professor of at Delaware State University, found that people's choice of "gesture" password tended to follow patterns. <more>

Heartbeat is NOW your Password!!!

Our heartbeats could be used instead of traditional passwords to unlock smartphones, tablets and cars using a new device being developed by Canadian company Bionym. Passwords scrawled on a scrap of paper are easily lost, jumbled letters and numbers are quickly forgotten and, with "password" still the most popular password, it's no wonder that identity theft has become a million-dollar enterprise. But now security experts may have hit upon a type of identification that can't be lost, forgotten, or stolen: your heart. With usernames and passwords fast becoming unreliable, companies are now turning towards our internal features as an authentication alternative. One of the new developments in this line of research is the Nymi wristband being developed by Canadian firm Bionym. The hi-tech gadget monitors the unique pattern of the wearer's heartbeat, which can be used to wirelessly unlock smartphones, tablets, gaming consoles, and cars. It may even be used to pay for shopping, or act as a replacement for your credit card PIN number. <more>

Mac OS X Sudo Password Bypass

An unaddressed five-month-old flaw in Apple's Mac OS X gives hackers near unlimited access to files by altering clock and user timestamp settings. As reported by Ars Technica, a bug discovered five months ago has received renewed interest due to the creation of a new module in testing software Metasploit, which can life easier for hackers looking to exploit the Mac vulnerability. The bug revolves around a Unix component called sudo. The program is designed to require a password before "super user" privileges are granted to an account -- giving access to other user files. <more>

Facebook bug report posted on Mark Zuckerberg's wall

Khalil Shreateh, a Palestinian IT researcher, found a big Facebook security vulnerability, but Facebook ignored him. So he used the exploit to write on Mark Zuckerberg's wall. The hack violated a fundamental rule about how Facebook works: If you're not friends with someone, you can't write or post links on their walls. At least in theory. While the vulnerability seems like a severe one, Shreateh says that Facebook didn't take it seriously. After ignoring Shreateh's messages twice, Facebook finally gave him a reply: "I am sorry this is not a bug," the company said. So, Shreateh says, he had no choice but to take the vulnerability all the way to top by posting a message directly on Facebook CEO Mark Zuckerberg's personal Facebook page. That, as you might expect, really got Facebook's attention. <more>

Microsoft fixes critical flaws in IE, Exchange Server & Windows

Microsoft released patch tuesday for August, addressing multiple vulnerabilities in Microsoft Windows, Internet Explorer and Exchange Server. The first update is MS13-059, a cumulative update for Internet Explorer, and patches 11 separate vulnerabilities, 9 of which are rated critical on one or more platforms. The 9 critical vulnerabilities are all memory corruption vulnerabilities. The other 2 are only rated as Moderate severity on some platforms for privilege escalation or information disclosure. MS13-060 (Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution) affects only Windows XP and Server 2003. "The vulnerability could allow remote code execution if a user viewed a specially crafted document or webpage with an application that supports embedded OpenType fonts." MS13-061 describes 3 critical vulnerabilities in all currently-supported versions of Exchange Server. The actual vulnerability is in a set of Oracle libraries, called Outside In, which assist in document viewing for users of Outlook Web Access in a web browser. The update installs fixed versions of the Oracle libraries. These vulnerabilities have been publicly disclosed already, but Microsoft states that "Exploit code would be difficult to build". <more>

Google patches Bitcoin-theft vulnerability in Android

Google is distributing patches for a cryptography flaw in Android that may affect hundreds of thousands of applications. The patches have been passed to partners belonging to the Open Handset Alliance, a trade group dedicated to development of Android, wrote Alex Klyubin, an Android security engineer. Affected applications are those that rely on the pseudo random number generator (PRNG) within the Java Cryptography Architecture or "directly invoke the system-provided OpenSSL PRNG without explicit initialization on Android," Klyubin wrote. Random numbers are used in part to generate secure encryption keys and for other cryptography processes. In some cases, the numbers were not "cryptographically strong values," Klyubin said. <more>

Multi-service authentication via palm vein images

Fujitsu Laboratories Ltd. has developed the world's first technology for extracting and matching 2,048-bit feature codes from biometric data (palm vein images). In contrast to the existing matching process of comparing vein feature patterns, the new method employs feature codes extracted from vein images that represent the features of the images in binary format. This, in turn, allows for simple comparison calculations and rapid authentication. As multiple feature codes can be generated from a single piece of biometric data, different codes can be used for different biometric authentication services. As a result, even in the case of leaked registered data, a new feature code can be generated and registered to give users peace of mind and uninterrupted service. <more>

Stealing data through JavaScript and Timing attacks

At the Black Hat security conference in Las Vegas, researcher Paul Stone demonstrated how cybercriminals could gain access to an Internet user's information by leveraging various security issues. According to ThreatPost, Stone has come up with a new technique that allows hackers to gain access to the source code of web pages that users are logged into by exploiting browser and JavaScript flaws. By using Scalable Vector Graphics filters, the expert has been able to determine which pixels are white and which are black in a browser window. By utilizing JavaScript, he could reconstruct the content of an iframe and gain access to a page's source code. The researcher warns that this code could contain sensitive data. In a demonstration made at Black Hat, Stone showed that the source code of a Google+ page contained a phone number, a Google ID and other information that might be valuable to an attacker. <more>

IPv6 attack against Windows 8 machines

Security firm NeoHapsis is warning that the protocol, which has been undergoing a rollout over the last several years, could be subject to a unique attack that redirects users to unwanted potentially malicious pages. Dubbed a "SLAAC" attack, the operation takes advantage of the client-side rollout of IPv6 and the built-in preference such systems have for the new protocol. "Modern operating systems, such as Windows 8 and Mac OS X, come out of the box ready and willing to use IPv6, but most networks still have only IPv4," explained Neohapsis researchers. The researchers went on to describe an attack in which the attacker finds and IPv4 and sets up a server or network impersonating an IPv6 alternative. When users attempt to load the intended site, their systems could, by default, select the imposter network instead, sending their traffic through the attacker's systems. <more>

26th July - Systems Administrators day

Systems administrators around the world are being celebrated July 26 for their behind-the-scenes work in keeping the networks of the organizations running smoothly, as part of the loosely organized and whimsical 14th annual SysAdmin Day. It was first created by system administrator Ted Kekatos on July 28, 2000, according to a report in Wikipedia. "Kekatos was inspired to create the special day by a Hewlett-Packard magazine advertisement in which a system administrator is presented with flowers and fruit-baskets by grateful co-workers as thanks for installing new printers. Kekatos had just installed several of the same model printers at his workplace," the story reported. Since then, SysAdmin Day has been celebrated on the last Friday in July. <more>

SIM security flaw EXposed!!!

Karsten Nohl, founder of Security Research Labs in Berlin, told the New York Times on Sunday that he has discovered a flaw in the encryption technology used in some SIM cards. This vulnerability could allow hackers to eavesdrop on the device owner while in a call, make purchases through mobile payment systems, and possibly even impersonate the device owner. Around 750 million devices could be vulnerable to attacks thanks to this flaw. According to the paper, the newly discovered encryption hole allows the attacker to obtain the SIM card's 56-digit key. Nohl said that he was able to acquire a key by sending the target device an SMS using a false signature for the device's wireless carrier. Typically, both the device and wireless carrier verify their identities by comparing digital signatures. If a device recognizes a false signature, it will end transmission. <more>

'RiskRater' - Online risk assessment tool by Rapid7

Rapid7 has come up with a risk assessment tool named 'RiskRater'. It's a free online tool that assess your mobile, endpoint and user-based risk management programs. The tool aims to bring to your attention areas that need work in a prioritized order. Of all the tasks you could do to improve your organization's overall security, which should you do first? Some are more valuable to do before others, and RiskRater will help you identify what they are. It shows a number of questions for each of three categories (endpoint, mobile, and user), and calculates a score from 1-10 based on your answers. The scoring is determined based on an algorithm and then mapped against benchmarks. The benchmark is based on data collected from Rapid7’s own research and from responses provided by over 600 organizations. <more>

Two-factor authentication bypass in Dropbox, POSSIBLE!!

Researcher Zouheir Abdallah revealed that an attacker already knows the victim's credentials (username and password obtained with a Key-logger, cross-site shared password, due the adoption of a easy to guess password etc..), for Dropbox account that has two-factor authentication enabled, is able to hack that account through a procedure. Q-CERT team found a critical vulnerability in DropBox that allows a hacker to bypass the two-factor authentication implemented by the popular file sharing service. The flaw is related to the lack of verification of authenticity of the email addresses used to sign up a new DropBox account, a hacker could conduct the attack creating a new fake account similar to the target one and append a dot (.) anywhere in the email address. <more>

Wi-Vi signals are used to see-through-wall

Researchers at MIT's Computer Science and Artificial Intelligence Laboratory have come up with a way to create a low-power, portable device that can see through walls using Wi-Fi signals. Technology of this sort, similar in concept to radar or sonar, has existed for years and relies on radio waves and other parts of the electromagnetic spectrum. It is used mainly in law enforcement and military applications. Dina Katabi, a professor in MIT's Department of Electrical Engineering and Computer Science, and graduate student Fadel Adib propose wider civilian use of the technology through a simple, affordable device like a mobile phone, equipped with two antennas and a receiver.  Here's an interesting video that shows how the system works. Katabi suggested the technology, which she calls WiVi, can be used for virtual reality and gaming, without requiring the user to remain in a specific area in front of a sensor. She also says the technology could be used for personal safety. <more>

Cisco patches flaws in security appliances

Cisco is advising administrators to patch their security appliance following the disclosure of vulnerabilities in the company's Web Security and Email Security Appliance systems. The company said that the flaws included both command injection flaws on denial of service attacks for both of the security systems. For the Web Security Appliance, the fix will bring patches for two authenticated command injection vulnerabilities. If exploited, the flaws could allow a user to remotely take control of a targeted appliance and execute arbitrary code. In order to do so, however, the company noted that the user would need to have a valid account on he network, thus decreasing the likelihood of a remote attack. <more>

Facebook Fixes SMS-Based Account Hijacking Vulnerability

A UK security researcher has disclosed a bug in Facebook's code that allowed him to take over any Facebook account in less than a minute - and earned himself a $20,000 bug bounty in the process. fin1te, a security engineer has described a simple bug "which will lead to a full takeover of any Facebook account, with no user interaction." Put simply, you send Facebook an SMS message, and Facebook lets you into the account of your choice via smartphone. Once there, of course, an attacker can simply send a password reset message and have the reset code sent to his mobile. <more>

Certstation Knowledge Base launched

Certstation knowledge base provides state of the art information related to IT security that covers a broad spectrum which includes news, blogs, articles, malwares and whitepapers related to what is happening in the security arena. Besides more in-depth technical analysis in the form of security advisories not only from their vendors, but also from the top-notch security sources. It provides a platform for security professionals to look for security patches and apply them on timely basis. Patches are available for proprietary as well as open source applications. Our updated repositories provides a complete snapshot for professionals to stay ahead in the cyber world. So let’s start using Knowledge Base.

40 Fixes are on the way in June's Oracle Critical Patch

Oracle is planning to release a Critical Patch Update on Tuesday that affects multiple versions of Java, and it's another products. According to Oracle's security announcement, the patch addresses 40 different vulnerabilities. All update levels of Java SE 5, 6, and 7 are affected by the flaws, as are all versions of JavaFX. Of the 40 bugs, all but three are remotely exploitable over a network without the need for a username or password. Oracle ranks the severity of its flaws using the Common Vulnerability Scoring System (CVSS), and the top-ranked bug in this particular update rates a 10.0. <more>

OOPS!! another iPhone lockscreen bypass

Apple's iOS 7 brings a number of visual changes, but somehow the lock screen remains leaky. According to Forbes, the iOS7 lock screen can be bypassed thanks to one of the new features in the OS, the Control Center which can be accessed from any screen in iOS, brings shortcuts to four frequently-used apps. By opening up the Control Center, and launching the Calculator app and then launching the Camera app once again through the Control Center in the Calculator screen, anyone can access, delete, email and tweet the pictures in the Camera Roll. All this without having to enter the passcode on the lock screen. The vulnerability is discovered by Jose Rodriguez from Spain living in Tenerife sent the video showing how to bypass the lockscreen on Apple’s beta version of iOS 7 in just a few seconds.<more>

Spamhaus under MASSIVE DDoS attack

The biggest DDoS (Distributed Denial of Service) attack in the history of the internet was carried out last week. The victim was Spamhaus anti-spam organisation. According to Akamai,  Spamhaus was facing increasing traffic about a week ago, but have surged in the last few days, reaching a never previously experienced level of some 300 gigabits per second at peak hours, says Akamai. <more>

Still Lock Screen Bypass possible even after fix

Last week, Apple just released a fix for lock screen bypass that was discovered in mid-February. Unfortunately, it seems another trick that allows similar access to the device has already been discovered. According to The Next Web, this vulnerability is present in iOS 6.1.3. This version was just released earlier this week and contained a number of bug fixes along with a fix for the lock screen bypass. The method for bypassing the lock screen in that instance was pretty complicated. This time, it's much, much easier.

Microsoft, Twitter, LinkedIn and Yahoo users @ RISK

A vulnerability related to account hijacking has been identified by a security researcher Rishi Narang which puts Microsoft, Twitter, LinkedIn and Yahoo users at risk. While Google and Facebook customers are not impacted by the flaw. According to the expert, the vulnerability, which can be leveraged to launch session fixation attacks, is caused by an issue with the management of cookies and sessions.<more>

Another Java zero-day flaw discovered

Less than a week after the latest zero-day flaw in Oracle's Java software was discovered, security researchers have discovered yet another bug that can allow attacks on computers. The latest flaw, which researchers from FireEye dubbed the vulnerability YAJ0 - Yet Another Java Zero-Day, is already being exploited "in the wild." According to FireEye, new zero-day vulnerability has been used to attack multiple customers, especially those whose browsers have Java v1.6 Update 41 and Java v1.7 Update 15 installed. Unlike other popular Java vulnerabilities, this new vulnerability "leads to arbitrary memory read and write in JVM process."

HTML5 Flaw clogs up Disk Space

Developer Feross Aboukhadijeh has published that allows a web page to fill up a hard disk without any action on the user's part. If you'd like to try out the "HTML5 Hard Disk Filler" at your own peril, simply go to www.filldisk.com – but beware: the script will immediately get to work and clog up your hard disk with cat images. <<more>>

Latest Adobe Flash player released to rescue Firefox users

The last update of Flash Player was just two weeks ago and now it's being updated again - this time to block exploits that target the Firefox browser. The new advisory points to three fixes in the update, two involved in blocking the Firefox exploit and one correcting a generally applicable, serious flaw. The problems affect Flash Player on Windows, Mac OS X and Linux, but do not appear to affect Flash on Android. In the month of February, Adobe released emergency updates to Flash Player, taking its version number, on Windows and Mac, up to 11.5.502.149. Then further patches were released on 12 February as part of the regularly scheduled Patch Tuesday, bringing the version number up to 11.6.602.168. In the latest update the version number rises to 11.6.602.171 for Windows and Mac OS X versions; the updates can be downloaded from Adobe. <<more>>

CERTStation Cyber Security Dashboard

CERTStation's Cyber Security Dashboard is an IT security intelligence dashboard that provides a snapshot of an organization's security status, allowing it to make instantaneous and informed decisions to safeguard the security of its systems.

CERTStation's Cyber Security Dashboard is a web based application that provides users with advanced security data management, scanning, and threat management capabilities over the Internet.

The widget allows you to monitor the latest news on viruses, worms, trojans, bugs, news and sparklines. It gives you an overview on the latest happening in the security arena. The widget appears on the first and second dashboard screens.

CERTStation Inc.'s security news information collection systems and analysts develop a weekly report called as Threat Management Advisory (TMA). The data for the report is a combination of CERTStation's own published information combined with hundreds of public and private sources. The report offers an easy to read weekly threat advisory that readers can incorporate into their threat assessment processes and procedures.

A simple registration at CERTStation News TMA Registration will enable you to receive the industry's leading threat management advisory report. To read the current TMA, Click Here

Facebook targeted by hackers!!!

Facebook officials said they recently discovered that computers belonging to several of its engineers had been hacked using a zero-day Java attack that installed a collection of previously unseen malware. Company officials said that the attack did not expose customer data, and it was contained to the laptops of a small number of Facebook engineers. But other companies who were affected by the same hacking campaign may not have been so lucky. <<more>>

250,000 Twitter accounts HACKED!!!

Twitter has become the latest victim in a number of high-profile cyber-attacks against media companies, saying hackers may have gained access to information on 250,000 of its more than 200 million active users. The social media giant said in a blog posting that earlier this week it detected attempts to gain access to its user data. It shut down one attack moments after it was detected. But it discovered that the attackers may have stolen user names, email addresses and encrypted passwords belonging to 250,000 users. Twitter reset the pilfered passwords and sent emails advising affected users.

WordPress 3.5.1 fixes 37 bugs

WordPress developers have announced a maintenance update to the popular open source blogging software. WordPress 3.5.1 fixes 37 bugs and addresses three security issues, including two cross-site scripting vulnerabilities. Users running WordPress on IIS might run into a problem that prevents the upgrade; the developers have prepared documentation to help users work around this problem. Security issues addressed in the update include a server-side request forgery problem that allowed the exposure of information through pingbacks. According to the developers, this vulnerability could help attackers compromise an unpatched WordPress site.

Cisco Warns of Vulnerabilities in Wireless LAN Controllers

Cisco has warned system administrators to patch their wireless LAN appliances following the discovery of flaws which could allow for remote code execution and denial-of-service attacks. The company said that the flaws affect some 17 products in its WLC wireless controller lines. Among the products are the Virtual Wireless Controller tool and the Catalyst 3750G and Flex 7500 lines. Cisco has released a fix for the flaws and the company is advising customers to update their wireless controllers to prevent attack. The threat of attack can also be mitigated on some devices by limiting SNMP access on the wireless controller.

'Red October' Cyberspy unplugged, credit to Kaspersky

Key parts of the infrastructure supporting an espionage campaign that targeted governments around the world reportedly have been shut down in the days since the five-year operation was exposed. The so-called Red October campaign came to light on Monday in a report from researchers from antivirus provider Kaspersky Lab. It reported that the then-ongoing operation was targeting embassies as well as governmental and scientific research organizations in a wide variety of countries. The research uncovered more than 60 Internet domain names used to run the sprawling command and control network that funneled malware and received stolen data to and from infected machines. In the hours following the report, many of those domains and servers began shutting down, according to an article posted Friday by Kaspersky news service Threatpost.

SQL injection flaw fixed in Ruby on Rails

Ruby on Rails versions 3.2.10, 3.1.9, and 3.0.18 has been released in order to patch a serious SQL injection vulnerability. The vulnerability is located in the framework's Active Record database query interface and allows potential attackers to inject arbitrary SQL statements. The Rails developers apologized for releasing a security update so close to the holidays, but said that they were forced to rush out a patch because the vulnerability had been publicly disclosed. So it is recommended that all users apply the upgrade on earliest basis.