Oracle Java Cloud Service bugs publicly disclosed

Researchers have released technical details and attack code for 30 security issues affecting Oracle's Java Cloud Service. Some of the issues make it possible for attackers to read or modify users' sensitive data or to execute malicious code, the researchers warned. Poland-based Security Explorations typically withholds such public airings until after any vulnerabilities have been fixed to prevent them from being exploited maliciously. The researchers broke from that tradition this week after Oracle representatives failed to resolve issues including bypasses of the Java security sandbox, bypasses of Java whitelisting rules, the use of shared WebLogic server administrator passwords, and the availability of plain-text use passwords stored in some systems. <more>

Microsoft reveals zero-day attacks against Word

The exploit that attackers are using to target a zero day vulnerability in Microsoft Word relies on a complex series of pieces, including an ASLR bypass, ROP techniques and shellcode with several layers of tools designed to detect and defeat analysis. Microsoft officials said the exploit is being used in targeted attacks right now and attackers are employing it to drop a backdoor on vulnerable machines. The vulnerability, which Microsoft acknowledged yesterday in a security advisory, affects several versions of Word and Office, both on Windows and OS X, and is related to a problem in the handling of RTF files. Microsoft also acknowledged that there is a theoretical method through which an attacker could trigger the vulnerability in Outlook, but that method hasn't been seen in the wild yet. <more>

Facebook shows off epic ThreatData security platform

Facebook unveiled a new automated ThreatData security service, claiming the advanced malware-detection and mitigation service has already helped take down a criminal campaign. Facebook unveiled the ThreatData service in a blog post. ThreatData is a central intelligence tool designed to automatically detect, catalogue, offer IT administrators information on and combat incoming cyber threats. The company said it has already successfully used ThreatData to spot and mitigate a campaign targeting feature phones. "In the summer of 2013, we noticed a spike in malware samples containing the string 'J2ME' in the antivirus signature. Further investigation revealed a spam campaign using fake Facebook accounts to send links to malware designed for feature phones," read the post. <more>