About
Dennis Fisher is a journalist with more than 13 years of experience covering information security.
The list of applications known to be vulnerable to the Windows DLL-hijacking bug is growing by the hour, with some sites listing more than 30 vulnerable applications right now. A large portion of the known vulnerable apps belong to Microsoft, including PowerPoint 2010 and Microsoft Live Email.
Apple released a patch Tuesday that fixes more than a dozen bugs, including a critical remote code-execution flaw in Apple Type Services. The patch release also includes a fix for a flaw in CFNetwork that enabled an attacker to intercept user credentials and other sensitive data silently on a network.
Researchers have found a very simple method for evading the Android licensing scheme that Google uses to ensure that paid applications in its Android Market are correctly licensed.
In this video, the folks at Offensive Security demonstrated exactly how the Windows DLL-hijacking vulnerability can exploited using Metasploit and a benign PowerPoint slide.
A day after Microsoft released information on the remotely exploitable DLL-hijacking vulnerability that affects dozens of Windows applications, researchers are starting to discover exactly which pieces of software are vulnerable. The list so far includes PowerPoint, Wireshark and some applications that are included by default with Windows Vista, and possibly Windows 7.
Dennis Fisher talks with HD Moore about the newly discovered DLL load vulnerability in Windows, which affects several dozen applications and can be used by attackers to silently compromise remote machines, as well as the guidance and workarounds that Microsoft is offering for users and developers
Two ATM manufacturers have released software updates to address the remotely exploitable vulnerabilities in their machines’ firmware that IOActive researcher Barnaby Jack demonstrated line on stage at the Black Hat conference last month.
In this video from the OWASP AppSec Research conference, Gustav Rydstedt from Stanford University, discusses frame-busting and clickjacking vulnerabilities on popular Web sites.
It seems that any time there’s a high-profile incident in which a vulnerability is disclosed without a patch being available, there is an immediate and loud call from some corners to abolish the practice of vulnerability research. If researchers weren’t spending their days poking holes in software, the bad guys wouldn’t have so many flaws to exploit and we’d all be safer, this argument goes. But the plain fact is that all of us–users and vendors alike–are far better off because of the work researchers do.
There’s old, and there’s old. Internet Explorer 6 clearly falls into the latter category, but despite its advancing age, IE6 still holds a lot of sway in the enterprise, as new data that came to light this week. That’s not the only weirdness that reared its head this week, though. There was the Firefox bug that wasn’t, the revelation of hundreds of thousands of infected parked domains and a mysterious bug that affects as many as 40 Windows apps. The dog days of summer are upon us. Read on for the full week in review.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
