Dennis Fisher

From Wired (David Kravets)
A federal appeals court, in the first decision of its kind, said Thursday that companies providing malware, spyware and adware blocking services are immunized by the Communications Decency Act of 1996 from lawsuits claiming unfair business practices.
A three-judge panel of the 9th U.S. Circuit Court of Appeals found that the CDA treats security software makers the same as internet service providers when they block material they find objectionable, granting them so-called “good Samaritan” immunity from civil lawsuits.  Like an ISP, such companies provide an “interactive computer service”  because they pull updates from a central server, the San Francisco-based appeals court said. Read the full story [Wired.com].

Dennis Fisher talks with Robert “Rsnake” Hansen about his Slowloris tool, low-bandwidth DoS attacks and the law of unintended consequences.

From SANS AppSec Street Fighter Blog (Jason Montgomery)
I just ran across Jakob Nielsen’s Alert Box post titled Stop Password Masking and wanted to provide some feedback from a security vs. usability perspective. I have great respect for Nielsen’s contribution to the usability of the web. Back in the early days of the internet (mid 1990’s), his books were gospel at my consulting firm, ATGi.
My initial reaction to his article was ‘that’s a crazy idea’ – but after some reflection, I really felt like it was a good mental exercise to actually consider what he was saying. If I hadn’t known who Nielson was, I probably would have dismissed his suggestion outright. Sometimes it is a good exercise to go back and review why we do the things we do – especially as it relates to information security controls. Nielsen questions the real security benefit of password masking – something I haven’t given a second thought to…well, ever. Read the full story [SANS].

On May 28, our colleagues at The Microsoft Security Response Center released advisory 971778 which elaborated on a new vulnerability in Microsoft DirectShow effecting Windows 2000, Windows XP and Windows Server 2003. You can obtain more details on how to protect your environment from this vulnerability from the Microsoft SRD blog.
We have been closely monitoring the malware landscape for threats related  to leveraging exploits against this new vulnerability. We subsequently developed and released a generic detection for malformed media files, Exploit:Win32/CVE-2009-1537, based on MAPP information provided to us. Also, we have developed detections for the known malicious web pages, as Exploit:JS/Mult.BM or Trojan:HTML/Redirector.I. Our security products, such as Windows Live OneCare, Microsoft Security Essentials, and Forefront Client Security can block access to these malformed media files with signature definition update version 1.59.798 or higher. Read the full story [Microsoft Malware Protection Center].

Adobe has patched a critical security flaw in its Shockwave Player software which could enable an attacker to gain complete control of affected machines. The vulnerability affects version 11.5.0.596 and earlier of Shockwave.

From The New York Times (Thom Shanker)
Defense Secretary Robert M. Gates on Tuesday ordered the creation of the military’s first headquarters designed to coordinate Pentagon efforts in the emerging battlefield of cyberspace and computer-network security, officials said. Read the full story [NYTimes.com].

Google has released a new version of its Chrome browser, which includes a fix for a serious buffer overflow vulnerability. The vulnerability in Chrome lies in the way that the browser handles certain responses from HTTP servers.