Tor Servers Hacked
Two of the seven directory authority servers that the Tor Project uses to run its anonymous browsing service have been compromised, along with a new server that the project uses to host metrics and graphs.
Malware
Microsoft Knew of IE Zero-Day Flaw Since September
Microsoft today admitted it knew of the Internet Explorer flaw used in the attacks against Google and Adobe since September last year.The flaw was in the Microsoft Security Response Center’s (MSRC) queue to be fixed in the the next batch of patches due in February but the targeted zero-day attacks against U.S. companies forced the company to release an emergency, out-of-band IE update.
Cisco Buffer Overflow, DDoS Flaws Revealed
Cisco has discovered a buffer overflow in version 2.6 of CiscoWorks Internetwork Performance Monitor (IPM) and previous versions for Windows; the flaw allows attackers to compromise vulnerable systems remotely, as well as a DDos flaw in Cisco IOS XR. Read the full article. [The H Security]
Analysis of the 32 million passwords recently exposed in the breach of
social media application developer RockYou last month provides further
proof that consumers routinely use easy to guess login credentials. Read the full article. [The Register]
Mozilla yesterday reported a “huge increase” in downloads of Firefox in
Germany after that country’s computer security agency urged users of
Microsoft’s Internet Explorer to dump the browser and run a rival
instead. Read the full article. [Computerworld]
Although the first known attacks using the Aurora malware that compromised Google weren’t discovered until late last year, some parts of the malware codebase has been in existence in China for nearly four years, raising questions about how many other attacks it might have been used in during that time frame.
This is just a quick heads-up that the emergency security patch for Microsoft’s Internet Explorer will be released tomorrow (January 21, 2009).The update, rated critical for all versions of IE, will cover a remote code execution flaw that has already been used in targeted attacks against U.S. companies, including Google and Adobe.
Here are some steps Microsoft and other security firms recommend you
can take now to help defend yourself against the IE Aurora attacks. Read the full article. [Dark Reading]
Even though online job scams have become more convincing as criminals
have honed their skills, sometimes victims don’t fall for them – they
jump into them. Read the full article. [SFGate]
Adobe’s run on the patching treadmill continued this week with a “critical” update to fix a pair of code execution holes in its Shockwave Player.
