Vulnerabilities


Gaining Precision in Information Leakage Attacks

By Robert HansenIt’s hard to narrow down your life’s work into
one interesting event or tidbit. Even
picking 10 would be tough. So instead
of picking something I am well-known for, I wanted to look for something I had
a lot of fun coming up with that you probably didn’t read. I’ve always been interested in information
leakage as an exploit class. It’s
something most people like to overlook, in favor of the higher-profile
exploits. Sure, it’s a lot sexier to
go after the direct administrative compromise, but I enjoy the nuances of
piecing together big puzzles. Information leakage as a class provides me that kind of mental
stimulus.

Critical PDF Reader Patch Fixes ‘/Launch’ Command Attack Vector

Adobe today shipped a critical Reader/Acrobat patch to cover a total of 17 documented vulnerabilities that expose Windows, Mac and UNIX users to malicious hacker attacks.The update, which affects Adobe Reader/Acrobat 9.3.2 (and earlier versions), includes a fix for the outstanding PDF “/Launch” functionality social engineering attack vector that was disclosed by researcher Didier Stevens.


Since April, a son-of-Kraken botnet has infected an estimated 318,058
machines – about half as big as the original Kraken was at its height
in the middle of 2008, according to Paul Royal, a research scientist at
the Georgia Tech Information Security Center. Read the full article. [The Register]

Barry Ardolf, 45, of Blaine, Minnesota, had rejected a plea deal in
connection to charges accusing him of sending Vice President Joe Biden a
threatening e-mail from his neighbor’s computer, a computer he is
accused of hacking. A federal grand jury substantially upped the ante against the
computer technician by ringing him up on additional charges of identity theft and two
kiddie-porn accusations carrying lifetime sex-offender registration
requirements. Read the full article. [Wired]

According to the FTC, the fraudsters charged 1.35 million credit cards a
total of $9.5 million, but only 78,724 of these fake charges were ever
noticed. Typically they floated just one charge per card number, billing
on behalf of made-up business names such as Adele Services or Bartelca
LLC. Read the full article. [Computerworld]