Google security researcher Tavis Ormandy has set the cat among the “responsible disclosure” pigeons with the release of technical details of a zero-day vulnerability affecting the Microsoft Windows Help and Support Center without giving Microsoft adequate time to prepare a patch.
By Robert HansenEarly this morning Google’s Tavis Ormandy published a vulnerability in the hcp protocol handler. It allows the attacker to run arbitrary commands as the user. In practice it created a lot of alerts and warnings for me – but the XP install I was using is somewhat locked down. So I’m not sure how practical this attack would be over any other attack that causes an alert, as the article mentions. Later his reports says it works around the alerts (I couldn’t reproduce that, but that was his intention). Either way, though, this is some pretty amazing research. However, there are some odd things about this that really struck me the wrong way.
A researcher has discovered a flaw residing in the Windows Help and Support Center, a feature that
provides users with online technical support. Malicious hackers can
exploit the weakness of Windows by embedding commands in web addresses
that activate the feature’s remote assistance tool, which allows
administrators to execute commands over the internet. Read the full article. [The Register] Read the advisory. [Seclists.org]
Microsoft has issued updates for its Office 2004 and 2008 suites for Mac
that patch several security vulnerabilities. According to Microsoft,
the updates address a number of security issues, many of them rated
Important. Three of the vulnerabilities are Excel related and could allow attackers to inject
arbitrary malicious code, for instance when opening specially crafted
files. Read the full article. [The H Security]
There’s a large-scale attack underway that is targeting Web servers running Microsoft’s IIS software, injecting the sites with a specific malicious script. The attack has compromised tens of thousands of sites already, experts say, and there’s no clear indication of who’s behind the campaign right now.
WordPress users whose websites are hosted on GoDaddy servers have been
targeted by fake AV peddlers yet again. Read the full article. [Help Net Security]
An audit of the Department of Homeland Security’s Microsoft Windows
Active Directory at its headquarters revealed that its implementation
failed to fully comply with the department’s security guidelines, and no
mechanism was in place to ensure its level of security, DHS’s inspector
general said in a report. Read the full article. [GovInfoSecurity]
Malaysian cops have busted an alleged text message spam scam ring
thought to have fleeced locals for hundreds of thousands of dollars. The group are suspected of raking in RM6.4m ($1.9m) between 2006 and April 2010
using fictitious lottery winnings as a bait for an advanced fee fraud. Read the full article. [The Register]
Unsuspecting users looking for videos on recent events like the Gulf of
Mexico oil spill and the NBA playoffs are being directed to maliciously crafted websites with
videos that appear to be identical to YouTube postings. Read the full article. [InfoSecurity]
A pair of academic researchers have analyzed the use of
passwords by many prominent online sites, and found that many sites
require passwords as a sort of security theater, requiring them in
contexts that are superfluous and failing to do their part to secure the
information on their end. The end result, they argue, is a tragedy of
the commons, with the commons being the finite memory of the average
user. Read the full article. [Ars Technica]. Read the study.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
