OpenSSL Flaw Can Crash Remote Machines
There is a vulnerability in some versions of the OpenSSL software that can enable an attacker to crash remote clients or servers using a specially constructed record.
Vulnerabilities
Broadcom Network Cards Vulnerable: US-CERT
A buffer overflow vulnerability exists in the Broadcom NetXtreme
management firmware. This vulnerability may allow a remote attacker to
execute arbitrary code on an affected device. Read the full advisory. [US-CERT]
Traffic Sniffed, Payloads Launched on MS Keyboards
Security researchers at CanSecWest unveiled an open-source device that
captures the traffic of a wide variety of wireless devices, including
Microsoft wireless keyboards, medical devices, and remote controls. Read the full article. [The Register]
Networking giant Cisco has published a total of 7 security advisories that address 11 individual vulnerabilities for its Internetwork Operating System (IOS) software. Read the full article. [The H Security]
VANCOUVER–Software makers, led by Microsoft, have spent the last few years steadily adding new memory-protection and exploit-mitigation technologies such as ASLR, DEP and SafeSEH to their products. But the state of the art in exploitation has advanced just as steadily and, as researchers showed at CanSecWest this week, bypassing these protections is challenging, but increasingly feasible.
Latest spam report from Messaging Anti-Abuse Working Group (MAAWG) now includes data from European users. More than half (57%) of survey adults
have responded to spam in such a way that it supports the perpetrators
of the spam. This includes opening attachments to an email, forwarding
an email or clicking on links. Read the full article. [The H Security]
A new invention developed by Dr. Jacob Scheuer of Tel Aviv University’s
School of Electrical Engineering promises an information security
system that can beat today’s hackers — and the hackers of the future —
with existing fiber optic and computer technology. Transmitting binary
lock-and-key information in the form of light pulses, his device ensures
that a shared key code can be unlocked by the sender and receiver, and
absolutely nobody else. Read the full article. [ScienceDaily]
Charlie Miller won his third consecutive Pwn2Own contest at the CanSecWest conference in Vancouver this week. In this video he talks about the contest, the state of Apple security and the bug-finding and reporting process.
On Thursday, investigators in France arrested an unemployed 25-year old man who appears to have been responsible for the spectacular attacks on Twitter accounts that included those of US President Barack Obama and pop singer Britney Spears. Read the full article. [The H Security]
VANCOUVER, BC — Jumping through a series of anti-exploit roadblocks, Dutch hacker Peter Vreugdenhil pulled off an impressive CanSecWest Pwn2Own victory here, hacking into a fully patched 64-bit Windows 7 machine using a pair of Internet Explorer vulnerabilities.
