Botnets: Advanced Spy Tools for Hackers
Botnets give the common hacker espionage tools formerly reserved for nation states. Brian Krebs interviews Roland Dobbins on the “democratization of espionage.” Read the full article. [CSOonline]
Vulnerabilities
BIND Name Server Gets Patched Update
The Internet Systems Consortium (ISC), the company behind the open source DNS BIND, software, has released security updates to resolve a DNSSEC-related vulnerability that could lead to Denial-of-Service (DoS) attacks. Read the full article. [The H Security]
Tracking The Destructive Worm Zimuse
Zimuse-A and its variant, Zimuse-B, overwrite MBR (Master Boot Record)
files on infected drives with their own data, either 40 days or 20 days
respectively after infection. This malicious behavior corrupts records
and makes data recovery difficult if not impossible, researchers report. Read the full article. [The Register]
A flaw in Twitter’s website has
left the login credentials of its users vulnerable to hackers,
according to a security researcher who has asked the social
media company to fix the problem. Read the full story [Reuters]
RealNetworks has released patches to cover a total of 11 vulnerabilities in several versions of
RealPlayer for Windows, Mac, and Linux. The flaws, which could lead to code execution attacks, also affect several versions of the
Helix Player for Linux. Read the full advisory [RealNetworks]
Microsoft today admitted it knew of the Internet Explorer flaw used in the attacks against Google and Adobe since September last year.The flaw was in the Microsoft Security Response Center’s (MSRC) queue to be fixed in the the next batch of patches due in February but the targeted zero-day attacks against U.S. companies forced the company to release an emergency, out-of-band IE update.
Cisco has discovered a buffer overflow in version 2.6 of CiscoWorks Internetwork Performance Monitor (IPM) and previous versions for Windows; the flaw allows attackers to compromise vulnerable systems remotely, as well as a DDos flaw in Cisco IOS XR. Read the full article. [The H Security]
Mozilla
has released the latest iteration of its flagship Firefox browser with
a few significant security goodies to keep malicious hacker at bay. The update, which is being shipped via the browser’s automatic
update mechanism, includes new features to patch third-party Firefox
plug-ins and lock out rogue add-ons.
Analysis of the 32 million passwords recently exposed in the breach of
social media application developer RockYou last month provides further
proof that consumers routinely use easy to guess login credentials. Read the full article. [The Register]
One day after a Google security researcher releases code to expose a flaw that affects every release of the Windows NT kernel — from Windows NT 3.1 (1993) up to and including Windows 7 (2009) — Microsoft has released a security advisory to acknowledge the issue and warn of the risk of privilege escalation attacks.
