By Roel Schouwenberg
Once
upon a time we were living in a world where creating malware, then
still called viruses, was a very bad thing to do. These days, people
seem much more relaxed with the idea of someone writing malware.
Dennis Fisher talks with Joe Grand of Grand Idea Studio about the design for this year’s DEFCON badge, the secret feature he added that no one has uncovered yet and his research on hacking smart parking meters.
By Andrew Storms
Two years ago I took some hard hits from my peers for calling the iPhone “a security nightmare.” Two years later, I can’t find a single person who doesn’t agree that the iPhone is the number one mobile target of security researchers.Fast forward to today: Is the iPhone still a security nightmare or have those problems been relegated to annoyance status?
A group of cryptographers has devised a new attack against AES, the de facto standard encryption algorithm, that enables them to recover an encryption key in far less time than had been possible before. The attack can recover an AES-256 key in a small enough amount of time to make the method practical for common attackers, leading some experts to recommend that users stop using AES-256 immediately.
There are several architectural and implementation problems in mobile phone networks that can be used to force users to open malicious files, allow attackers to gain control of users’ phones and change phone settings to redirect mobile Internet traffic to a proxy controlled by the attackers.
In a presentation at the Black Hat conference in Las Vegas on Thursday, Luis Miras, and independent security researcher, and Zane Lackey of iSec Partners, demonstrated a number of techniques for taking advantage of the implementation and design problems. The pair also announced the release of a tool they called TAFT (There’s an Attack for That), which runs on jailbroken iPhones and can be used to execute several different attacks.
LAS VEGAS — There is a serious vulnerability in all versions of the current release of BIND, a widely deployed name server, that can be used to force DNS servers to quit without warning. Experts say there also is an exploit for the vulnerability that is already circulating widely online.
From CNN (John D. Sutter)
Remember Conficker? The hugely talked-about computer worm seemed poised to wreak havoc on the world’s machines on April Fool’s Day. And then … nothing much happened.
But while the doom and gloom forecast for the massive botnet — a remotely controlled network that security experts say infected about 5 million computers — never came to pass, Conficker is still making some worm hunters nervous. Read the full story [cnn.com]
Ryan Smith, one of the researchers who found the bug in the Microsoft MsVidCtl DLL that the vendor is rushing to patch this week, has posted a short video demonstration of a technique that bypasses the stop-gap solution of preventing the vulnerable ActiveX control from loading.
The current zero-day attacks against Adobe Flash Player are not quite zero-day after all. According to new information, Adobe’s security response team knew about the vulnerability since December 31, 2008 (see image below) but it was misdiagnosed as a “data loss corruption” issue.
When word of the attacks surfaced this week, Adobe quickly locked access to the bug ticket with a note that it was “reclassified as a security bug.” Read the full story [zdnet.com]
From Washington Post (Brian Krebs)
Microsoft may soon be taking the unusual step of issuing an out-of-band security update to address multiple weaknesses that stem from a Windows security flaw that the software giant tried to fix earlier this month. Read the full story [washingtonpost.com] See more details at Halvar Flake’s blog [blogspot.com]
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
