Vulnerabilities

All three major Web browsers —  Microsoft’s Internet Explorer 8, Mozilla Firefox and Apple’s Safari — failed to survive the hacker onslaught at this year’s CanSecWest Pwn2Own contest.

A security researcher named “Nils” (he declined to provide his full name) performed a clean drive-by download attack against the world’s most widely used browser to take full control of a Sony Vaio machine running Windows 7.  He also scored hits against Firefox and Safari.

By Paul F. Roberts, The 451 Group

Starting this week at the annual CanSecWest conference in Vancouver, British Columbia, some of the world’s best hackers will crack their knuckles and get to work on a different kind of problem: hacking mobile devices including Apple’s über popular iPhone. The annual Pwn2Own contest is likely to be a wake-up call to companies about the dangers posed by BlackBerrys, iPhones and other mobile devices. Despite that, many security firms are still playing catch up on mobile device management and security. Their enterprise customers may pay the price.

Adobe vs. Microsoft on Security Response – Fri, March 6, 2009

Ryan and Roel discuss the latest zero-day vulnerabilities (and attacks) affecting Adobe and Microsoft customers and compare the response from the two software vendors.

Emergency IE Patch – Fri, January 9, 2009
 
Ryan and Roel dissect the latest wave of malware attacks against Microsoft Internet Explorer browser and discuss the company’s plans to ship an emergency out-of-band update.

Explaining AMTSO principles – Fri, November 21, 2008

Ryan grills Roel on the latest “principles” document coming out of the AMTSO (Anti-Malware Testing Standards Organizing) and the two spar over the value of such a massive effort.

In-the-wild worm attacks exploitation – Fri, November 7 2008

In this special episode, Ryan and Roel get to the bottom of the new in-the-wild worm attacks exploiting the Microsoft MS08-067 vulnerability. Listen as Roel provides a blow-by-blow of the two different Trojans now targeting Chinese-language versions of Windows.

Clickjacking: Ryan and Roel tackle browser-threat hype – Tue, October 21, 2008

The cross-browser clickjacking threat, malware on new Asus EEE machines, phishing and the elections/financial crisis, the iPhone security mess, Microsoft Patch Tuesday and the exploding fraudware/rogueware problems.