Thursday, June 29, 2006

Logic Bomb

This one is a real logic bomb created by an unhappy system admin of an investment bank, who expected a bonus of $50k but only got $32k, to take revenge deleting all the files in the host server in the central data centre and then every server in every branch of the company.

where "/usr/sbin/mrm -r" is a variant of the classic "rm -rf" command for mass deletion of files and folders.

Some 2,000 servers did go down and 400 branch offices were hit. Backup systems did not work and files were deleted.

This 'time bomb' was found by Keith Jones, director of computer forensics and incident response at Mandiant, while doing forensics on the United States v. Duronio case.

read more ...

Researchers hack Wi-Fi driver to breach laptop

Security researchers have found a way to seize control of a laptop computer by manipulating buggy code in the system's wireless device driver.

The drivers of various WiFi hardware are vulnerable and can be exploited very efficiently, even if the computer is not connecting/trying to connect to some network. Only defence is to turn them physically off when you dont need them and limit your usage of them to "somewhere safe".

These vulnerabilities were found by the use of a 802.11 Fuzzing tool called lorcon
read more ...

Wednesday, June 28, 2006

Multiple Vulnerabilities in Yahoo! Web Services

My friend Rajesh Sethumadhavan has published an advisory about multiple vulnerabilities in many Yahoo services.

The advisory provides some proof of concept exploits and screenshots of authentication bypass, session binding, weak cookie encoding, cross-site scripting, file inclusion and url redirection vulnerabilities, which are caused due to improper validation of user-supplied inputs.
read more

Here is one news report about this vulnerability published in securitypronews.com


Tuesday, June 27, 2006

UnAnonymizer

- From H D Moore on Full Disclosure list.
A fun browser toy that depends on Java for complete results.

PayPal Security Flaw Exploited for Identity Theft

- From Netcraft.com
A security flaw in the PayPal web site was being actively exploited by fraudsters to steal credit card numbers and other personal information belonging to PayPal users.

PayPal has fixed this flaw recently in its Web site
read more...

E-commerce security a myth?

- From Dcrab's Blog

How secure is your information? Millions of people rely on Amazon, Msn, etc to keep thier information secure and yet thier ignorance towards security researchers leaves the wide open for exploitation.
read more ...

From Flaw to Exploit

- From SecuriTeam Blogs
I came across the following post by Netcraft: PayPal Security Flaw allows Identity Theft, and I was wondering HOW long would it take me to find the flaw fraudsters were using (or any other flaw) to cause a cross site scripting vulnerability?
read more ...

Hello World !

Hello World !
Technorati Profile