Hackin9
A screenshot of an Android device that's been hacked by modifying the device manufacturer's application. The hack gives access to all permissions on the device.

Researchers said they've uncovered a security vulnerability that could allow attackers to take full control of smartphones running Google's Android mobile operating system.

The weakness involves the way legitimate Android applications are cryptographically signed to ensure they haven't been modified by parties other than the trusted developer, according to a blog post published Wednesday by researchers from mobile security startup Bluebox. The flaw has existed since at least the release of Android 1.6 almost four years ago. Hackers who exploit the vulnerability can modify app code to include backdoors, keyloggers, or other malicious functionality without changing the verification signature.

Malicious apps that exploit the vulnerability would enjoy the same system privileges as the legitimate one. That access could be especially dangerous if the app that's modified originated with the handset manufacturer or third parties that partner with the manufacturer, Wednesday's blog post said. That's because such apps are typically granted elevated privileges within the Android OS.

Read 4 remaining paragraphs | Comments

 
Yahoo has continued a major buying spree by acquiring Xobni, which offers products designed to help people keep better track of their contacts.
 
Vine, Twitter's mobile video service, has just gained several new features designed to make it easier to shoot with the app and to share videos more widely.
 
Microsoft's former head of Windows 8 development has agreed not to badmouth Microsoft or work for some of its competitors and in return will receive a payout for unvested stock in the company, according to a regulatory filing Wednesday.
 
Douglas Engelbart, a Silicon Valley engineer who invented the computer mouse and is credited with many of the concepts that underpin modern computing and the Internet, died on Tuesday at his home in Atherton, California. He was 88.
 

Hurry up for the World's Leading Regional Information Security Event: Black ...
The Herald | HeraldOnline.com
After the top level trainings on highly technical fields of information security, a one day summit will take place where the latest developments in infosec will be analyzed by global as well as local researchers. Industry trends pertaining to the ...

and more »
 
One provider of contact center services in Latin America sees cloud computing as critical to competing with much larger competitors.
 
InstantCMS 'index.php' Arbitrary PHP Code Execution Vulnerability
 
Oracle Java SE CVE-2013-2471 Buffer Overflow Vulnerability
 
Box, the red-hot provider of the eponymous cloud storage and file-sharing service, will boost the collaboration capabilities of its product in the next 18 months, and could become a publicly traded company next year or in 2015.
 
Oracle Java SE CVE-2013-2444 Remote Security Vulnerability
 
Oracle has quietly cut the list price of its flagship BI (business intelligence) Foundation Suite significantly, possibly in response to increased market competition.
 
Follow these simple steps to show your IT outsourcing provider a little love and get more attention than other customers in return (without giving away too much).
 
Twitter is working on some new approaches to offer more personalized ads to users, partly based on their online activity outside of the social network.
 
Google Chrome CVE-2013-2856 Use-After-Free Remote Code Execution Vulnerability
 
Google Chrome CVE-2013-2858 Use-After-Free Remote Code Execution Vulnerability
 
Google Chrome CVE-2013-2857 Use-After-Free Remote Code Execution Vulnerability
 
Google Chrome CVE-2013-2859 Unspecified Security Vulnerability
 
The Internet Corporation for Assigned Names and Numbers (ICANN) has approved a broad registry agreement that moves the organization forward in its efforts to offer more than 1,000 new generic top-level domains (gTLDs) for sale.
 
LinuxSecurity.com: USN-1890-1 introduced a regression in Firefox.
 
LinuxSecurity.com: Module::Signature could be made to run programs if it verified a signature.
 
LinuxSecurity.com: libvirt could be made to crash if it received specially crafted networktraffic.
 
LinuxSecurity.com: Several vulnerabilities were identified in Wordpress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the Wordpress package to the latest upstream version instead of [More...]
 
LinuxSecurity.com: A security vulnerability was discovered and fixed in php-radius. Fix a security issue in radius_get_vendor_attr() by enforcing checks of the VSA length field against the buffer size (CVE-2013-2220). [More...]
 

The security pitfalls of mining Big Data
USA TODAY
The security industry has come to collectively recognize the power of data analytics in significantly improving threat detection and many infosec teams are evolving their current security management models to incorporate Big Data techniques. CONTEXT ...

and more »
 
In an effort to further human and robot cooperation in space, a NASA astronaut aboard the International Space Station flying 240 miles above Earth controlled a robot on the ground.
 
Microsoft today said it had received "a few submissions" so far for its Internet Explorer 11 bug bounty program, the first for the company.
 
Apple's proposed 18-megawatt photovoltaic solar farm will power servers running in its Northern Nevada data center
 
Flaws in QuickTime lead Apple to release its third standalone security update for Mac OS X in 2013
    


 
RETIRED: Oracle Java Runtime Environment Multiple Unspecified Remote Code Execution Vulnerabilities
 

ISNR Abu Dhabi 2014 Latest Developments Announced
Zawya (registration)
The Information Security pavilion is supported by the UAE Telecommunications Regulatory Authority (TRA) and InfoSec Europe, Europe's most prominent and largest Information Security industry event. It will be the ideal new platform that will bring ...

 

Apple released Security Update 2013-003 yesterday.  

The key focus and fix is for a few buffer overflow conditions while using Quicktime software on the OS X platform.  
The impact is possible application crash or potential for arbitrary code execution.

Full details can be found here:   http://support.apple.com/kb/HT5806

 

-Kevin
--
ISC Handler on Duty

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
There's been an intrusion at Ubisoft in which unknown attackers gained access to customer data. Users of Ubisoft's services are advised to change their passwords
    
 
Nokia's latest low-cost phones, the 207 and 208, have integrated support for social networking as well as Exchange and can be turned into a USB modem.
 
Motorola today began promoting its highly-anticipated Moto X smartphone in newspaper ads and on its Web site
 
A vulnerability that has existed in Android for the past four years can allow hackers to modify any legitimate and digitally signed application in order to transform it into a Trojan program that can be used to steal data or take control of the OS.
 
For decades, IT vendors have offered small 's' solutions that were really bundles of hardware, software and services that they wanted to sell regardless of what customers actually needed. Now firms such as Dell, IBM and EMC are using analytics to help customers decide which products are best for their needs. Oracle, HP and others struggling with big 'S' solutions may get left behind.
 
At the sixth Sharkfest, Wireshark founder Gerald Combs looks back on 15 years of network analysis. His tool is now capable of handling 1,500 protocols and 120,000 field filters
    


 
EDItran Communications Platform (editcp) Remote Buffer Overflow Vulnerability
 
Multiple Vulnerabilities in Kasseler CMS
 
Multiple Vulnerabilities in OpenX
 

A campaign that forces sites running the Apache Web server to install highly malicious software on visitor's PCs has compromised more than 40,000 Web addresses in the past nine months, 15,000 of them in the month of May alone.

The figures, published Tuesday by researchers from antivirus provider Eset, are the latest indication that an attack on websites running the Internet's most popular Web server continues to build steam. Known as Darkleech, the rogue Apache module gets installed on compromised servers and turns legitimate websites into online mine fields that expose unsuspecting visitors to a host of dangerous exploits. More than 40,000 domains and website IPs have been commandeered since October, 15,000 of which were active at the same time in May, 2013 alone. In just the last week, Eset has detected at least 270 different websites exposing users to attacks.

Sites that come under the spell of Darkleech redirect certain visitors to malicious websites that host attack code spawned by the notorious Blackhole exploit kit. The fee-based package available in underground forums makes it easy for novices to exploit vulnerabilities in browsers and browser plug-ins. Web visitors who haven't installed updates patching those flaws get silently infected with a variety of dangerous malware titles. Among the malware that Darkleech pushes is a "Nymaim" piece of ransomware that demands a $300 payment to unlock encrypted files from a victim's machine. Other malware titles that get installed include Pony Loader and Sirefef.

Read 9 remaining paragraphs | Comments

 
There's been an intrusion at Ubisoft in which unknown attackers gained access to customer data. Users of Ubisoft's services are advised to change their passwords
    


 
Apple has hired Paul Deneve, until Tuesday the CEO of French luxury brand Yves Saint Laurent, to work as its vice president for special projects, igniting fresh speculation about possible new product launches including a TV or wearable computing devices such as a smart watch.
 
Internet Explorer 10 (IE10) jumped into second place among Microsoft's browsers last month, pushing past IE9 through an enforced upgrade.
 
Japan-based security software vendor Trend Micro is planning a rare foray into hardware, with a home storage device for managing photos from multiple cameras and smartphones.
 
ansible 'paramiko_ssh.py' Security Bypass Vulnerability
 

Information Security Risk Assessment Toolkit
Help Net Security
These "boxes" follow the mock real-life decisions and actions of Jane, a fictional CIO at a large healthcare organization, who is tasked with building up the org's information security program and consequently must first perform a thorough infosec risk ...

 
Chinese Internet giant Tencent is rolling out a global marketing campaign for its WeChat messaging app in a bid to expand the product's reach across 15 different markets, and boost its popularity among users outside China.
 
A simple piece of malicious software is circulating that steals Litecoins, a virtual currency based on the Bitcoin system.
 
The strike by San Francisco Bay Area transit workers this week is a clear and naked display of union power, something that's probably completely alien to tech professionals.
 
Apple's anticipated iWatch and Google Glass have provoked plenty of headlines, but a recent poll shows that a majority of well-heeled Americans with college degrees wouldn't consider buying or wearing such devices.
 
APPLE-SA-2013-07-02-1 Security Update 2013-003
 
Apache Tomcat CVE-2012-3544 Denial of Service Vulnerability
 
Multiple Vendors Multiple EAS Devices Private SSH Key Information Disclosure Vulnerability
 
Slots open for Security Projects :Open Source Showcase at AppSec Research / EU 2013
 

Walden University's Information Security Courses Receive NSA/CNSS National ...
NEWS.GNOM.ES
The nationally recognized certification indicates that students completing these courses will possess a working knowledge of INFOSEC principles and practices; an understanding of the threats and vulnerabilities of national security information systems ...

and more »
 
The International Astronomical Union vetoed a public vote to name one of Pluto's two most recently discovered moons Vulcan and named the moons Styx and Kerberos.
 
Chinese Internet giant Tencent is rolling out a global marketing campaign for its WeChat messaging app in a bid to expand the product's reach across 15 different markets, and boost its popularity among users outside China.
 
Over the first eight months of its current fiscal year, the ICS-CERT registered 200 attacks on SCADA – among the targets was a gas compressor station in the US
    


 
[security bulletin] HPSBUX02893 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remote Denial of Service (DoS), Cross Site Scripting (XSS)
 
[ MDVSA-2013:192 ] php-radius
 
[SECURITY] [DSA 2718-1] wordpress security update
 
[security bulletin] HPSBUX02889 SSRT101252 rev.1 - HP-UX Running Java, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities
 

Hurry up for the World's Leading Regional Information Security Event: Black ...
NEWS.GNOM.ES
After the top level trainings on highly technical fields of information security, a one day summit will take place where the latest developments in infosec will be analyzed by global as well as local researchers. Industry trends pertaining to the ...

and more »
 

Posted by InfoSec News on Jul 03

http://www.usatoday.com/story/cybertruth/2013/07/02/cybersecurity--training-on-the-rise-for-young-students/2482445/

By Robert R. Ackerman Jr.
Special for CyberTruth
USA Today
July 2, 2013

Amid rising sentiment that America's cyber security threat fully rivals
the terrorism threat, it is becoming time for U.S. citizens -- especially
younger citizens -- to educate themselves about cyber security and assume
part of the responsibility to...
 

Posted by InfoSec News on Jul 03

http://www.prweekus.com/failure-to-prepare-for-data-hacks-can-exacerbate-a-crisis-situation/article/300374/

By Terry Banks
FleishmanHillard
July 01, 2013

For many organizations, the prospect of a data breach is no longer if, but
when. Barely a week goes by without reports that a business, government
agency, or other institution, has had data – customer records, internal
communications, and financial files – stolen or exposed.

If your...
 

Posted by InfoSec News on Jul 03

http://www.csoonline.com/article/735805/researchers-mimic-board-game-to-bolster-computer-security

By Antone Gonsalves
CSO Online
July 02, 2013

University researchers have built a program that mimics the way people
play the memory game Concentration, opening the possibility of improving
computer security by distinguishing human behavior from bots.

The study, conducted by North Carolina State University researchers, sets
the groundwork for...
 

Posted by InfoSec News on Jul 03

http://www.infosecnews.org/ubisoft-database-compromised-recommends-changing-passwords/

By William Knowles
Senior Editor
InfoSec News
July 2, 2013

Ubisoft announced in a blog posting today that their systems had been
hacked and recommended everyone with a Ubisoft account change their
password, users can update their password here.

We recently discovered that one of our Web sites was exploited to gain
unauthorized access to some of our online...
 

Posted by InfoSec News on Jul 03

http://www.wired.com/threatlevel/2013/07/ipmi/

By Kim Zetter
Threat Level
Wired.com
07.02.13

Major vulnerabilities in a protocol for remotely monitoring and managing
servers would allow attackers to hijack the computers to gain control of
them, access or erase data, or lock others out. The vulnerabilities exist
in more than 100,000 servers connected to the internet, according to two
researchers.

The vulnerabilities reside in the...
 
The last high-profile Wi-Fi data breach was the assault on the TJX retail group in 2007, but that doesn't mean there is no risk
 
FastJar 'extract_jar()' Absolute Path Archive Extraction Directory Traversal Vulnerability
 
A simple piece of malicious software is circulating that steals Litecoins, a virtual currency based on the Bitcoin system.
 
Google is benefiting in terms of advertisement revenue from YouTube videos that depict and even promote dangerous or illegal activities, two state attorneys general in the U.S. have stated in a letter to the company.
 
Internet Storm Center Infocon Status