Hackin9

RSA Highlights the Changing Face of Infosec
CSO Magazine (blog)
"If you look a the demographics of where those people are from, the companies their from – it's not just big financial services companies or Fortune 100s, it people from utilities. If you asked who were the most progressive people in infosec you would ...

 
Seagate Technology thinks the storage capacity could be larger in tablets, most of which come with a relatively small amount of native storage.
 
LinuxSecurity.com: Updated openstack-nova packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. [More...]
 
LinuxSecurity.com: Updated openstack-swift packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Moderate [More...]
 
LinuxSecurity.com: Updated openstack-glance packages that fix one security issues and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Moderate [More...]
 
LinuxSecurity.com: Updated mongodb packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Moderate [More...]
 
LinuxSecurity.com: Updated postgresql packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...]
 
LinuxSecurity.com: Updated openstack-packstack packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. [More...]
 
NASA's $17.5 billion proposed fiscal 2015 budget would maintain the U.S. space agency's plan to send humans to Mars by 2030, to study near-Earth asteroids and to send astronauts to the International Space Station.
 
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
How can you keep critical data safe when disaster strikes? There is no one magic answer, but there are steps your business can and should take to protect important files and applications in the event of a disaster.
 
Synology DiskStation Manager VPN Module Hardcoded Password Security Bypass Vulnerability
 
More and more corporate IT departments around the world are straining under the weight of unnecessary software applications, according to a survey by systems integrator Capgemini.
 
Facebook is reportedly buying Titan Aerospace, a New Mexico-based company known for making solar-powered drones.
 
Lowering the price of an operating system upgrade boosts its uptake five-fold, but pushing it out for free speeds uptake as much as 12 times, data from an analytics company shows.
 
 

Researches have released a paper describing several vulnerabilities in TLS (Transport Layer Security). Some of the attacks have been known for a while, but the paper combines and explains them nicely, and also adds a couple of really clever new ideas. The tricks rely on cutting sessions off and re-starting them in a way that client and server end up with a different (security) state. The full research is available here https://secure-resumption.com/. The good news is that (a) the main impact is apparently limited to connections that use client-side certificates, which is rare, and (b) the researchers have informed the browser vendors early on, and some browsers and TLS libraries are already patched.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Privacy Act audits will consider infosec budgets
iT News
The Australian Privacy Commissioner will take into account the size of an organisation's wallet when it cracks down on hacked companies under the tougher Privacy Act set to come into force next week. Small organisations across Australia with revenues ...

and more »
 
Both MirrorLink and Apple's new CarPlay will eventually be able to duplicate some iPhone functions on a car's in-vehicle infotainment system. But MirrorLink can also handle Android, Windows and Blackberry phones.
 
OCZ Storage Solutions is starting a new chapter in its enterprise operations with shipments of a new line of solid-state drives (SSDs) that offer maximum storage capacity of 3.2TB.
 
[slackware-security] gnutls (SSA:2014-062-01)
 
ALLPlayer Remote Buffer Overflow Vulnerability
 
OpenStack Keystone Trustee Token Revocation Failure Security Bypass Vulnerability
 
Adobe Flash Player and AIR CVE-2014-0498 Remote Stack Overflow Vulnerability
 
[CVE-2014-0072] Apache Cordova File-Transfer insecure defaults
 
[CVE-2014-0073] Apache Cordova In-App-Browser privilege escalation
 
JOIDS (Java OpenID Server) multiple vulnerabilities
 
Flexcoin, a site that described itself as the "world's first bitcoin bank," has closed after it got hacked and all of the bitcoins it had placed in online storage were stolen, the site recently announced.
 
 

Hundreds of open source packages, including the Red Hat, Ubuntu, and Debian distributions of Linux, are susceptible to attacks that circumvent the most widely used technology to prevent eavesdropping on the Internet, thanks to an extremely critical vulnerability in a widely used cryptographic code library.

The bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates included in Internet discussions such as this one indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn't be surprising if the actual number is much higher. Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers.

The bug is the result of commands in a section of the GnuTLS code that verify the authenticity of TLS certificates, which are often known simply as X509 certificates. The coding error, which may have been present in the code since 2005, causes critical verification checks to be terminated, drawing ironic parallels to the extremely critical "goto fail" flaw that for months put users of Apple's iOS and OS X operating systems at risk of surreptitious eavesdropping attacks. Apple developers have since patched the bug.

Read 8 remaining paragraphs | Comments

 
GnuTLS CVE-2014-0092 Certificate Validation Security Bypass Vulnerability
 
GnuTLS Certificate Validation Security Bypass Weakness
 
Apple's chief financial officer, Peter Oppenheimer, a long-familiar voice to Wall Street on the company's quarterly earnings calls, will retire at the end of September.
 
After testing a preview version of the Outlook.com-Skype integration for almost a year in some markets, Microsoft has now made it generally available to all users.
 
 
Thanks to its 2012 acquisition of Polymita, Red Hat has added major functionality to its software suite for managing business processes, making the package an appealing choice in the enterprise market for BPM (business process management) software.
 
LinuxSecurity.com: Fraudulent security certificates could allow sensitive information tobe exposed when accessing the Internet.
 
Apache Camel CVE-2014-0003 Remote Code Execution Vulnerability
 
Microsoft has completed a series of moves aimed at making its Dynamics AX ERP software a more viable option for large enterprises, and plans to showcase them this week during the Convergence conference in Atlanta.
 

Flexcoin, which proclaimed itself to be the "world's first bitcoin bank" and the solver of "nearly every problem that exists with the Bitcoin currency today," says it has shut down after a robbery. An attacker made off with 896 bitcoins, the equivalent of about $620,000 at today's exchange rates.

A statement on Flexcoin's website read as follows:

On March 2nd 2014 Flexcoin was attacked and robbed of all coins in the hot wallet. The attacker made off with 896 BTC, dividing them into these two addresses:

1NDkevapt4SWYFEmquCDBSf7DLMTNVggdu

1QFcC5JitGwpFKqRDd9QNH3eGN56dCNgy6

As Flexcoin does not have the resources, assets, or otherwise to come back from this loss, we are closing our doors immediately.

The "hot wallet" is what exchanges use to pay out withdrawals instantly. Bitcoins deposited by users are put into "cold storage." Flexcoin said it will help these users get their coins back. "Users who put their coins into cold storage will be contacted by Flexcoin and asked to verify their identity," the bank said. "Once identified, cold storage coins will be transferred out free of charge. Cold storage coins were held offline and not within reach of the attacker."

Read 5 remaining paragraphs | Comments

 
MediaWiki CVE-2014-2243 Information Disclosure Vulnerability
 
PostgreSQL CVE-2014-0063 Remote Stack Buffer Overflow Vulnerability
 
Chip maker Broadcom has announced a new specification along with software and APIs to improve the performance of OpenFlow switches and to make it easier for hardware vendors to build products.
 
Advanced Micro Devices' Sempron processor brand has polarized chip fans since its 2004 introduction in laptops, but a fresh batch of the processors is being targeted at its desktop fan base.
 
Cordova and PhoneGap Multiple Security Bypass Vulnerabilities
 
CMS Made Simple CVE-2014-0334 Multiple Cross Site Scripting and HTML Injection Vulnerabilities
 
MantisBT 'adm_config_report.php' SQL Injection Vulnerability
 
VCDGear Cue File Handling Multiple Buffer Overflow Vulnerabilities
 
Cisco Intrusion Prevention System CVE-2014-2103 Denial of Service Vulnerability
 
Even if a company were willing to expunge personal data that it had been authorized to collect, the realities of IT systems mean it probably could never completely do that.
 
The only limit to the Internet of Things isn't imagination or technology. It's interoperability. And the Linux Foundation thinks that's an issue it can help fix.
 
You don't always need high-end tools like Python or OpenRefine to reformat data. Plain old Excel can do the job.
 
Sprint has been sued in a federal court for allegedly overcharging federal law enforcement agencies for surveillance related services by over 50%.
 
Empty-handed customers of bankrupt bitcoin exchange Mt. Gox are being targeted in a ploy likely intended to distributed malware.
 
Premier 100 IT Leader Stuart Kippelman also answers questions on career growth.
 

Posted by InfoSec News on Mar 04

http://www.lasvegassun.com/news/2014/feb/28/las-vegas-sands-some-customer-data-was-stolen-hack/

By Hannah Dreier
Associated Press
Feb. 28, 2014

Computer hackers stole some Las Vegas Sands customers' Social Security and
driver's license numbers during a data breach earlier this month, the
casino company said Friday.

Las Vegas Sands Corp. said in a statement that the information about some
patrons at its Bethlehem, Pa., hotel-casino...
 

Posted by InfoSec News on Mar 04

http://www.itproportal.com/2014/03/04/are-we-about-to-witness-a-full-on-cyber-war-between-russia-and-ukraine/

By Fahmida Y. Rashid
ITProPortal
04 Mar 2014

Russia has invaded Ukraine. Well, at least the province of Crimea. Are we
about to see cyber-war unfold?

After months of hearing about cyber-war, cyber-espionage, and attacks
against critical infrastructure, it's only natural to wonder if the
physical conflict between Russia and...
 

Posted by InfoSec News on Mar 04

http://www.v3.co.uk/v3-uk/news/2331953/hackers-hijack-300-000-soho-routers-with-man-in-the-middle-attacks

By Alastair Stevenson
V3.co.uk
04 Mar 2014

Researchers at the security firm Team Cymru have traced a campaign that
has successfully compromised 300,000 small office and home office (SOHO)
routers using man-in-the-middle attacks to two UK IP addresses.

The research team reported the campaign in its SOHO Pharming white paper,
confirming...
 
GnuTLS DTLS Information Disclosure Vulnerability
 
 
Internet Storm Center Infocon Status