InfoSec News

Software security consultancy Cigital has acquired Consciere, bringing in security veterans Joel Scambray and Kevin Rich.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google
 
Now that the dust has settled from yesterday's Worldwide Developer Conference keynote, I can safely say iOS 5 will be a huge win for Apple. Playing around with some of the new features such as Notification Center and iCloud on my iPad 2 re-invigorates my excitement for developing for the iOS platform. In many ways iOS 5 has already exceeded expectations- out of my top five wish list last week, Apple knocked three of them out of the park. There were however, two glaring omissions. This is what they are and why they were left on the bench for now.
 
When I first hauled out the Acer Aspire 8950G from the backpack, I almost dropped it--not because it was that heavy, but because it was lighter than expected. This massive (I hesitate to say "notebook") desktop replacement system sports an 18.4-inch, true 1080p LCD panel. At 8 pounds, 5 ounces without the power brick, it's lighter than some smaller systems that have been through the lab here. Even with the 120-watt power supply, the weight falls just a little short of 10 pounds.
 
IPv6 day officially started at midnight GMT. Over the next 24 hrs, a number of large web sites will be reachable via IPv6. For example Google, Yahoo and Facebook added AAAA records.
You can check yourself if you are able to receive the AAAA records with this nslookup command:

nslookup
set type=AAAA
www.facebook.com

Non-authoritative answer:
www.facebook.com has AAAA address 2620::1c08:4000:face:b00c:0:2


The next 24 hrs bring a unique opportunity to test IPv6 and to experiment with it. I recommend that you setup at least a test system and attempt to connect to IPv6 via a tunnelbroker. You may also be able to use auto-configured 6-to-4 but it tends to be less reliable. See the end of this article for a number of free tunnel brokers.
Things to test:

ping Google: on unix, use ping6 www.google.com, on Windows, ping -6 www.google.com
measure latency via IPv4 and IPv6 and compare.
test if you can reach various IPv6 sites (http://isc.sans.edu has been dual stack for a while now)
can you detect the traffic with whatever tools you use (snort, tcpdump, windump, wireshark...)

More information about IPv6 day:
http://ipv6day.org
Tunnelbrokers:

http://www.ipv6day.org/action.php?n=En.GetConnected-TB







------

Johannes B. Ullrich, Ph.D.

SANS Technology Institute

Twitter (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Combining social media with location services and mobile phones represents the next generation of online marketing, according to speakers at the Search Marketing Expo in Seattle on Tuesday.
 
RETIRED: Oracle Java SE and Java For Business June 2011 Advance Notification
 
Apache Web Server Multiple Module Local Buffer Overflow Vulnerability
 
IT outsourcing is on the rise and for good reason. There are notable benefits associated with it such as gaining greater flexibility in meeting customer demands regionally or nationally, changing fixed costs to variable costs, extending expertise beyond internal resources, improving risk management and so on.
 
A Maine judge's ruling in a case involving a business that sued its bank after losing $345,000 in a cyber heist could set a precedent about how diligent companies must be in protecting their assets online.
 
Hewlett-Packard CEO Leo Apotheker announced at a user conference in Las Vegas that the company is setting aside $2 billion to help customers buy its cloud systems.
 
The Internet has been rolling along for decades on the strength of IPv4 and its numbering system, which has supplied billions of addresses. But the booming popularity of the Internet has finally soaked up nearly all those fresh numbers. On Wednesday, World IPv6 Day will turn the new protocol on at hundreds of companies, agencies and universities for testing.
 
Twitter is becoming an increasingly important tool for marketing and search optimization and experts are learning more about how to best use the service, they said Tuesday during a panel at Search Marketing Expo in Seattle.
 
A small number of Internet users will experience delays or time-outs as they attempt to visit Facebook, Google, Yahoo and other popular websites tonight and tomorrow, due to a 24-hour trial of a new Internet standard called IPv6.
 
Apple is letting customers try out one feature of its upcoming iCloud months before the service is set to debut.
 
Google is tying its Analytics and Webmaster Tools applications more closely together in an effort to give Web publishers a joint view of internal site traffic and search engine optimization data.
 
Google has started using individual authors, not just the publications they write for, as one of its criteria for ranking search engine results.
 
On Monday, Apple said it would sell OS X 10.7, aka 'Lion,' next month through its own Mac App Store for $29.99. Here's what you need to know to upgrade.
 
After helping to hatch the plan for World IPv6 Day set for Wednesday, a senior network engineer at Facebook is raring to test the site's reworked network.
 
Mike Butler, executive vice president and chief operating officer at Providence Health and Services, explains ERM's benefits from his point of view. [Part of CSOonline's special report on enterprise risk management and organizational models.]
 
Sybase EAServer Unspecified Directory Traversal Vulnerability
 
Tor Directory Authority 'src/or/policies.c' Denial of Service Vulnerability
 
Do you know the butterfly effect? Well, there are billions of butterflies in the world, and you want to keep an eye on the ones that, according to the chaos theory, are about to flap their wings and start a chain of events that will eventually result in a hurricane half a world away. In business, those butterflies go by many names: counter-party risk, supply chain disruption, natural disaster, compliance, regime change, Anonymous, and many, many more. The bigger the organization, the more butterflies there are to worry about.
 
Autonomy KeyView Filter ZIP File Viewer Buffer Overflow Vulnerability
 
Autonomy KeyView LZH Archive File Buffer Overflow Vulnerability
 
Autonomy KeyView Filter RTF Hyperlink Buffer Overflow Vulnerability
 
Following a retooling of its manufacturing and supply chain management processes, RSA plans to replace security tokens for high risk customers.

Add to digg Add to StumbleUpon Add to del.icio.us Add to Google
 
------

Johannes B. Ullrich, Ph.D.

SANS Technology Institute

Twitter (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
What do you get when you combine the roles of software developer, statistician and data analyst? A data scientist, who can derive tangible insights from huge quantities of data.
 
A new document in a year-old patent lawsuit filed by Oracle against Google over Android intellectual property suggests Oracle could be seeking huge damages from Google.
 
Error handling and trace logs are as old as the hills. Of course this is handled in the clouds, right?? Keep laughing...
 
Dell announced a new appliance that allows its block-based storage area network to store file-based data under one unified management interface.
 
Apache CouchDB Web Administration Interface Cross Site Scripting Vulnerability
 
Paul Maritz, CEO of VMware, sees virtualization as one piece of the platform VMware intends to offer a mobile, cloud-enabled world
 
Three Romanian men and one Austrian man were indicted on Monday by U.S. federal prosecutors for allegedly stealing more than $1.5 million by cloning payment cards with stolen account information.
 
Riverbed today announced three new WAN optimization appliances targeted at backing data up to the cloud.
 
SharePoint has become vital to the business infrastructure and, in many companies, it's even used as the company's face to the world: its public facing website. Because of this dependency and high visibility, a well-thought-out disaster recovery strategy for SharePoint is imperative.
 
[ MDVSA-2011:107 ] fetchmail
 
Multiple Cross-Site Scripting vulnerabilities in BLOG:CMS
 
ZDI-11-181: Novell iPrint op-printer-list-all-jobs url Remote Code Execution Vulnerability
 
ZDI-11-180: Novell iPrint op-printer-list-all-jobs cookie Remote Code Execution Vulnerability
 

Lunarline Now Offers CNSSI 4012 Certification in their Training Program
PR Newswire (press release)
Additionally, the coursework continues to meet the standards for the National Training Standard for Information Systems Security (INFOSEC) Professionals and System Certifiers (NSTISSI 4011 and 4015 certifications). Students receive a certificate for ...

and more »
 
ZDI-11-179: Novell iPrint nipplib.dll iprint-client-config-info Remote Code Execution Vulnerability
 
ZDI-11-178: Novell iPrint nipplib.dll client-file-name Remote Code Execution Vulnerability
 
ZDI-11-177: Novell iPrint nipplib.dll core-package Remote Code Execution Vulnerability
 
ZDI-11-176: Novell iPrint nipplib.dll driver-version Remote Code Vulnerability
 
TeliaSonera's 4G network comes out on top when pitched against Three's new HSPA+ (High-Speed Packet Access) network in central Stockholm, with average download speeds at 57.1M bps (bits per second) and 13.7M bps.
 
Keeping your kids safe online can be a full-time job. But it's one that's made a lot easier with AVG Family Safety ($20, buy-only; temporarily available for a $1 Red Cross Donation), a comprehensive parental control solution that works well in multi-computer homes.
 
An alliance of companies that claim more than $100 million in annual buying power have created standards for cloud computing services.
 
Research in Motion has added several new features to its PlayBook tablet, but it continues to lack native email capabilities demanded by many users.
 
AMP will hold its annual Amplify innovation event this week and IT leaders will exchange crowdsourced ideas with the rank and file. CIO, Lee Barnett, spoke with CIO about how IT and business can benefit from all variety of industries.
 
Have you ever wondered if Microsoft Excel was invented by a sadist?
 
Millions of Skype users were having trouble on Tuesday signing into the application, less than two weeks after the company published software updates for Windows and Mac computers to fix a similar problem.
 
Fetchmail Debug Mode With Multichar Locale Remote Denial of Service Vulnerability
 
RSA issued a press release, offering to replace all tokens if a customer asks for it. As an alternative, RSA also offers to implement additional authentication monitoring.
Aside from the press release, and an interview with the RSA CEO, there have not been any details about how this would work or how long it will take. However, RSA states that this will cover all customers, even if RSA considers them not at risk.

------

Johannes B. Ullrich, Ph.D.

SANS Technology Institute

Twitter (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Intel's upcoming Medfield chip will be an acid test of the chip maker's ability to enter the smartphone market and battle ARM, analysts said.
 
Hacker group Anonymous has come out in support of a civil movement against corruption in India by hacking one of the websites of a government IT organization.
 
Apple told MobileMe subscribers Monday that the sync and storage service will be shuttered next year.
 
Sony opened its E3 press conference Monday with an apology for the multi-week PlayStation Network outage.
 
Acer on Tuesday started shipping three new Aspire laptops, including a thin-and-light laptop around an inch thick and priced from US$779.99.
 
In an acknowledgement of the severity of its recent computer compromise, RSA Security it will replace SecureID tokens for any customer that asks.
 
GNOME Display Manager URI Scheme Handler Local Privilege Escalation Vulnerability
 
Although many of the features Apple talked up Monday during the WWDC keynote could be a boon to enterprise IT shops, some could pose security challanges, says columnist Ryan Faas.
 
Current PaaS offerings focus mainly on individual developers, but analysts expect enterprise-class offerings to emerge
 
Linux Kernel DCCP Option Length Remote Denial of Service Vulnerability
 
Internet Storm Center Infocon Status