Information Security News

Hackers say Indian cyber spies stole US government passwords
Firstpost
Infosec Island's Anthony M Freed reported that one of “The Lords of Dharmaraja” hackers, who calls himself “YamaTough,” gave him 68 sets of usernames and passwords for US government network accounts. “YamaTough” told Freed the account data is just a ...
FBI investigates US-China group hackTG Daily

all 5 news articles »

People have been very friendly to TVs at the Consumer Electronics Show this week, talking to them, waving at them, occasionally stroking their screens.

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Apple abruptly canceled first-day sales of its iPhone 4S at one of its Beijing stores, prompting an irate customer to throw eggs at the building, and leaving others disappointed after waiting for a number of hours.

LightSquared is seeking an investigation of a federal official involved in deciding whether the company can deploy its hybrid satellite-LTE network, saying he simultaneously serves on the board of a GPS company opposing the network.

Ultrabooks are attracting admirers at the Consumer Electronics Show, but some attendees are waiting to buy the thin laptops until prices drop and Windows 8 is released later this year.

Social news site Reddit will black out its site for 12 hours on January 18 to protest the controversial Stop Online Piracy Act SOPA bill that is currently working its way through the U.S. House of Representatives.

TG Daily

FBI investigates US-China group hack
TG Daily
Meanwhile, the Lords of Dharmaraja hacking team told Anthony M. Freed of InfoSec Island that it was a pro-American group determined to publicize the inherent corruption plaguing the Indian political system. "My team is pro US, we fight for rights in ...

and more »

The controversial copyright enforcement bill the Protect IP Act may be amended on the Senate floor later this month in response to ongoing concerns about its provisions affecting Internet service providers and the domain-name system, the bill's chief sponsor said.

Phony Android application checks for running Carrier IQ software, but then sends SMS messages to a premium rate number.

The Navibot and TeleMe show where robotics could be going.

While some tablet makers are talking up the benefits of quad-core processors in their devices, Fujitsu has put a quad-core chip in a smartphone -- at least for a prototype version on display at CES.

A hacker from India has been arrested after stealing thousands from a private company via its hacked bank account. The incident which happened Bihar had apparently allowed the hacker to withdraw over $50,000 USD or RS 29 lakh.

OpFreePalestine has been causing all sorts of worries and troubles for Israel so far but now comes part 3 of the said to be 10 part database leak that has been slowly rolling out.

Gulf Times

Project to make Qatar 'botnet free'
Gulf Times
Infosec 2012, an Information Security conference, yesterday. “Partnerships have been established with service providers in this regard,” explained Khalid Sadiq al-Hashmi, executive director of Cyber Security at ictQATAR, in his welcome address at the ...

ZDI-12-016 : (0Day) HP Diagnostics Server magentservice.exe Remote Code Execution Vulnerability

ZDI-12-014 : HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution Vulnerability

Managing Information Security During an Innovation Void
CIO
Budget constraints certainly continue to be an issue even as the US economy plods along in recovery mode. However, the more disconcerting limiting factor is beyond the direct control of infosec executives:the scarcity of innovation in the information ...

and more »

As the Internet Corporation for Assigned Names and Numbers moves forward, despite ongoing concerns, with its decision to launch a program to sell new generic top-level domains, the organization should take new steps to protect trademarks and other intellectual property, a U.S. software trade group said Thursday.

If you wanted to share a Computerworld article with a tech colleague, what service(s) would you be likely to use?

Apple trumped all e-tailing rivals in mobile shopping satisfaction during 2011's holidays, but lost to Amazon on the Web, according to Michigan-based ForeSee Results.

Seeking to transform the way its staff communicates and collaborates worldwide, Banco Bilbao Vizcaya Argentaria (BBVA) will roll out Google Apps to its 110,000 employees, shedding along the way various legacy email systems, including Microsoft Exchange, a bank executive said in an interview.

In an effort to accommodate enterprise users looking to implement private and hybrid clouds, Cisco in the coming months will unveil an "integrated" WAN routing system of existing, but enhanced, products.

Nvidia showed tablets using its Tegra 3 quad-core processors at CES, including a developer prototype that was running Windows 8.

ZDI-12-015 : (0Day) HP StorageWorks P2000 G3 Directory Traversal and Default Account Vulnerabilities

ZDI-12-013 : HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution Vulnerability

ZDI-12-012 : (0Day) McAfee SaaS myCIOScn.dll ShowReport Method Remote Command Execution

Three House members today called for a Congressional hearing on the implications raised by the use of the Carrier IQ's software by wireless carriers.

IBM researchers have discovered a way to create a bit of data using only 12 iron atoms, which compares to today's magnetic data storage technology requiring about one million atoms for a single bit.

JBoss Cache 'NonManagedConnectionFactory.java' Local Information Disclosure Vulnerability

Wibu-Systems CodeMeter TCP Packets Denial of Service Vulnerability

Microsoft executives this week hinted at lowered expectations for Windows revenues in the fourth quarter of 2011, citing data from research firms that point to a stall in PC shipments at the end of 2011.

Lenovo's K800 smartphone running the Intel Atom processor was put on display at the International Consumer Electronics Show next to a reference design smartphone that could be used by Motorola and other smartphone makers.

[ MDVSA-2012:004 ] t1lib

Managing information security during an innovation void
CSO
But can the gap be closed by infosec professionals willing to seize the initiative? By Peter Kuper Although predictions for the coming year are a staple of the season, I will do more than offer an educated guess. I am going on the record with a ...

and more »

Oracle on Thursday rolled out an updated version of its TimesTen In-Memory Database, which is a key component of its upcoming Exalytics appliance as well as a competitor to SAP's HANA platform.

The new Droid Razr Maxx unveiled by Motorola during CES has a stunningly large battery that's nearly twice as powerful as others on the market.

Tools, services and support are available, but experts believe a watershed moment is what is needed to push enterprises into DNSSEC adoption.

Revised IETF I-D: IPv6 Neighbor Discovery, SEND, and IPv6 Fragmentation

AthCon 2012 CFP is now OPEN!

SafeSEH+SEHOP all-at-once bypass explotation method principles

Office arbitrary ClickOnce application execution vulnerability

Intelligence firm CEO apologizes for failing to properly secure customer credit card data and email addresses. Firm now outsources processes to third-party payment processor.

PR Web (press release)

EC-Council's Inaugural CISO Executive Summit Develops Guidelines to Address ...
PR Web (press release)
Co-chairs of “Structuring and Managing Your Infosec Workforce”, Jerry Chappee, Chief Information Assurance and Operations Officer for the US Army Reserve, and Jeffrey Vinson, Director and CISO of SecureNet Payment Systems, stated that one of the best ...

and more »

Stratfor slaps website back online after Anon mega-hack
Register
Strafor provides intelligence services for law enforcement agencies, among others, making them target for anti-sec hacktivists, who enjoy exposing the security failings of infosec consultancies and FBI affiliates. Various comments from the ...

and more »

GreenBrowser iframe content Double Free Vulnerability

[security bulletin] HPSBPI02698 SSRT100404 rev.2 - HP Easy Printer Care Software Running on Windows, Remote Execution of Arbitrary Code

[SECURITY] [DSA 2386-1] openttd security update

===============
Rob VandenBrink
Metafore (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

CloudFTP is a $100 gadget that addresses one of the most ubiquitous tech disconnects in recent memory: the lack of USB support on iPhones and iPads, which makes it a hassle to transfer data from a thumb drive to these popular devices.

BBVA, one of Spain's largest banks, is moving desktop applications to Google Apps' cloud computing systems.

Say youre writing a long Windows CMD script, something like an audit script thatll take a good 20-30 minutes to complete.
Now say the whole script is being redirected to a report file - as scripts get more complicated, I'm finding that almost everything Iwrite ends up doing this. Something like below (just to pick a random SEC579 example):

audit-esx.cmd servername userid password reportfile.html
If all goes well, you see *nothing* on your screen for the next 20+ minutes (unless youve got a good port of tee available) but if it gets stuck, it's going to be 20+ minutes, or likely longer, before you realize that your script is borked
What to do? What to do? - - Use STDERR !
As the script goes through, insert an echo for each test (or meaningful phase) in your script to STDERR:

echo Audit Check SomeMeaningfulName 2
or, if youve parameterized your script enough:

echo Check %CHK% 2
2 means send this to STDERR.
So, instead of a blank screen as the audit runs, the screen will be a show you useful info on it's progress:

C:\sans\sec579\auditaudit-vms esx01.sec579.com root Passw0rd esx01-audit-vms.html

Audit Check VMX01

Audit Check VMX02

Audit Check VMX10

Audit Check VMX11

Audit Check VMX12

Audit Check VMX20

Audit Check VMX21

Audit Check VMX22

and so on, until it's done
Another neat trick will allow you to echo to a file ANDto STDERR in windows. The example below will take the output of somecommand, echo it to STDERR(which you'll see on the screen), and also echo it to the file outputfile.txt

somecommand 2 outputfile.txt
In linux, I'd normally do this using tee as mentioned, mostly because I'm lazy. The problem in this case with using tee is that it goes to STDOUT, rather than to STDERR, so if you're using it in combination with other redirection, you may not get what you expect:

somecommand |tee outputfile.txt
To fix this, you might string your command serially with cat, but that means that you won't see the command output on STDERRuntil the command is completely finished, rather than in (more or less)real time.

somecommand cat outputfile.txt 2
To see everything at the same time, I'll still use tee, but we'll also use a temp file descriptor (3) and dump the STDOUToutput of tee to STDERR, as shown below

(somecommand | tee outfile.txt) 32

Ihope this was useful - if you've got a neat take on using STDERR, or STDIN or STDOUTfor that matter, in Windows (or *nix)scripts, by all means pass them along in our comment form !
===============

Rob VandenBrink

Metafore (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

A mobile TV effort by local broadcasters in the U.S. is entering a new phase, with two large groups of stations showcasing new partnerships at the International Consumer Electronics Show, but the initiative still faces major hurdles.

Open-source BI (business intelligence) vendor Jaspersoft wants its software to become another arrow in the quiver for developers using commercial PaaS (platform-as-a-service) offerings.

Smartphones using quad-core processors may not have made a splash at this year's Consumer Electronics Show in Las Vegas, but the devices will be coming in a few months, Nvidia said at the show.

As wireless access is added to new types of devices, Ericsson is reorganizing its licensing department in an effort to make more money from its patents, the company said on Thursday.

In whats been done due to bordem and lulz, @LulzOps has dumped a small amount of accounts on pastebin.

A hacker going by the handle of [email protected] has dumped over 3500 accounts from a popular file sharing website fileden.

@TehMaskz has continued to fight towards the #NDAA and FEMA camps by hacking a well known mother board supplier website and dumping admin accounts online.

A Catholic website has become the victim of SQLi hackers who have used the well known tool Havij to exploit the site.

Over the past few months its come to light that the DHS has been using different types of social media to obtain possible information to trending situations. This comes as a worry with many jokers, trolls and real threats its going to be almost impossible for them to follow them all, which would mean they may end up with disinformation.

Microsoft investigated a workers protest at its contract manufacturer Foxconn Technology Group, and found that the dispute in Wuhan, China was related to staffing assignments and transfer policies, the company said Thursday.

Advanced Micro Devices demonstrated its upcoming mobile chips for thin-and-light laptops, which the company said will lead to cheaper but equally speedy alternatives to Intel's expensive ultrabooks.

Justin Bieber caused a minor scrum on the floor of the Consumer Electronics Show Wednesday when he stopped by to launch a dancing robot for Vietnamese toy and robotics designer Tosy.

Verizon used the Consumer Electronics Show in Las Vegas as an opportunity to show off some of the unique applications and products being developed on its LTE network.

Infosys cut its revenue growth forecast for its fiscal year ending March 31, citing slowing demand in Europe which is hit by a debt crisis.

The question of whether there are too many smartphone variations on the market came up during a panel discussion Thursday at CES.

Cashing in on the ultrabook excitement at the International Consumer Electronics Show (CES), Lenovo has rolled out four of its own slimmed-down models, including one geared specifically for the enterprise.

Microsoft PowerPoint Malformed Record Remote Code Execution Vulnerability