Hackin9
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Google just released a software update for its wearable computer, Glass, adding security tools, Hangouts and a YouTube feature.
 

Download the relevant updated version from: http://www.wireshark.org/download.html

   The following vulnerabilities have been fixed.
     * [1]wnpa-sec-2013-66
       The SIP dissector could go into an infinite loop.
       Discovered by Alain Botti. ([2]Bug 9388)
       Versions affected: 1.10.0 to 1.10.3, 1.8.0 to 1.8.11
       [3]CVE-2013-7112
     * [4]wnpa-sec-2013-67
       The BSSGP dissector could crash. Discovered by Laurent
       Butti. ([5]Bug 9488)
       Versions affected: 1.10.0 to 1.10.3
       [6]CVE-2013-7113
     * [7]wnpa-sec-2013-68
       The NTLMSSP v2 dissector could crash. Discovered by Garming
       Sam.
       Versions affected: 1.10.0 to 1.10.3, 1.8.0 to 1.8.11
       [8]CVE-2013-7114

Cheers,
Adrien de Beaupré
Intru-shun.ca Inc.
My SANS Teaching Schedule

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Intel's acquisition of mobile network assets from silicon vendor Mindspeed Technologies will give the chip giant what it needs to extend the Intel architecture throughout mobile operator networks, helping the carriers upgrade hardware and roll out new services more quickly, according to Intel.
 
NASA has postponed the launch of a mission to resupply the International Space Station so it can focus on undertaking three spacewalks to fix a glitch in the orbiter's cooling system.
 
Wireshark TCP Dissector CVE-2013-6340 Denial of Service Vulnerability
 
For decades, scientists have fantasized about creating robots with brain-like intelligence. This year, researchers tempted by that dream made great progress on achieving what has been called the holy grail of computing.
 
The 2014 Cybersecurity Innovation Forum, to be held January 28-30, 2014, at the Baltimore Convention Center in Baltimore, Md., will focus on the existing threat landscape and provide presentations and keynotes on current and emerging ...
 
U.S. District Court Judge Richard Leon's ruling in a case challenging the National Security Agency's bulk collection of phone records sets up what's likely to be a contentious legal fight over government surveillance in the U.S.
 
Microsoft won't select and announce a new CEO this year, the director who leads the search said today.
 

Like most mainstream operating systems these days, fully patched installations of Linux provide a level of security that requires a fair amount of malicious hacking to overcome. Those assurances can be completely undone by a single unpatched application, as Andre' DiMino has demonstrated when he documented an Ubuntu machine in his lab being converted into a Bitcoin-mining, denial-of-service-spewing, vulnerability-exploiting hostage under the control of attackers.

A security researcher with George Washington University, DiMino noticed several IP addresses attempting to hijack the Linux server by exploiting a now-patched PHP flaw that gave attackers the ability to remotely execute commands on vulnerable machines. DiMino was curious to know what the people behind the attacks intended to do with his machine, so he set up a "honeypot" box that, for research purposes, ran an older version of the Web development language.

The attackers' HTTP POST request contained a variety of commands that in short order downloaded a Perl script that was disguised as a PDF document file, executed it, and then deleted it. To ensure success, the attackers repeated the steps using the curl, fetch, lwp-get requests. The Perl script was programmed to sleep for periods of time, presumably to prevent administrators from noticing anything amiss. Eventually, the compromised machine connected to an Internet relay chat channel, where it downloaded another script and executed it. Then he ran forensic software and snapped lots of screen shots so everyone could follow along.

Read 5 remaining paragraphs | Comments


    






 
 
Google and Hewlett-Packard have recalled the micro-USB chargers of their Chromebook 11 due to fire and burn hazards, an example of an innovation that turned into a problem.
 
Kurt DelBene, the retired president of Microsoft's Office Division, will take over the U.S. Department of Health and Human Services' insurance shopping site, HealthCare.gov.
 
Facebook, in a move poised to give a major boost to its position as a mass media platform, will soon start placing video ads into users' feeds.
 
Apple has apparently decided to kill support for OS X Snow Leopard, the 2009 operating system that has resisted retirement for more than a year.
 
Developers who want to work with one of the first 64-bit ARM server chips can now order an AppliedMicro board with its X-Gene chip.
 
OpenStack Compute (Nova) CVE-2013-4469 Incomplete Fix Denial of Service Vulnerability
 
Amazon Web Services hopes enterprises are willing to rely on the company when getting large amounts of data ready for analysis with its latest service, Kinesis.
 
[slackware-security] ruby (SSA:2013-350-06)
 
Hancom Office '.hml' file heap-based buffer overflow
 
[slackware-security] seamonkey (SSA:2013-350-07)
 
Mobile, Web- and cloud-based companies could also face class-action lawsuits. Here's how to prepare for that possibility. Insider (registration required)
 
Cloud computing is increasingly becoming the rule and not the exception for application deployment. This will make 2014 an interesting and disruptive year for vendors, service providers and IT organizations grappling with this change.
 
Sprint and DISH Network announced plans to try out a high-speed fixed wireless broadband service in Corpus Christi, Texas, that would be available in mid-2014.
 
[SECURITY] [DSA 2820-1] nspr security update
 
[slackware-security] mozilla-thunderbird (SSA:2013-350-05)
 
[slackware-security] mozilla-firefox (SSA:2013-350-04)
 
[slackware-security] llvm (SSA:2013-350-03)
 
LinuxSecurity.com: New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. [More Info...]
 
LinuxSecurity.com: New mozilla-firefox packages are available for Slackware 14.1 and -current to fix security issues. [More Info...]
 
LinuxSecurity.com: New libjpeg packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. [More Info...]
 
LinuxSecurity.com: New llvm packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. [More Info...]
 
LinuxSecurity.com: New mozilla-thunderbird packages are available for Slackware 14.1 and -current to fix security issues. [More Info...]
 
LinuxSecurity.com: New ruby packages are available for Slackware 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. [More Info...]
 
LinuxSecurity.com: New libiodbc packages are available for Slackware 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. [More Info...]
 
LinuxSecurity.com: DjVuLibre could be made to crash or run programs as your login if it openeda specially crafted file.
 
LinuxSecurity.com: Updated nodejs010-nodejs packages that fix one security issue are now available for Red Hat Software Collections 1. The Red Hat Security Response Team has rated this update as having moderate [More...]
 
LinuxSecurity.com: Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6.2, 6.3, and 6.4 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More...]
 
LinuxSecurity.com: Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 Long Life, and Red Hat Enterprise Linux 5.6 and 5.9 Extended Update Support. [More...]
 
LinuxSecurity.com: It was discovered that NSPR, Netscape Portable Runtime library, could crash an application using the library when parsing a certificate that causes an integer overflow. This flaw only affects 64-bit systems. [More...]
 
AST-2013-007: Asterisk Manager User Dialplan Permission Escalation
 
QuickHeal AntiVirus 7.0.0.1 - Stack Overflow Vulnerability
 
Instagram is going to let you send messages and images to small subsets of your friends and family. It's a clever way to get more of your data into the hands of marketers.
 
APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1
 
AST-2013-006: Buffer Overflow when receiving odd length 16 bit SMS message
 
FileMaster SY-IT v3.1 iOS - Multiple Web Vulnerabilities
 
APPLE-SA-2013-12-16-2 OS X Mavericks v10.9.1
 

Apple have released the following security advisories and updates for Mac OS X and Safari. OS X Mavericks v10.9.1 and APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1. More information will be available from their web site: http://support.apple.com/kb/HT1222

Cheers,
Adrien de Beaupré
Intru-shun.ca Inc.
My SANS Teaching Schedule

(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
An appeals court has ruled against a Motorola Mobility bid to declare invalid a Microsoft patent that figures in an import ban by the U.S. International Trade Commission on certain Motorola mobile phones.
 
Anyone who was hoping to sneak in an Internet voice call over JetBlue's new in-flight Wi-Fi service had better make other plans, because the airline now plans to enforce its ban on voice calls in the air.
 
Apple on Monday updated OS X Mavericks for the first time since it released the free upgrade eight weeks ago, patching a handful of security vulnerabilities in Safari and addressing issues with Gmail and Contacts.
 
U.S. President Barack Obama, hoping to repair some of the damage wrought by the troubled Healthcare.gov site, will meet with executives from technology companies including Yahoo and Twitter on Tuesday.
 
Semiconductor company Avago Technologies has agreed to buy storage and networking company LSI for $6.6 billion in an effort to expand its data center offerings.
 
Joomla! MijoSearch Cross Site Scripting and Path Disclosure Vulnerabilities
 
LiveZilla Multiple HTML Injection Vulnerabilities
 
A pension investment group has sued IBM, claiming that the company failed to warn investors that sales in China would slow dramatically following revelations that IBM was helping the U.S. National Security Agency spy on the Chinese.
 

Posted by InfoSec News on Dec 17

http://www.manufacturing.net/articles/2013/12/shutting-the-door-on-shodan

By Alan Grau
Icon Labs
12/16/2013

Shodan, "the scariest search engine on the Internet" according to CNN
Money, is a search engine scouring the Internet looking for servers,
webcams, printers, routers and all the other devices that are connected
to, and make up, the Internet of Things. Searches on Shodan can find a
stunning amount of information. Would-be...
 

Posted by InfoSec News on Dec 17

Until January 15, 2014, your company can post jobs on HotInfoSecJobs.com
for 50% off our normal rate of $99 for 31 days by using the discount code -
XMAS2013

http://www.hotinfosecjobs.com/

At HotInfoSecJobs.com we pride ourselves on creating an excellent overall
experience for InfoSec job seekers and employers. Postings cost just $99
and all jobs are cross-posted to popular sites like SimplyHired & LinkedIn
for FREE. Its like getting...
 

Posted by InfoSec News on Dec 17

http://www.computerworld.com/s/article/9244828/Attackers_use_ColdFusion_flaw_to_install_Microsoft_IIS_malware

By Lucian Constantin
IDG News Service
December 16, 2013

Attackers exploited a vulnerability in Adobe ColdFusion to install
data-stealing malware that works as a module for Microsoft's Internet
Information Services (IIS) Web server software.

Researchers from security firm Trustwave recently reported they've
identified IIS...
 

Posted by InfoSec News on Dec 17

http://arstechnica.com/security/2013/12/how-hackers-made-minced-meat-of-department-of-energy-networks/

By Dan Goodin
Ars Technica
Dec 16 2013

A Department of Energy network breach earlier this year that allowed
hackers to download sensitive personal information for 104,000 people was
the result of a decade-old patchwork of systems, some that hadn't
installed critical security updates in years, according to a federal
watchdog....
 

Posted by InfoSec News on Dec 17

http://www.defenseone.com/management/2013/12/pentagon-reorganizes-intel-office-adds-cyber-post/75590/

By Stephanie Gaskell
Defense One
December 16, 2013

The Pentagon’s top intelligence policy office is making staff changes to
address new threats and meet expected budget cuts, including creating a
director-level position to oversee cybersecurity and other “special
programs.”

Marcel Lettre, the Pentagon’s newly confirmed principal...
 
EMC Connectrix Manager Converged Network Edition Multiple Remote Code Execution Vulnerabilities
 
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Internet Storm Center Infocon Status