InfoSec News

I woke up this morning to my Spam box full of email from a variety of people, to a variety of my email boxes, greeting me and checking into my well being. One example of this is
From: Luella Winkler [email protected]

Date: Sat, Sep 18, 2010 at 1:03 PM

Subject: hello

To: [email protected]





how are you?

To Luella and the other 54 email addresses that checked up on me...Iwould just like to thank all of you for caring so much and reassure you that Iam quite well.
Seriously though, there is no solicitation, no attempt at phishing, and no embedded crap, just warm regards. Is this a dry run for something big to come?

-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Microsoft has released a security advisory for ASP.NET (CVE-2010-3332). It looks like there are no known attacks for this vulnerability at this time, and no update has been released.
To quote the release...
Microsoft is investigating a new public report of a vulnerability in ASP.NET. An attacker who exploited this vulnerability could view data, such as the View State, which was encrypted by the target server, or read data from files on the target server, such as web.config. This would allow the attacker to tamper with the contents of the data. By sending back the altered contents to an affected server, the attacker could observe the error codes returned by the server. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.
More details are available at Scott Guthrie's Blog. As reader Jacob pointed out, Scott also details a configuration change that can be used for a workaround until the update is released.
-- Rick Wanner - rwanner at isc dot sans dot org - http://rwanner.blogspot.com/ (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Columnist Mike Elgan embarked on a two-week project to use voice-based technology for everything he possibly could. Here's what he found.
 

Internet Storm Center Infocon Status