Hackin9
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
Apple is incrementally restoring its developer systems following an intrusion last week the company said may have divulged personal information about registered users.
 
The U.S. House of Representatives has narrowly rejected an effort to stop the National Security Agency from collecting millions of U.S. residents' telephone records.
 
Apple sold 14% fewer iPads in the quarter that ended June 30 than in the same quarter last year, while the revenue from those sales plummeted by 27%. The solution? Cut prices, say analysts.
 

The upcoming version of Google's Android operating system offers several enhancements designed to strengthen handset security, particularly in businesses and other large organizations. Ars will be giving the just-unveiled version 4.3 a thorough review in the coming days. In the meantime, here's a quick rundown of the security improvements.

The most significant change is the addition of a security extension known as SELinux—short for Security-Enhanced Linux—to reinforce Android's current hack-mitigation model. Since Android's debut, apps have run inside a "sandbox" that restricts the data they can access and isolates code they can execute from other apps and the operating system as a whole. Built on a traditional Unix scheme known as discretionary access control, Android sandboxing prevents the pilfering of sensitive passwords by a rogue app a user has been tricked into installing or by a legitimate app that has been commandeered by a hacker.

Originally developed by programmers from the National Security Agency, SELinux enforces a much finer-grained series of mandatory access control policies. Among other things, SELinux allows varying levels of trust to each app, as well as dictating what kind of data an app can access inside its confined domain.

Read 8 remaining paragraphs | Comments

    


 
RETIRED: McAfee ePolicy Orchestrator Multiple SQL Injection and Cross Site Scripting Vulnerabilities
 
Oracle Java SE CVE-2013-2458 Remote Security Vulnerability
 
Cisco Video Surveillance Manager CVE-2013-3429 Directory Traversal Vulnerability
 
Facebook's revenue rose 53 percent during the second quarter amid continued gains in mobile advertising revenue share, the company reported Wednesday.
 
The scoop: SanDisk Connect Wireless Flash Drive (16GB, $50; 32GB, $60) and Wireless Media Drive (32GB, $80; 64GB, $100)
 
Videoconferencing is advertised as a tool to reduce travel expenses, but for the CEO of one of the biggest companies in the business, apparently that wasn't enough.
 
That IT professionals work on vacation is as obvious as sand on a beach. Do you think IT pros ever truly relax on vacation?
 
Michael Dell and Silver Lake's decision to raise the offer to take Dell private is a concession that rival Carl Icahn and affiliate parties may have an upper hand in the wrangling to take over the company, observers of the deal said.
 
PHP 'ext/soap/php_xml.c' Multiple Arbitrary File Disclosure Vulnerabilities
 
PHP Calendar Extension 'SndToJewish()' Remote Denial of Service Vulnerability
 

Growing Popularity of Chat Apps Means Revising Information Governance ...
CMSWire
How does this shift in text messaging affect employers who want an accurate, up-to-date understanding of where their data is located for information governance, or for corporate InfoSec policies that focus solely on locking down or preventing SMS ...

 
The flexibility and scalability of the cloud can make migrating mission-critical applications a tempting proposition, but availability can become a serious issue.
 
Google on Wednesday launched a small $35 device, called Chromecast, that lets users send videos and music from smartphones, tablets and laptops to high definition TV sets.
 
Adding to a growing portfolio of enterprise software it offers as hosted services, Microsoft plans to add Java to its Windows Azure cloud service.
 

Wired

Snowden's Impact on the Enterprise: How Mobile Security is Evolving Post-NSA ...
Wired
Systems that lock-down processes in time and place are good for executing transactions but encumber natural human workflow and encourages staff to seek risky workarounds to get their jobs done—the three horrors of info sec: thumb drives, Dropbox and ...

and more »
 
Apple CEO Tim Cook on Tuesday let loose another salvo at rival tablets, audaciously dismissing them as devices that no one uses.
 
The National Transportation Safety Board this week called for all U.S. vehicles to come equipped with technology that would allow them to communicate with each other to help avoid accidents.
 
Microsoft yesterday released Office 2010 Service Pack 2 (SP2), a cumulative update that includes previously-released bug fixes as well as several performance, reliability and stability improvements.
 
 
IBM Java CVE-2013-3010 Unspecified Arbitrary Code Execution Vulnerability
 

CMSWire

Growing Popularity of Chat Apps Means Revising Information Governance ...
CMSWire
How does this shift in text messaging affect employers who want an accurate, up-to-date understanding of where their data is located for information governance, or for corporate InfoSec policies that focus solely on locking down or preventing SMS ...

and more »
 
The hacker group calling itself the Syrian Electronic Army (SEA) broke into the customer support website for Viber, an instant messaging and Voice-over-Internet-Protocol (VoIP) application available for both mobile and desktop operating systems.
 
Google's next-generation Nexus 7 tablet is already on online pre-order at Best Buy starting at $229.99 for a 16 GB version, ahead of its official launch by Google later today.
 
Citadel malware is installed on over 20,000 PCs in Japan and actively sending financial information it harvests to servers abroad, according to security software vendor Trend Micro.
 
Cross-Site Scripting (XSS) in Duplicator WordPress Plugin
 
Cross-Site Scripting (XSS) in Magnolia CMS
 
Edward Snowden, who leaked documents revealing U.S. National Security Agency surveillance programs, has received a document that allows him to leave Moscow's Sheremetyevo airport, according to news reports.
 
Augmented reality, image recognition and other multimedia features could be standard in future smartphones and tablets, and Nvidia's upcoming Tegra 5 mobile chip will have features to handle such demanding graphics capabilities.
 
Michael Dell has raised his offer to take Dell private by 10 cents a share, to about $24.7 billion, after the company was forced to delay a vote because stockholders seemed inclined to reject the bid.
 
LinuxSecurity.com: Multiple vulnerabilities has been discovered and corrected in libxml2: A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external [More...]
 
LinuxSecurity.com: Updated ruby193-ruby packages that fix one security issue are now available for Red Hat OpenStack 3.0 (Grizzly). The Red Hat Security Response Team has rated this update as having moderate [More...]
 

Insurance Freeze: Insurance Exclusion Zones in Marlborough And Wellington ...
Scoop.co.nz (press release)
As a result of the recent earthquake activity, AA Insurance has an exclusion zone in place for new home & contents policies throughout Marlborough and the Greater Wellington districts. “Until further notice, if you are buying a home that is currently ...

and more »
 
Google is expected to announce its second-generation Nexus 7 tablet at an event today in San Francisco, according to a news report citing details released by retailers.
 
Nagstamon CVE-2013-4114 Information Disclosure Vulnerability
 
Hackers are now using a critical vulnerability in Android to modify legitimate smartphone applications, putting users at risk of being spied on.
 
SSDs are encroaching on hard disk drives with the promise of faster access to data, but HDDs are fighting back -- in some cases, with built-in solid-state storage of their own.
 
The White House is opposed to an amendment to a defense spending bill that would limit spending on mass surveillance by the National Security Agency.
 
Data mining experts share stories of failure from the trenches and lessons learned.
 
A Texas man was charged on Tuesday in U.S. federal court with allegedly running a Bitcoin Ponzi scheme, allegedly siphoning the virtual currency from victims to pay for rent, food and gambling.
 
A pair of severe security problems in millions of SIM cards should be easy for operators to fix, according to the German security researcher who found the issues.
 

Researchers have spotted the first in-the-wild apps to exploit a critical Android vulnerability allowing attackers to inject malicious code into legitimate programs without invalidating their digital signature.

The two apps, distributed on unofficial Android marketplaces in China, help people find doctors and make appointments, according to a blog post published Tuesday by researchers from security firm Symantec. By exploiting the recently disclosed "master key" vulnerability—or possibly a separate Android flaw that's closely related (English translation here)—attackers were able to surreptitiously add harmful functions to the apps without changing the cryptographic signature that's supposed to ensure the apps haven't been modified.

"An attacker has taken both of these applications and added code to allow them to remotely control devices, steal sensitive data such as IMEI and phone numbers, send premium SMS messages, and disable a few Chinese mobile security software applications by using root commands, if available," a Symantec researcher wrote. "Using the vulnerability, the attacker has modified the original Android application by adding an additional classes.dex file (the file which contains the Android application code) and also adding an additional Android manifest file (the file which specifies permissions)."

Read 4 remaining paragraphs | Comments

    


 
Oracle Java SE CVE-2013-1489 Unsigned Java Code Security Bypass Vulnerability
 
Re: [Full-disclosure] nginx exploit documentation, about a generic way to exploit Linux targets
 
[ MDVSA-2013:198 ] libxml2
 

Information Assurance Specialist
Supply Management
Working knowledge of HMG guidance including HMG Information Assurance Standards (IS 1-7), Good Practice Guides, InfoSec Memorandum, and defence specific standards including JSP440. Development and authorship of all parts of RMADS for Defence ...

 
Oracle Java SE CVE-2013-2455 Remote Code Execution Vulnerability
 
Preview editions of Hyper-V 2012 R2 and System Center Virtual Machine Manager 2012 R2 pick up where the strong initial releases left off
 
That IT professionals work on vacation is as obvious as sand on a beach. Some see it as part of the job bargain, and maybe there's something to relish about being indispensable.
 
Mac sales in the second quarter contracted by nearly 7%, the third consecutive quarter of decline, sliding to 3.75 million systems, the lowest number in more than two years, the company reported.
 
Oracle Java SE CVE-2013-2412 Remote Security Vulnerability
 

Posted by InfoSec News on Jul 24

http://www.scientificamerican.com/article.cfm?id=how-would-us-respond-nightmare-cyber-attack

By Josephine Wolff
Scientific American
July 23, 2013

It’s been a busy summer for computer security mavens. The U.S. and China
locked horns on cyber espionage, Edward Snowden allegedly leaked
classified intelligence about National Security Agency (NSA) monitoring
programs that target communication networks, and the Cobalt malware took
13 U.S. oil...
 

Posted by InfoSec News on Jul 24

http://blog.foreignpolicy.com/posts/2013/07/23/report_indonesia_emerges_as_hacking_powerhouse

By Elias Groll
Foreign Policy
July 23, 2013

Internet hackers have found a new home from which to spread online mayhem,
and it's not where you might expect. According to a new report from cloud
computing provider Akamai, Indonesia became a hotbed of hacking activity
during the first quarter of 2013, rocketing to second place behind China
among...
 

Posted by InfoSec News on Jul 24

http://www.nextgov.com/cybersecurity/2013/07/federal-cloud-security-now-partially-privatized/67292/

By Aliya Sternstein
Nextgov.com
July 23, 2013

The government has partially privatized the certification of agency cloud
services by tapping the American Association for Laboratory Accreditation
to vet inspectors of commercial data centers, federal officials announced
on Tuesday.

Since the 2011 inception of the Federal Risk and Authorization...
 

Posted by InfoSec News on Jul 24

http://www.ibtimes.co.uk/articles/494053/20130724/ftse-350-companies-fail-cyber-security-protection.htm

By Alistair Charlton
International Business Times
July 24, 2013

Published today, the report by KPMG accuses FTSE 350 companies of failing
to keep their networks safe, and as a result the safety of Britain's
economy and national security as a whole could also be under threat due to
simple flaws in web security.

By simulating the...
 

Posted by InfoSec News on Jul 24

http://dealbook.nytimes.com/2013/07/23/cisco-to-buy-sourcefire-a-cybersecurity-company-for-2-7-billion/

BY MICHAEL J. DE LA MERCED
Dealbook
The New York Times
July 23, 2013

Cisco Systems agreed on Tuesday to buy Sourcefire, a provider of
cybersecurity services, for about $2.7 billion in cash, in a reflection of
the growing fervor for companies that can help guard against
computer-based attacks.

Under the terms of the deal, Cisco will pay...
 
Orbit Downloader versions causing massive SYN flooding. Cyberoam cautions!
 
CORE-2013-0613 - FOSCAM IP-Cameras Improper Access Restrictions
 
Internet Storm Center Infocon Status