Wikipedia outage

Cisco security updates

Published: 2010-03-24
Last Updated: 2010-03-24 22:52:39 UTC
by Kyle Haugsness (Version: 1)
0 comment(s)

Cisco released 7 new security updates to various different products today.  More information at their site: http://ww.cisco.com/en/US/products/products_security_advisories_listing.html

-Kyle Haugsness

Keywords: cisco
0 comment(s)

Wax nostalgic - commodore64 updated to present time

Published: 2010-03-24
Last Updated: 2010-03-24 19:56:19 UTC
by Kyle Haugsness (Version: 1)
6 comment(s)

Slow news/incidents day.... So I will post something slightly off-topic.  Yes, the story was on Slashdot and it may never come to fruition (or even be suitably priced), but the news that Commodore USA was releasing a new PC embedded into a keyboard had me reminiscing of my first computer, the commodore64.  New site here: http://www.commodoreusa.net

I can't tell you how many times I read "syntax error" in response to my prodding of the BASIC language.  Hmm, how do I make this into a security-related article?  It would be difficult to install a keyboard logger on these things!!  So perhaps it fits into your physical security strategy?  Does anyone conquer physical security threats with creative choices of hardware?  For instance, if you have a policy of no USB flash drives do you enforce that through hardware restrictions?

-Kyle Haugsness

Keywords: commodore64
6 comment(s)

".sys" Directories Delivering Driveby Downloads

Published: 2010-03-24
Last Updated: 2010-03-24 02:42:35 UTC
by Johannes Ullrich (Version: 1)
7 comment(s)

Our read Paul observed malware being delivered from the ".sys" directory of various web sites. The URL follows the scheme:

http://evilexample.com/.sys/?action=....

In response to clicking on the link, the user is asked to install the software. According to Paul, he observed the link being delivered via Facebook which of course makes the message more plausible and it is likely that users install the software thinking it came from a "Friend". Before adding a specific block for ".sys", Paul's web filter caught about 60% of these exploits.

Once a user follows the link, additional exe files are downloaded from ".sys" directories. The file names Paul observed are p.exe, go.exe and v2captcha21.exe.


------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

7 comment(s)
Firefox 3.6.2 released ahead of schedule. Fixes critical vulnerability.

Comments

What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
https://defineprogramming.com/
https://defineprogramming.com/
Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
Enter corthrthmment here...

Diary Archives