Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

iPhone 4 Order Security Breach Exposes Private Information

Published: 2010-06-15
Last Updated: 2010-06-15 23:02:26 UTC
by Manuel Humberto Santander Pelaez (Version: 2)
0 comment(s)

Well, seems to be if you order an iPhone 4 you might get access to private information of other AT&T customers. The exposed information includes private addresses, phone calls, and bills.

More information at http://gizmodo.com/5564262/apple-iphone-4-order-security-breach-exposes-private-information

 -- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

0 comment(s)

Apple releases advisory for Mac OS X - Multiple vulnerabilities discovered

Published: 2010-06-15
Last Updated: 2010-06-15 21:54:43 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
2 comment(s)

Apple released today an advisory for multiple vulnerabilities discovered in Mac OS X. Impacted programs includes CUPS,  Desktop Services, Folder Manager, Help Viewer, iChat, ImageIO, Kerberos, libcurl, Network Autorization, Open Directory, Printer Setup, Printing, Ruby, SMB File Server, Squirrelmail, and Wiki Server. Mac users: please download the Mac OS X Server v10.6.4 Update Mac mini (Mid 2010) at http://support.apple.com/downloads/DL1055/en_US/MacOSXSrvUp10.6.4MacminiMid2010.dmg. Better to patch quickly before an exploit goes outside the wild.

More information for the advisory at http://support.apple.com/kb/HT4188.

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

2 comment(s)

Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild

Published: 2010-06-15
Last Updated: 2010-06-15 21:16:53 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
0 comment(s)

Reader Jack showed us notifications that the vulnerability for Microsoft Windows Help and Support Center is being exploited in the wild. More information for this vulnerability at http://www.microsoft.com/technet/security/advisory/2219475.mspx.

To fix this problem, please visit http://support.microsoft.com/kb/2219475 and look for the "Enable this fix" image. It will download a MSI that unregisters the HCP protocol as a workaround, because there is currently no patch available.

-- Manuel Humberto Santander Peláez  |  http://twitter.com/manuelsantander  |  http://manuel.santander.name | msantand at isc dot sans dot org   

 

 

 

0 comment(s)

Mastercard delivering cards with OTP device included

Published: 2010-06-15
Last Updated: 2010-06-15 08:26:28 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
3 comment(s)

I live in a country where credit and debit card fraud is pretty high and unfortunately banks have not provided secure means to avoid credit and debit card cloning. In USA, I have seen OTP devices to access online banking, but credit cards are pretty much the same. I learned that Mastercard will provide credit cards with OTP included. This is great news because will decrease bank fraud a lot.

More information at http://www.slashgear.com/mastercard-trialling-smart-credit-cards-with-display-keypads-1089351/

-- Manuel Humberto Santander Peláez  |  http://twitter.com/manuelsantander  |  http://manuel.santander.name | msantand at isc dot sans dot org   

3 comment(s)

TCP evasions for IDS/IPS

Published: 2010-06-15
Last Updated: 2010-06-15 01:07:30 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
0 comment(s)

Judy Novak posted on her blog an excellent article of IDS/IPS evations on TCP, showing a real example when linux runs on the destination host. Check it out at http://www.packetstan.com.

-- Manuel Humberto Santander Peláez  |  http://twitter.com/manuelsantander  |  http://manuel.santander.name | msantand at isc dot sans dot org  

0 comment(s)
Diary Archives