Slashdot Mirror

Tasha26 writes "The BBC has an interesting Web security snippet from the SyScan 2010 security conference in Singapore. In a presentation, security researcher Laurent Oudot released details of bugs found in commonly used attack kits such as Neon, Eleonore, and Sniper. These loopholes could be exploited to get more information about the attackers, perhaps identifying them, stealing their tools and methods, or even following the trail back to their own computer."

garg0yle writes "A researcher has found a security bug that could allow privilege escalation in Windows. Nothing new there, right? Well, this affects the Virtual DOS Machine, found in every 32-bit version of Windows all the way back to Windows NT. That's 17 years worth of Windows and counting. 'Using code written for the VDM, an unprivileged user can inject code of his choosing directly into the system's kernel, making it possible to make changes to highly sensitive parts of the operating system. ... The vulnerability exists in all 32-bit versions of Microsoft OSes released since 1993, and proof-of-concept code works on the XP, Server 2003, Vista, Server 2008, and 7 versions of Windows, Ormandy reported.'"

An anonymous reader writes "Using data generated by the Mozilla Firefox download pledge page, the map on this blog post ranks countries, not by absolute number of pledges made, but rather on a per capita basis. This analysis yields some interesting conclusions about where open source is strongest and weakest." Anonymous Warthog writes "That didn't take long. In a blog posting from the TippingPoint DVLabs security team (of Kraken and CanSecWest hacking contest fame), they confirmed that they reported a vulnerability in Firefox 3.0 to Mozilla a mere five hours after it was released. Additionally, there was a posting on the Full Disclosure security mailing list from someone that purports to have another vulnerability in the works as well. In the grand scheme of things, this probably means nothing to the general security of Firefox, but you can be sure the browser zealots on all sides will be watching carefully." Finally, from reader Toreo asesino: "Microsoft have congratulated the Mozilla team by sending them their second cake (minus recipe) to Mozilla's Mountain View headquarters to congratulate them on shipping FireFox 3, which went live right on time last night." Congratulations are indeed due on both the browser and the release process — looks like the Firefox fever (despite some seriously taxed servers) resulted in more than 8 million downloads in 24 hours.

An anonymous reader writes "After less than a four days after original mailing list posting there are reports about a new Instant Messaging worm exploiting unpatched Windows Metafile vulnerability. This worm is using MSN to spread, reports Viruslist.com."

Eh-Wire writes to tell us OpenBSD Journal is reporting that OpenBSD is officially ten-years-old today. After some confusion, it was decided that 10 years ago today marked the birth of OpenBSD when Theo de Raadt committed his makefile to CVS.

evenprime writes "In 2001, Dmitry Sklyarov described vulnerabilities in Adobe Acrobat and Adobe Acrobat Reader while giving a talk at Defcon 9. As has been previously mentioned, Dmitry was arrested the day after this talk. He and his company Elcomsoft were charged with violating the DMCA. Now Elcomsoft have announced that Adobe, two years later, has still not patched these bugs."

Mortimer.CA writes "The OpenBSD Journal has an article with more info on cutting of the OpenBSD funding. It seems that the funding was partially cut due to worries about "capable nation-states". Also Mark West asked the hotel to cancel all reservations for the upcoming "hackathon" -- even though many of the arriving developers have non-refundable tickets, and would have no place to stay. Jonathan Smith also probably had something to do with the decision. If you would like to voice your opinion to these individuals, please be clear, extremely professional and courteous. Flaming and being childish will only hurt OSS. Also, please think about donating or ordering something to help the project along." DARPA, which initially denied that it was cancelling the grant, has now admitted it. Although de Raadt seems to be upset with how his UPenn contacts are handling the cancellation, it's DARPA that is ultimately at fault, not the UPenn people.

Mortimer.CA writes "The OpenBSD Journal has an article with more info on cutting of the OpenBSD funding. It seems that the funding was partially cut due to worries about "capable nation-states". Also Mark West asked the hotel to cancel all reservations for the upcoming "hackathon" -- even though many of the arriving developers have non-refundable tickets, and would have no place to stay. Jonathan Smith also probably had something to do with the decision. If you would like to voice your opinion to these individuals, please be clear, extremely professional and courteous. Flaming and being childish will only hurt OSS. Also, please think about donating or ordering something to help the project along." DARPA, which initially denied that it was cancelling the grant, has now admitted it. Although de Raadt seems to be upset with how his UPenn contacts are handling the cancellation, it's DARPA that is ultimately at fault, not the UPenn people.

chill writes "Where to begin? OpenBSD Journal has a couple of update articles on the business of DARPA cancelling POSSE and OpenBSD's grant. And here is a message from Theo de Raadt, the OpenBSD big cheese, with a quote from a military spokesman. How does '...due to world events and the evolving threat posed by increasingly capable nation-states...' grab you? Does open source and freely available security support terrorism by its very nature?"

ocipio writes "OpenBSD's systrace now has privilege elevation support. This means binaries no longer need to be suid or sgid an longer. Applications can be executed completely unprivileged. Systrace raises the privileges for a single system call depending on the configured policy."

jimmy writes ""A vulnerability exists in the SSI error pages of Apache 2.0 that involves incorrect filtering of server signature data. The vulnerability could enable an attacker to hijack web sessions, allowing a range of potential compromises on the targeted host." This Cross site scripting (or XSS) hole has been found in all versions of apache prior to 2.0.43. The advisory can be found here and users are urged to upgrade to address this problem."

cperciva writes "The original story is here. And more details are available from the guy's weblog here." Here's a mirror of that email message. Another reader writes, "Not really a trojan because all it does is make a connection to 203.62.158.32:6667." Still another writes "The tarball of the portable OpenSSH on ftp.openbsd.org is trojaned. The backdoor is only used during build - generated binaries are fine." There isn't much authoritative information available, but this appears legitimate - please be careful if you're updating any of your machines with code from ftp.openbsd.org, and we'll update this story with more links as information is available. Update: 08/01 19:13 GMT by M : OpenSSH now has an advisory.

Cowboy71 writes: "An interesting posting on Bugtraq by Stephen Christie announcing the release for comment of an internet-draft "Responsible Disclosure Process" document, prepared by himself and Chris Wysopal of @stake. You can view the full paper at the IETF site."