SEARCH RESULTS
 
Showing 1-10 of 164 records
 
Expand article

Corrupted Heap Termination Redux

2008-06-07 04:00:00 by sdl in The Security Development Lifecycle
 
...previous post I explained how to use HeapSetInformation correctly. In short there's an option when calling this function that will terminate your application if the heap manager detects some form of heap corruption, or the potential to cause heap corruption I would recommend you read the previous post before continuing You guessed it, the...
 
Tags: heap, free block list, block, handle, bogus heap handle, invalid, invalid heap, custom heap, block header
 
 
 
 
Expand article

Covert channel vulnerabilities in anonymity systems

2007-12-10 10:39:42 by Steven J. Murdoch in Light Blue Touchpaper
 
...previous research on covert channels (unintended means to communicate in violation of a security policy) to analyse several anonymity systems in an innovative way One application for anonymity systems is to prevent collusion in competitions. I show how covert channels may be exploited to violate these protections and construct defences...
 
Tags: covert, covert channel vulnerabilities, vulnerabilities, network covert channels, covert channels, channels, covert channel, anonymity systems, systems
 
 
 
 
Expand article

Rogue RBN Software Pushed Through Blackhat SEO

The Article has images
2008-03-05 08:19:46 by HASH0x8b39d2c in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...previous example for instance, we had an second ongoing IFRAME campaign with just 4 pages injected with 89.149.243.201 , however, what Keep it Simple Stupid really means in this case is that the next IP in their netblock 89.149.243.202 is currently getting injected at many other sites as well. The difference between the previous campaign and...
 
Tags: rbn, huge iframe campaign, iframe campaign, iframe, rbn coverage, single rbn, russian business network, campaign, antivirus
 
 
 
 
Expand article

SDL and the OWASP Top Ten

2008-05-01 15:46:00 by sdl in The Security Development Lifecycle
 
...previous list. And items that were on the previous list were removed from this list in fact, even the previous #1 most important issue (unvalidated input) does not appear in the current top ten (perhaps because it was deemed to be too generic). Its possible that some security researcher will drop an 0-day at Black Hat , or Toorcon , or some...
 
Tags: security, web application security, top, security standpoint, list, previous list, agile development teams, development teams, security researcher
 
 
 
 
Expand article

Asprox Phishing Campaigns Dominated in April

The Article has images
2008-05-27 06:38:48 by Dancho Danchev in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...previous post. The IPs in question 212.174.25.241 62.233.145.45 218.92.205.246 85.105.182.6 212.0.85.6 Where's the connection? It's in the historical domains that used to respond to the IPs, in the Asprox case, a great deal of the original domain names used a couple of months ago are still in a fast-flux and further expose and connection...
 
Tags: asprox, botnet, asprox botnet, previous, previous months, historical domains, ips, months, domains
 
 
 
 
Expand article

UltimateBet cheating goes undetected for almost 21 months

The Article has images
2008-06-04 10:55:17 by Evan Francen in The Breach Blog
...previous ownership of UltimateBet prior to the sale of the business to Tokwiro in October 2006 Evan] Shouldn't an information security and risk assessment be conducted as part of the acquisition and integration? If so, then wouldn't a code review of the proprietary software that came with the acquisition be included? This is the proprietary...
 
Tags: ultimatebet, tokwiro enterprises enrg, tokwiro enterprises, ultimatebet issues statement, ultimatebet prior, ultimatebet subsequently, ultimatebet immediately removes, ultimatebet servers, ultimatebet statement
 
 
 
 
Expand article

A conspicuous contribution !

The Article has images
2007-12-04 17:40:46 by Richard Clayton in Light Blue Touchpaper
...previous inkling when they recently gave me their 2007 award for a conspicuous contribution This award was first given in 2006 to Nigel Titley , who was a LINX council member from its 1994 formation through to 2006, and his contribution is crystal clear to all. My own was perhaps a little less obvious. I have regularly attended LINX general...
 
Tags: formal linx meetings, linx meetings, linx, linx council, meetings, conspicuous contribution, contribution, fiercely competitive industry, internet
 
 
 
 
Expand article

Have Your Malware In a Timely Fashion

The Article has images
2007-12-15 08:35:11 by HASH0x89f6724 in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...previous PSYOPS operation on behalf of an unnamed intelligence agency . However, in this case they embedded malware at a French Government's site related to Libya in order to eventually infect all the visitors looking for more information during the visit. That's a social engineering trick taking advantage of the momentum by proactively...
 
Tags: malware, attack, malware attack, malware downloaders, media malware gang, loads, web site, site, php
 
 
 
 
Expand article

Update on the MySpace Phishing Campaign

The Article has images
2007-12-10 21:50:56 by HASH0x899feb4 in Dancho Danchev's Blog - Mind Streams of Information Security Knowledge
...previous post, have recently changed the main login redirector from 319303.cn/login.php to z8atr.cn/login.php , and the attached z8atr.cn's fast-flux can be greatly compared to that of Storm Worm's fast-flux networks in terms of its size. The updated campaign is also taking advantage of the following DNS servers Name Server: ns1.4980603.com...
 
Tags: myspace, fast-flux networks, fast-flux, attack vectors include, campaign, server, attack, exploit content results, primary infection vectors