http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com 2010-04-06 21:20:56 - Zero in a bit : Zero Day the album that is Wired has a review You can read the full lyrics on Frontalot s site Here is a snippet Press play, prepare as history is made largest hack in one day, all the headlines will say All out of time, hear the chime from the buzzer Found this bug on my own, no http://www.secuobs.com/revue/news/209430.shtmlhttp://www.secuobs.com/revue/news/209430.shtml Secuobs.com : 2010-02-26 17:03:49 - Zero in a bit - Here s a quick post to let you know all the places to get your Veracode fix at RSA Conference 2010 On the Expo floor, we ll be in booth 729 I ll be at the booth for a few hours on Tuesday and Wednesday Stop by if you d like to talk about our service http://www.secuobs.com/revue/news/195950.shtmlhttp://www.secuobs.com/revue/news/195950.shtml Secuobs.com : 2010-02-17 19:17:49 - Zero in a bit - There have been a lot of great articles written in the wake of my presentation on Mobile Spyware at Shmoocon 2010 Many of them show wonderful insight into the problems that mobile carriers and owners of the mobile applications stores are facing However, for every handful of great articles, we occasionally come across a technical http://www.secuobs.com/revue/news/192829.shtmlhttp://www.secuobs.com/revue/news/192829.shtml Secuobs.com : 2010-02-11 00:31:58 - Zero in a bit - Some of the media coverage to date has described Tyler Shields proof-of-concept spyware as a BlackBerry hack , much to our chagrin In this blog post, we d like to clarify some of the misconceptions that have surfaced both in the media and in the BlackBerry user community Feel free to post additional questions in http://www.secuobs.com/revue/news/190695.shtmlhttp://www.secuobs.com/revue/news/190695.shtml Secuobs.com : 2010-02-07 17:57:47 - Zero in a bit - Tyler Shields gave a presentation earlier today at ShmooCon 2010 on the threats of mobile spyware, particularly as it relates to data privacy Smart phones and mobile applications have grown tremendously popular over the past couple of years, and it seemed like an appropriate time to raise awareness of what these applications are capable http://www.secuobs.com/revue/news/189386.shtmlhttp://www.secuobs.com/revue/news/189386.shtml Secuobs.com : 2010-01-13 19:10:10 - Zero in a bit - I applaud Google for coming forward and letting the world know about how they were attacked and what the attackers were after Secrecy only helps the offense Most of the time we only hear about attacks when there is public evidence such as a defaced web page, screen shots sourced from the attacker, or http://www.secuobs.com/revue/news/181222.shtmlhttp://www.secuobs.com/revue/news/181222.shtml Secuobs.com : 2009-12-01 06:18:18 - Zero in a bit - Gartner analyst Neil MacDonald has written that Byte Code Analysis is not the Same as Binary Analysis He describes the difference between statically analyzing binary code, which runs on an x86, ARM, or SPARC CPU, and statically analyzing bytecode, which runs on a virtual machine such as the Java VM or the NET CLR http://www.secuobs.com/revue/news/167196.shtmlhttp://www.secuobs.com/revue/news/167196.shtml Secuobs.com : 2009-12-01 06:18:18 - Zero in a bit - From the L0pht Archives Weld Pond and Cult of the Dead Cow to be Featured on Dateline NBC 9301999 The lack of client side security for internet transactions poses a huge security risk that online banks and others just seem to ignore Tools such as BO2K and even simpler keystroke loggers can cut through the authentication used for secure http://www.secuobs.com/revue/news/167195.shtmlhttp://www.secuobs.com/revue/news/167195.shtml Secuobs.com : 2009-12-01 06:18:18 - Zero in a bit - The WASS Project which Veracode contributed data to shows some nice benefits to White box static over Black box dynamic for many serious vulnerability categories White box overall detects a higher prevalence of many categories which we can extrapolate to having lower FN rates Now the sample set of apps is not the http://www.secuobs.com/revue/news/167194.shtmlhttp://www.secuobs.com/revue/news/167194.shtml Secuobs.com : 2009-12-01 06:18:18 - Zero in a bit - The size and scope of the RBS Worldpay ATM heist are unprecedented The perpetrators stole 9M in a matter of hours from 2100 ATMs worldwide An indictment was handed down on Nov 10, 2009 I am always on the lookout for indictments and trials related to computer crime because this is often the http://www.secuobs.com/revue/news/167193.shtmlhttp://www.secuobs.com/revue/news/167193.shtml Secuobs.com : 2009-11-21 02:24:50 - Zero in a bit - A conversation on Twitter this morning started out like this dinozaizovi Finding vulnerabilities without exploiting them is like putting on a dress when you have nowhere to go This clever analogy spurred a discussion about the importance of proving exploitability as a prerequisite to fixing bugs While I agree that nothing is more convincing than a http://www.secuobs.com/revue/news/163698.shtmlhttp://www.secuobs.com/revue/news/163698.shtml Secuobs.com : 2009-10-02 19:33:35 - Zero in a bit - Attackers are not going to be satisfied with a simple PII breach any more The market is becoming saturated with PII Look at the stats In 2007, credit card records sold for an average of 10 per cardholder record in 2009 the same records sell for an average of 50 cents per http://www.secuobs.com/revue/news/146924.shtmlhttp://www.secuobs.com/revue/news/146924.shtml Secuobs.com : 2009-08-21 02:27:42 - Zero in a bit - Trust has long been a favorite target of malicious individuals Most people would say that proper management of trust is one of the primary cornerstones of information security Trust is a relative term and all trust relationships should be examined with a very critical eye Ken Thompson s seminal paper Reflections on Trusting Trust , which won a http://www.secuobs.com/revue/news/133018.shtmlhttp://www.secuobs.com/revue/news/133018.shtml Secuobs.com : 2009-08-18 01:53:54 - Zero in a bit - The details of 3 major identity theft breaches came to light today with the release of the federal indictment of Albert Gonzalez It turns out that the main entry point was a SQL Injection vulnerability The indictment states that a SQL Injection vulnerability was exploited and used to install malware on the target network The indictment doesn t http://www.secuobs.com/revue/news/131721.shtmlhttp://www.secuobs.com/revue/news/131721.shtml Secuobs.com : 2009-07-22 21:01:32 - Zero in a bit - Christien Rioux, Veracode co-founder and chief scientist, recently gave a webinar on mobile app security He covers the strengths and weaknesses of 3 popular mobile application platforms Windows Mobile, RIM Blackberry, and Google Android Veracode recently announced our capability to scan Windows Mobile applications for vulnerabilities and malicious code Blackberry and Android support http://www.secuobs.com/revue/news/123644.shtmlhttp://www.secuobs.com/revue/news/123644.shtml Secuobs.com : 2009-07-15 22:13:24 - Zero in a bit - Yesterday it was reported by various media outlets that a recent BlackBerry software update from Etisalat a UAE-based carrier contained spyware that would intercept emails and text messages and send copies to a central Etisalat server We decided to take a look to find out more We re not sure why the software was delivered in both http://www.secuobs.com/revue/news/121174.shtmlhttp://www.secuobs.com/revue/news/121174.shtml Secuobs.com : 2009-06-30 18:06:16 - Zero in a bit - The “Mobius Defense” is a somewhat novel defense model proposed by PeteHerzog, founder of ISECOM and lead author of the Open Source SecurityTesting Methodology Manual OSSTMM Before continuing to read thefollowing post I suggest you take a few minutes and breeze through theslide deck linked here It’s an easy and http://www.secuobs.com/revue/news/115329.shtmlhttp://www.secuobs.com/revue/news/115329.shtml Secuobs.com : 2009-06-16 00:45:56 - Zero in a bit - As of July 1, all personal computers sold in China must be pre-installedwith content filtering software called Green Dam The officiallystated goal is to protect children from online pornography, butnaturally, the technology will also serve to “protect” viewers fromoffensive text and images such as politically sensitive contentSubsequent to http://www.secuobs.com/revue/news/110026.shtmlhttp://www.secuobs.com/revue/news/110026.shtml Secuobs.com : 2009-05-19 18:12:01 - Zero in a bit - In lieu of actual technical content, and inspired by Jeremiah’s blogpost, 8 reasons why website vulnerabilities are not fixed, I startedthinking about all the different manifestations of reason #8, “No oneat the organization knows about, understands, or respects the issue”I polled the Veracode research group, most of whom have been http://www.secuobs.com/revue/news/98392.shtmlhttp://www.secuobs.com/revue/news/98392.shtml Secuobs.com : 2009-05-04 22:01:56 - Zero in a bit - If you visit this article on the New York Times website, you’ll getimmediately redirected to the website containing the original contentof the article Why does this happen, you ask Apparently the New YorkTimes ingests various third-party news feeds, wraps the article in theNew York Times template, and serves it http://www.secuobs.com/revue/news/91912.shtmlhttp://www.secuobs.com/revue/news/91912.shtml Secuobs.com : 2009-04-27 16:34:01 - Zero in a bit - As you probably know by now, the pattern of 1s and 0s on the cover of the2009 Verizon Data Breach Investigations Report contains a hiddenmessage I decided to give it a whirl and eventually figured it outNo doubt plenty of people managed to beat me to it, as evidenced byhttp://www.secuobs.com/revue/news/88634.shtmlhttp://www.secuobs.com/revue/news/88634.shtml Secuobs.com : 2009-04-20 18:59:34 - Zero in a bit - If you’re at RSA this week, be sure to check out this panel discussion,featuring Veracode’s Chris Wysopal along with Jerry Archer, Mary AnnDavidson, and Brian Chess Abstract as follows: The growth of Web 20has highlighted two significant trends in application security First,as the network has hardened, attacks against applications havedramatically http://www.secuobs.com/revue/news/85677.shtmlhttp://www.secuobs.com/revue/news/85677.shtml Secuobs.com : 2009-03-30 20:50:25 - Zero in a bit - The Ontario Lottery and Gaming Corp is in a bit of hot water afterrefusing to pay a $429 million jackpot: According to the statement,Kusznirewicz was playing an OLG slot machine called Buccaneer atGeorgian Downs in Innisfil, Ont, on Dec 8 when it showed he had won$429 million When the machine’s winning lights and http://www.secuobs.com/revue/news/77009.shtmlhttp://www.secuobs.com/revue/news/77009.shtml Secuobs.com : 2009-03-04 17:09:24 - Zero in a bit - A security bug was found in djbdns Daniel Berstein pays his promisedsecurity bug bounty for the first time More details about the bug onbugtraq Date: 4 Mar 2009 01:34:21 -0000 From: D J Bernstein To:dns@listcrypto Subject: djbdnshttp://www.secuobs.com/revue/news/67307.shtmlhttp://www.secuobs.com/revue/news/67307.shtml Secuobs.com : 2009-02-27 23:33:19 - Zero in a bit - In this final part of the anti-debugging series we’re going to discussprocess and thread block based anti-debugging Processes and threadsmust be maintained and tracked by the operating system In user space,information about the processes and threads are held in memory instructures known as the process information block PIB, processenvironment block http://www.secuobs.com/revue/news/66110.shtmlhttp://www.secuobs.com/revue/news/66110.shtml Secuobs.com : 2009-01-26 22:56:23 - Zero in a bit - Monstercom recently disclosed yet another major breach that compromisedthe personal data of over 13 million users This is not unlike theprevious breach in August 2007, though the attack vector was likelydifferent From a notice on their website emphasis mine: We recentlylearned our database was illegally accessed and certain contact andhttp://www.secuobs.com/revue/news/55303.shtmlhttp://www.secuobs.com/revue/news/55303.shtml Secuobs.com : 2009-01-20 09:21:50 - Zero in a bit - One of the great challenges for consumers of static analysis products,particularly desktop tools, is dealing with the large flaw counts Youhave to wade through the findings to decide what to fix and when,which can be a daunting task At Veracode, we continuously update ouranalysis engine to aggressively reduce false http://www.secuobs.com/revue/news/53052.shtmlhttp://www.secuobs.com/revue/news/53052.shtml Secuobs.com : 2009-01-15 21:25:35 - Zero in a bit - Computer security researchers are much like scientific researchers inseveral ways We build on the research of those who come before us, wesometimes rediscover the same things independently, and other times weforget where we learned things and sometimes claim them as our own Wealso occasionally take an engineer’s approach and http://www.secuobs.com/revue/news/51850.shtmlhttp://www.secuobs.com/revue/news/51850.shtml Secuobs.com : 2009-01-15 21:25:35 - Zero in a bit - Are editors so excited to use the headline “Vulnerability in WindowsVista” in their SEO URLs that they will have their reporters write astory on a non-issue IDG News has published a news report titled,“Researchers find vulnerability in Windows Vista“ The report says: AnAustrian security vendor has found a vulnerability in Windows Vistahttp://www.secuobs.com/revue/news/51849.shtmlhttp://www.secuobs.com/revue/news/51849.shtml Secuobs.com : 2009-01-15 21:25:35 - Zero in a bit - It was 10 years ago this week that Tan from the L0pht wrote CyberspaceUnderwriters Laboratories to describe a vision of third party testingand certification of computer hardware and software Tan’s vision gotone step closer this week when CWE and SANS issued the 2009 CWE/SANSTop 25 Most Dangerous Programming Errors Finally there http://www.secuobs.com/revue/news/51848.shtmlhttp://www.secuobs.com/revue/news/51848.shtml