Intrusions hit Fedora, Red Hat Enterprise Linux servers; some OpenSSH packages compromised

The maker of Red Hat Enterprise Linux and Fedora said that hackers have gained access to key servers in what appear to be two separate incidents. Red Hat Inc. found last week that someone had compromised several Fedora servers, including one that is used to sign Fedora packages. The company said that although the server was accessed illegally, they don’t believe that the passphrase used to get to the key used to actually sign the packages was compromised.

Read More

Microsoft BlueHat Security Briefings: Fall 2008

The eighth edition of BlueHat will be held on October 16-17, 2008, at the Microsoft corporate headquarters. The Microsoft BlueHat conference is a twice-a-year event aimed at bringing internal Microsoft security professionals and external security researchers together in a relaxed environment to promote the sharing of ideas and social networking. The event highlights important emergent technologies, techniques, and industry best practices.
Sessions
BlueHat v8 will consist of two full days of great content from both internal and external security experts presented in a lecture theater environment. These presentations will offer speakers the opportunity to showcase ongoing research and collaborate with peers while educating and highlighting advancements in security products and techniques.
Day 1: Sessions will be a hybrid of content from deep-dive technical security issues to innovative techniques and best practices in the information security realm.
Day 2: Microsoft’s Security Development Lifecycle (SDL) team will host sessions emphasizing secure development and testing practices and how to develop with security in mind from the beginning of the software development lifecycle. The BlueHat SDL sessions will focus more on appropriate defense strategies and less on attack techniques. Sessions might include demonstrations of secure coding techniques or correct and incorrect methods of using various security tools.

http://technet.microsoft.com/en-us/security/cc748656.aspx

Hackers spoof MSNBC alerts in new twist on malware ruse

Hackers trying to plant malware on PCs have switched from touting CNN news in come-on messages to pushing breaking stories said to be from rival network MSNBC, security experts said today.
The fake messages pose with subject headings that include the phrase "Breaking News," along with phony news story headlines, such as " Jerry Yang relinquishes control over Yahoo," "Mary-Kate Olsen responsible for Heath Ledger's death," and "Plane crashes into prep school, hundreds of kids killed," said researchers at F-Secure Corp. and Sophos Plc

Read More

From BLACK HAT 2008: Google gadget flaws

Google gadgets are small applications, such as a currency converter, calendar or weather forecast, that can be added to the iGoogle homepage or a computer's desktop. The problem lies in the fact that the mini-modules are created by third-party developers, who can embed malicious JavaScript to redirect users to hacker websites, security researcher Robert “RSnake” Hansen told several hundred people in attendance
Read More

Microsoft to give partners heads-up on security vulnerabilities

Microsoft will be giving companies that sell security software and services to its customers a sneak peek at the technical details of the vulnerabilities in Microsoft software before the company releases its monthly "Patch Tuesday" updates.
The new Microsoft Active Protection Program, set to be announced at the Black Hat security conference on Tuesday, is designed to give software vendors a change to prepare updates to their software before attackers have a chance to reverse engineer Microsoft's security patch and create an exploit.
"It's essentially a race between the attackers and the protectors," said Andrew Cushman, who runs the Microsoft Security Response Center. The program will "give a head start to software providers delivering security features to our mutual customers."

Read More

Switches are Supported by MS NAP 802.1x Enforcement

very Important article for implementing MS NAP 802.1x Enforcement
http://blogs.technet.com/nap/archive/2007/07/10/nap-802-1x-enforcement-switches-we-ve-tested-w-nap.aspx

MySpace and Facebook targeted by worm

Facebook users take care of this !!!

The worm variants are spread through the popular social networking sites, turning infected machines into zombies - PCs illicitly controlled by hackers to carry out tasks like denial of service attacks.The Net-Worm.Win32.Koobface.a is activated when a user accesses their MySpace account, and is spread when it automatically comments on linked friend's sites. Facebook is targeted by Net-Worm.Win32.Koobface.b, which sends messages to the infected user's contacts through the Facebook site.

Read More

Details of major Internet flaw posted by accident

The flaw was discovered several months ago by IOActive researcher Dan Kaminsky, who worked through the early part of this year with Internet software vendors such as Microsoft, Cisco and the Internet Systems Consortium to patch the issue.
The companies released a fix for the bug two weeks ago and encouraged corporate users and ISPs to patch their DNS systems as soon as possible. Although the problem could affect some home users, it is not considered to be a major issue for consumers, according to Kaminsky.

Read More

New risks in 802.11n

Along with the potential performance and coverage benefits of 802.11n come a few new security risks, says industry security guru Joshua Wright. Wright presented a Webinar last week that outlined several new vulnerabilities that high-speed 802.11n networks introduce

Read More

Facebook best Security practice

If you are Facebook user , really you need to read this
Sophos recommended privacy settings for Facebook
ID fraudsters target Facebook and other social networking sites to harvest information about you. Sophos experts recommend you set the following Facebook privacy options to protect against online identity theft.

Read More

Anything But Microsoft

Really nice Article to read

Microsoft is a security nightmare, Macs and Linux are a godsend.
Just because you're a Linux or Mac person sipping coffee in your server room on Patch Tuesdays doesn't mean you're immune from exploits. Nothing is bulletproof these days.

http://www.darkreading.com/document.asp?doc_id=99291&page_number=3

Intel Chips under Attack

Waaw!!!!!!!!

Security researcher and author Kris Kaspersky plans to demonstrate how an attacker can target flaws in Intel's microprocessors to remotely attack a computer using JavaScript or TCP/IP packets, regardless of what operating system the computer is running.

Read More

IE8.0 new security features

Microsoft has outlined new security features it will add to Internet Explorer (IE) next month, including anti-malware protection to block most cross-site scripting attacks.
Read More

ISA Server 2006 Service Pack 1 - Released

Finally Microsoft has released ISA 2006 SP1 ,and you can downlaoded from the following link
http://www.microsoft.com/downloads/details.aspx?FamilyId=D2FECA6D-81D7-430A-9B2D-B070A5F6AE50&displaylang=en

Yahoo Mail flaw found and fixed

If you have Yahoo desktop messenger , you need to read this one

Researchers at Cenzic discovered a vulnerability in Yahoo Mail they said could allow attackers to steal Yahoo identities and potentially access users’ sensitive information.
The company, a Web application security provider based in Santa Clara, Calif., notified Yahoo of the cross-site scripting flaw in its popular Web mail program on May 23 and Yahoo fixed it June 13.
The vulnerability requires the attacker use Yahoo Messenger desktop application version 8.1.0.209 to chat with someone using the Messenger support in the latest version of Yahoo Mail. An attacker can make their chat status “invisible” and craft a malicious message; when he returns to the chat and the user clicks on the message, the malicious scripting is executed, said Mandeep Khera, Cenzic vice president of marketing.

Read More

ISA Server 2006 Service Pack 1 Features

Microsoft® Internet Security and Acceleration (ISA) Server 2006 Service Pack (SP) 1 will be available for your installation pleasure this summer!

really enjoy the new features

read More

Microsoft Offers Cash To Use Its Search Engine

Microsoft plans to entice advertisers and users of its search engine with savings on online purchases on a site called Live Search cashback

Read More

Facebook applications exposed as security risk

Take care while you are using Facebook , security report shows Facebook applications exposed as security risk

Speculation on the security of social networking has increased amid reports that applications on Facebook are capable of collecting personal information.

Read The Report

The Award for “outstanding Individual contributor FY08”

I was very delightful when I received a call from Symantec inviting me to attend the “Symantec Partner Awards Dinner 08” held in Dubai.
At the beginning they insisted to have me there without giving me a reason, I did my best to get the Visa and it did not work , So I wasn’t able to attend.
One of my colleges attended on my behalf and the surprise that I have been awarded as the “outstanding Individual contributor FY08”, Best Pre -Sales in the ME.

Flaw turns Gmail into spamming machine

A "serious security flaw" in Gmail turns Google's e-mail service into a spamming machine, according to a recent security report.
INSERT, the Information Security Research Team, has created a proof of concept that exploits the "trust hierarchy" that exists between mail service providers. By exploiting a flaw in the way Google forwards messages, a spammer can send thousands of bulk e-mails through Google's SMTP service, bypassing Google's 500-address bulk e-mail limit and identity fraud protections.

Read More