Passwords of 100k IEEE members lie bare on FTP server
IEEE uses Akamai for content delivery. A FTP directory server was discovered which contained log files of username, password, IP addresses and HTTP request information. Surprisingly, an organization like IEEE logs such a sensitive information. NTOSpider looks for similar log files on systems during a scan, Test your application with NTOSpider to find out if any log file accessible from your webroot.
http://www.scmagazine.com/passwords-of-100k-ieee-members-lie-bare-on-ftp-server/article/260721/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A%20SCMagazineNews%20%28SC%20Magazine%20News%29
Hackers target Windows Update in phishing attack
Thieves have constructed spam messages which claim to originate from privacy@microsoft.com. The messages, which are designed to resemble official alerts from Microsoft, advise users that their systems might be at risk and advises them to visit a supposed “update” page. Upon clicking the link, however, users are directed to a phishing site which attempts to harvest email addresses from webmail services including Gmail and AOL mail.
http://www.v3.co.uk/v3-uk/news/2207737/hackers-target-windows-update-in-phishing-attack
USSD attack not limited to Samsung Android devices, can also kill SIM cards
Ravishankar Borgaonkar, a researcher, recently demonstrated the remote data wiping attack at the Ekoparty security conference. The attack can be launched from a Web page by loading a “tel:” URI (uniform resource identifier) with a special factory reset code inside an iframe. If the page is visited from a vulnerable device, the dialer application automatically executes the code and performs a factory reset. Several Samsung Android devices, including Samsung Galaxy S III, Galaxy S II, Galaxy Beam, S Advance, and Galaxy Ace were reported to be vulnerable because they supported the special factory reset code.
http://m.itworld.com/security/298784/ussd-attack-not-limited-samsung-android-devices-can-also-kill-sim-cards
jQuery 1.8.2 Released
jQuery 1.8.2 is released with fixes to several bugs and performance enhancements.
http://blog.jquery.com/2012/09/20/jquery-1-8-2-released/
SSL Scanner – SSLyze
A python script to test SSL checks has been released.
https://github.com/iSECPartners/sslyze
Documentation can be found at -
http://code.google.com/p/sslyze/w/list
Warrantless snooping by the Feds of email and social networks is on the rise.
Documents released by the American Civil Liberties Union (ACLU) on Thursday show that law enforcement agencies in the U.S. have increased surveillance of Americans’ electronic communications.
http://www.aclu.org/blog/national-security-technology-and-liberty/new-justice-department-documents-show-huge-increase
Java exploited, again !
A new zero-day vulnerability has been discovered in all currently-supported versions of Oracle’s Java software, potentially allowing attackers to install malware on around 1 billion Macs and PCs. Announced on the Full Disclosure mailing list by security researcher Adam Gowdiak on Wednesday, the bug is present in Java 5, Java 6, and Java 7. The 1 billion figure is taken from installation statistics provided by Oracle. This vulnerability has serious implications on those business applications that continue to require older Java versions.
Last updated by at .
