Zero-Day

chuckdarwin — Tue, 16 Dec 2008 02:33:52 -0800

BBC: Users of the world's most common web browser (good old IE!) have been advised to switch to a rival until a serious security flaw has been fixed. Microsoft Security Advisory 961051. Microsoft Corp. has tipped off its users of a “huge increase” in hacking attacks exploiting a critical unpatched vulnerability in some versions of its flagship web-browser Internet Explorer (IE), and notified that some of these attacks have originated from hacked porn websites. In addition to IE7, other versions like IE 5 and IE 6 have also been found to be vulnerable to the flaw, which on proper exploitation could enable a hacker to seize complete control over victim’s computer, the company added. The flaw essentially originates from the improper handlings of DHTML data bindings due to a memory corruption error. Though the hackers have been exploiting the vulnerability for more than a week, the company notified an upswing in attacks over the weekend. Researchers Tareq Saade and Ziv Mador in one of their postings on Malware Protection Center blog said, “Based on our stats, since the vulnerability has gone public, roughly 0.2 percent of users worldwide may have been exposed to websites containing exploits of this latest vulnerability”. The researchers purported that the hackers have now changed their methodology of attacks, as instead of using malicious websites for attacks, they are now using compromised legitimate websites to trick the users. Incidentally Trend Micro Inc has estimated that around 6,000 websites have been infected so far to exploit the vulnerability, with the count “quickly increasing in number”.

And DJB's $500 is safe for another day

Skorgu — Wed, 09 Jul 2008 18:57:48 -0800

A major flaw in the DNS system is promised to be revealed at the next Black Hat conference. Convinced it was too important to wait, security researcher Dan Kaminsky (video, autoplays) convinced several software vendors to issue emergency patches today, before publicizing details of the attack. It can't be that serious though, can it? Oh yes it can.

Wikipedia impartiality

bobbyelliott — Wed, 24 Jan 2007 12:42:30 -0800

Microsoft has been caught paying for Wikipedia edits. But wasn't this inevitable? Now that Wikipedia has become the de facto online reference, wasn't it inevitable that it would attract governments, corporates and other groups to create their own version of events. Is this an inherent and fatal flaw in open source knowledge?

MetaFilter posts tagged with flaw

Zero-Day

And DJB's $500 is safe for another day

Wikipedia impartiality