|
Archive for the ‘0day’ Category
Thursday, January 28th, 2010
Evgeny Legerov is wrapping up his month of 0day awareness. We are mid-way through his week of database 0day on the Intevydis blog:
“[January 25 - February 1] – week of database bugs, inspired by our research for DBJIT Toolset, 0days in Mysql, IBM DB2, Lotus Domino, Informix, Oracle(?)…and hopefully more”
Mostly all of our ThreatFire workstation users remain unaffected, as the noted attacks focus on enterprise level issues. So far this week he’s delivered the goods on all the major databases. If you’re unaware, Legerov runs a responsive shop developing exploit packs for the Canvas penetration-testing suite.
Posted in 0day, Penetration testing | 1 Comment »
Friday, January 15th, 2010
The Google compromise in China story builds interest as Microsoft released an advisory and blog post on the relevant Internet Explorer browser vulnerability, crediting “details” to Google, Mandiant and others. A number of factors are unfolding a dramatic story here, with the detection of a 20-year old Stanford student’s computer targeted and attacked (it seems to be no surprise that a regional coordinator of Students for a Free Tibet would be another target), and mention of Sergey Brin’s own Russian refuge background reported “The source told the Guardian the company’s decision was largely influenced by the experiences of Sergey Brin’s Russian refugee background.”
The 0day Google hack attacked a invalid pointer reference within Internet Explorer. It seems that malicious web links were visited by Google employees, resulting in FUD spyware installations on their workstations. Over the past couple of decades, this type of vulnerability has been exploited and sometimes resulted in hugely prevalent and successful exploits on the web, such as the infamous createTextRange Internet Explorer mshtml.dll hole.
Update: Google China employees seem to have been given an early holiday, according to Tech Crunch IMers.
The trojan itself has been analyzed and described on our ThreatExpert blog here and more information from Symantec on the attacks here.
Posted in 0day, Security breach, Spyware, Targeted attack | 1 Comment »
Friday, September 4th, 2009
PPStream is a multimedia player used widely throughout Asia, as in hundreds of millions of users. As such, it is interesting when crashes for widely used client-side software are reported as “exploitable” on various blogs and PoC sites.
According to the post, the reportedly vulnerable ActiveX component is MList.ocx, and it appears to maintain a heap overflow condition. The author had not released a workable exploit, and there appears to be no ThreatFire community reports for the component. Its exploitability is being discussed on full disclosure lists and various other forums:
“PPStream is the most huge p2p media player in the world. There are two hundred million ppstream users in the world. The vulnerability is exploitable,but I have no time to make it,you could visit my blog for detail.^@^ ”
So it appears to be a work in progress. If it is exploitable for such widely used software, it is strange that this one did not hit the underground market first and it has not been added to known exploit packs and kits. If you are using PPStream, be wary of the sites that you stream until you patch.
Posted in 0day, Notification | No Comments »
|
|
|
|
