BlackBerry update bursting with spyware

This may not be applicable to Singapore's BB users, but still, it highlights the potential vulnerabilities of Blackberry.

An update pushed out to BlackBerry users on the Etisalat network in the United Arab Emirates appears to contain remotely-triggered spyware that allows the interception of messages and emails, as well as crippling battery life.

Read on

First Zero-Day Exploit Released For Firefox 3.5

Patch is in the works, exploit code and Metasploit attack module are released.

The race is on: Mozilla is scrambling to finish a patch for a now-public bug in its Firefox 3.5 browser, while exploit code is circulating and Metasploit has released a new module for the attack.

The vulnerability, which was initially discovered by Mozilla last week in the Firefox 3.5 Just-in-Time (JIT) JavaScript compiler, is considered "critical" in that it can be used to execute malicious code, according to Mozilla. A researcher posted his attack code on mil0rm on Monday. The flaw lets an attacker infect the machine of a victim duped into visiting a malicious Web page.

Disabling JIT in the JavaScript engine is one way to protect against such an attack, but that's only a temporary solution because without JIT, Firefox's performance decreases, Mozilla warned in its blog. Another option is to run Firefox in Safe Mode, which disables the JIT, or to use the NoScript add-on for Firefox.

Here's how to disable JIT in JavaScript, according to Mozilla:

1. Enter about:config in the browser's location bar.
2. Type jit in the Filter box at the top of the config editor.

3. Double-click the line containing javascript.options.jit.content -- setting the value to "false."

After a patch for the bug is issued and applied, users have to reinstate JIT:

1. Enter about:config in the browser's location bar. Type jit in the Filter box at the top of the config editor.
2. Double-click the line containing javascript.options.jit.content -- setting the value to "true."

Mozilla says it will push out a Firefox update "as soon as the fix is completed and tested."

Secunia, meanwhile, says the flaw, if exploited, can cause memory corruption due to an error in processing JavaScript code-handling

'Anti-Sec' Group Hacks Popular Image Site, Demands Changes In Security Research

ImageShack, one of the Web's largest image hosts, was attacked over the weekend by a group called "Anti-Sec," which is demanding changes to the security industry's practice of full disclosure of vulnerabilities.

According to a report, the group replaced many of ImageShack's hosted images with its own manifesto, which states, in part:

"The security industry uses full disclosure to profit and develop scare tactics to convince people into buying their firewalls, anti-virus software, and auditing services...if whitehats were truly about security, this stuff would not be published...

"...Our battle is that of the removal of full-disclosure for the purpose of making it harder for the security industry to exploit its consequences. It is our goal that, through mayhem and the destruction of all exploitive and detrimental communities, companies, and individuals, full disclosure will be abandoned and the security industry will reform.

"How do we plan to achieve this? Through the full and unrelenting, unmerciful elimination of all supporters of full disclosure and the security industry in its present form. If you own a security blog, an exploit publication Website or you distribute any exploits...'you are a target and you will be rm'd. Only a matter of time.'

"This isn't like before. This time, everyone and everything is getting owned."

Another report states that the hackers were able to send email to ImageShack customers using the addresses that the site, itself, has registered for those users.

While security forums today were abuzz with discussion about the group's allegation that full disclosure is detrimental to security, researchers generally said they weren't sure how serious the group's threat is or exactly how the hack occurred.

A screen cap of the defaced website here.

Origins of Google Chrome logo

Ever wondered how the Google Chrome logo came about?

Sober worm returns and uses social engineering techniques

PandaLabs has recorded the appearance of a new variant of the Sober worm, Sober.Y, which spreads using social engineering techniques in emails sent in English or German.

The worm uses two types of mail to propagate: Firstly, an email in English with the subject "Your new password," which tries to make users think it is notification of a change of password, asking them to check the data in an attached file, pword_change.zip.

Secondly, an email written in German claiming to contain a photograph of old school friends in the file KlassenFoto.zip. Both compressed files contain the executable PW_Klass.Pic.packed-bitmap.exe, which is a copy of the worm itself.

If the file is run, a false CRC error is displayed, even though the action has already started. The worm collects email addresses from files with certain extensions on the compromised computer, and sends itself out to them in the emails described above using its own SMTP engine. It will only use the German version of the email if the addresses end in .de (Germany), .ch (Switzerland), .at (Austria), or .li (Lichtenstein).

Even though the number of incidents recorded is low, this worm has significant propagation potential.

Microsoft Warns Of IE Vulnerability

Microsoft has issued a security advisory about a privately reported vulnerability in its Video ActiveX Control.

The company says that users running IE6 or IE7 on Windows XP and Windows Server 2003 are at risk for attacks, but Windows Vista and Server 2008 and those running IE8 are not at risk.

"An attacker who successfully exploited this vulnerability could gain the same user rights as the local user," Microsoft said in its advisory. "We are aware of attacks attempting to exploit the vulnerability."

Microsoft said it is working with its partners to provide information they can use to provide broader protections to customers. "Microsoft is currently working to develop a security update for Windows to address this vulnerability," the company said.

Microsoft is recommending users remove support for ActiveX Video Control until a fix is in place.

"When the ActiveX control is used in Internet Explorer, the control may corrupt the system state in such a way that an attacker could run arbitrary code," the Redmond, Washington-based company said.

Attackers can exploit the vulnerability when Internet users visit websites with malicious code. Unsuspecting users may receive emails requesting they visit malicious websites.

"Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights," Microsoft said.