2007.01.16 Daily Security Reading
by Rodney Campbell on Jan.16, 2007, under Security
Subverting PatchGuard Version 2; A proof of concept executable packer that does not use any custom code to unpack binaries at execution time; and Exploiting 802.11 Wireless Driver Vulnerabilities on Windows.
Hackers look to break Apple iPhone
Within hours of Apple’s iPhone launch this week, the iPhone was a hot topic on the Dailydave discussion list, a widely read forum on security research. Much of the discussion centred on the processor that Apple may have chosen to power its new device and what kind of assembly language "shellcode" might work on this chip.
Corporate Security Hole: Employees Forwarding eMail to Personal Accounts
Employees forwarding their work email to "web-accessible personal accounts" is a growing problem. When away from the corporate network accessing email from these accounts is usually faster and easier than going through the corporate remote email solution. Accessing email from these accounts is usually faster and easier than going through corporate networks. However, because email sent from these services does not pass through the corporate mail system, companies could run afoul of federal laws that require them to archive corporate email and turn it over during litigation.
RSA Finds Phishing Kit With GUI Interface
A new "do-it-yourself" phishing kit enables criminals to launch quite effective man-in-the-middle phishing attacks. The graphical user interface makes it easy for less skilled criminals to start fooling users into providing sensitive information. The tool steals the actual web page of the target institution so that the user sees a completely familiar page.
Secure Passwords Keep You Safer
Ever since Bruce Schneier wrote about the 34,000 MySpace passwords he analyzed, people have been asking how to choose secure passwords.