Google has released Chrome version 62.0.3202.75 for all operating systems. This fixes a high-severity stack-based buffer overflow bug. My Chrome browser did not update automatically, but did so when I went into Settings->Help->About Chrome. Threat Post has a more detailed write-up here: https://threatpost.com/google-patches-high-severity-browser-bug/128661/
General
Bits on Bitcoin!
Author: Jared Hall Revision: 1.0 URL: https://www.jaredsec.com/2017/11/01/bits-on-bitcoin Date: 11/01/2017 Introduction In the midst of the global financial crisis, a paper was anonymously authored in November of 2008. It described a peer-to-peer, distributed, electronic payment system without the oversight of a “trusted” central party, like a bank, PayPal, or the Federal Reserve. The paper was titled: “Bitcoin“. […]
Microsoft Patch Tuesday: October 2017
Hmm. It’s another big update. Front and Center is CVE-2017-11826, a Remote Code Excecution, Zero-Day bug in all versions of Office 2007 and later, Word Automation Services, and Microsoft Office Web Apps server. This is important since there are active exploits of this bug “in the wild”. Two other Zero-Day bugs were fixed, CVE-2017-8703 (DOS in the […]
The How & Why of Caller-ID/SMS Spoofing
Caller-ID Spoofing? There’s an App for that! I recently received correspondence from individuals that I did not communicate and quickly determined that an unknown party has been spoofing my phone number. Between 2006 and 2007, I did some work for a small, local CLEC that had a CLASS 5 switch in St. Petersburg. They had […]
Common Mistakes Made With Your Tech Partners
ZDNet published an article “Ten mistakes to avoid when working with tech partners“, summarized herein by specifying what a company should do: Don’t treat all tech partners the same. Each of your tech partners have different functions, styles, and backgrounds. They each contribute to your success in a different way. You cannot manage them in […]
Joomla: Security Update
Joomla corrected a bug that was created 8 years ago where an attacker can steal website administrator credentials. The bug exists in Joomla’s LDAP (Lightweight Directory Access Protocol). Input is not properly sanitized, so an attacker can use wildcards to progressively determine credentials. Although the bug was present for 8 years, Joomla fixed it promptly […]
Top Attacking Countries: September 2017
The top three countries countries continue to be Russia, United States, and Ukraine. Russia re-assumed its position at #1. China moved down to #5. August 2017’s report can be found here.
GPS Hacked
Wired ran a story about widespread GPS errors experienced with merchant vessels traveling in the Black Sea. That story can be found here: https://www.wired.co.uk/article/black-sea-ship-hacking-russia. This has been experienced by at least 20 ships over the past year. One ship reports errors in the GPS-powered Automatic Identification System (AIS) every time they approach the Russian port of […]
Microsoft Office: No Shortage of Exploits
There exists another vulnerability (of sorts) within Microsoft Word that is actively being exploited for espionage and surveillance purposes. What is happening is that a Unicode reference to the INCLUDEPICTURE field can include a hyperlink to an external image or file, like a PHP script on a remote server. This is an OLE2 (Object Linking […]
VMware Exploited Again: Update Now
On Friday, 9/15/2017, VMware released patches for the ESXi Server, Workstation, and Fusion (Apple) hypervisors. The most serious issue, an out-of-bounds write vulnerability, exists in ESXi, and desktop hypervisors Workstation, and Fusion. An attacker could exploit the issue, which exists in a SVGA device, to execute code on the host O/S. This affects ESXi version […]