Chinese Blogs Detail Zero-day Flaw in Microsoft Works
,----[ Quote ]
| Chinese-language blogs are detailing a zero-day vulnerability in Microsoft
| Works, the company's lower-end office productivity suite, according to
| security vendor McAfee.
`----
http://www.pcworld.com/businesscenter/article/144803/chinese_blogs_detail_zeroday_flaw_in_microsoft_works.html
http://tinyurl.com/6jnyno
Hackers Cancel Attack on CNN
,----[ Quote ]
| Pro-China hackers had called for the attack in protest of the news network's
| coverage of Tibet, which they believe has been overly critical of China.
| Participants had been instructed to flood CNN's Web site with Internet
| traffic in hopes of knocking it offline, something known as a distributed
| denial of service (DDOS) attack.
`----
http://www.pcworld.com/businesscenter/article/144850/hackers_cancel_attack_on_cnn.html
I took a pamphlet from similar protests at the BBC yesterday. Many can
sympathise because there's serious daemonisation in the media, but that's
nothing new. The news also celebrated a nuclear holocaust after bombs had been
dropped on "the Japs" ("Them"). Also new:
GSM researcher stopped at Heathrow by UK government officials
,----[ Quote ]
| I was leaving today from the United Kingdom/Heathrow airport. I am about to
| speak at the HITB IT security conference about GSM security and the USRP
| (gnu-radio project).
|
| I was searched by the UK government while waiting at the Gate and reading a
| newspaper. A UK Government employee flipped his badge and said "Let's talk.
| Come over here".
`----
http://blog.thc.org/index.php?/archives/1-GSM-Researcher-stopped-at-Heathrow-Airport-by-UK-government-officials.html
http://tinyurl.com/5ruume
Recent:
Exploit Code Surfaces For Microsoft Works Vulnerability
http://www.informationweek.com/news/showArticle.jhtml?articleID=206504526
Microsoft: Critical patch goes missing
,----[ Quote ]
| Busy day for IT departments but key fix goes AWOL
`----
http://www.computerworlduk.com/technology/operating-systems/windows/news/index.cfm?newsid=7467
Microsoft dishes out six critical updates
,----[ Quote ]
| They all focus on flaws in the programs that could allow remote code
| execution. Affected systems are those running Windows XP, Windows Vista and
| Windows Server 2003
`----
http://www.theregister.co.uk/2008/02/13/patch_tuesday_february/
Microsoft fixes 17 flaws in 11 patches; 6 are 'critical'
,----[ Quote ]
| Microsoft on Tuesday released its February 2008 security bulletin, which
| includes 11 bulletins, six of which are deemed "critical" by Microsoft, while
| five are deemed "important." One bulletin, suggested in the advance notice
| posted Thursday, failed to be released Tuesday.
`----
http://www.news.com/8301-10789_3-9870399-57.html?part=rss&subj=news&tag=2547-1_3-0-20
Related:
Microsoft quietly tackles known Wi-Fi flaw
,----[ Quote ]
| Microsoft has quietly posted an update found here. The update
| prevents a Windows wireless client on a laptop from advertising
| its preferred wireless network list to the world at large.
|
| But the update appears to leave open the larger problem, which
| is having your laptop connect to a criminal rogue access point
| with the same default name as one of your preferred home networks.
`----
http://news.com.com/2061-10789_3-6143573.html?part=rss&tag=2547-1_3-0-20&subj=news
Vista SP1 will contain undocumented fixes
,----[ Quote ]
| Interesting email in today mailbag: “Will SP1 contain undisclosed or
| undocumented security fixes?”
|
| For some people, counting the number of security flaws that one OS has
| compared to another is important because it offers a metric upon which to
| determine which OS is the most secure (personally, I feel that it’s a bogus
| metric, but I’ll let it slide for now). However, many claim that Microsoft
| stacks the deck in its favor by not disclosing a full list of vulnerabilities
| that have been patched by omitting to include those discovered and patched
| in-house.
`----
http://blogs.zdnet.com/hardware/?p=1225
Critical Vulnerability in Microsoft Metrics
,----[ Quote ]
| This is a small subset of all the vulnerabilities, because the
| vulnerabilities that are found through the QA process and the vulnerabilities
| that are found by the security folks they engage as contractors to perform
| penetration testing are fixed in service packs and major updates. For
| Microsoft this makes sense because these fixes get the benefit of a full test
| pass which is much more robust for a service pack or major release than it is
| for a security update.
`----
http://blog.mozilla.com/security/2007/11/30/critical-vulnerability-in-microsoft-metrics/
http://antitrust.slated.org/www.iowaconsumercase.org/011607/3000/PX03096.pdf
Skeletons in Microsoft’s Patch Day closet
,----[ Quote ]
| This is the first time I’ve seen Microsoft prominently admit to silently
| fixing vulnerabilities in its bulletins — a controversial practice that
| effectively reduces the number of publicly documented bug fixes (for those
| keeping count) and affects patch management/deployment decisions.
`----
http://blogs.zdnet.com/security/?p=316
Beware of undisclosed Microsoft patches
,----[ Quote ]
| Forget for a moment whether Microsoft is throwing off patch counts
| that Microsoft brass use to compare its security record with those
| of its competitors. What do you think of Redmond’s silent patching
| practice?
`----
http://blogs.zdnet.com/microsoft/?p=527
Microsoft is Counting Bugs Again
,----[ Quote ]
| Sorry, but Microsoft's self-evaluating security counting isn't really a
| good accounting.
|
| [...]
|
| The point: Don't count on security flaw counting. The real flaw is
| the counting.
`----
http://www.microsoft-watch.com/content/security/microsoft_is_counting_bugs_again.html?kc=MWRSS02129TX1K0000535
|
|
