Showing posts with label wild. Show all posts
Showing posts with label wild. Show all posts
Monday, February 6, 2017
Not In The Wild iOS 8 SSL Certificate Parsing Bug Crash Crash Crash
Not In The Wild iOS 8 SSL Certificate Parsing Bug Crash Crash Crash
--
Interest Level: Background
The system used to encrypt data sent across the Internet has had a bad time this past year. A parade of bugs and exploits have been found. Related problems in hash functions have been found. Fraudulent security certificates have been forged by questionable certificate authorities. Google has injected a level of paranoia as well as demands for technology improvements, while itself ignoring its own aspirations. The result is a complicated and confusing mess that leaves users wondering what is safe and what is not.
On Wednesday, Dan Goodin of Ars Technica reported a new twist in the Internet encryption contortions by way of a report and public presentation from the company Skycure. They have found a bug in iOS 8 that allows an attack on iOS devices over Wi-Fi through the use of a malicious SSL security certificate. This attack can trigger Apple devices running iOS 8 to go into an endless crash loop while in the connection vicinity of the offending Wi-Fi network.
Note that this bug is NOT yet being exploited in the wild. It is at this point simply of interest while we wait for Apple to patch the bug and prevent it from becoming a real problem for users.
Below, I have linked both Dan Goodins article and the source blog post from Skycure.
If youre interested in higher level Mac and iOS security, this is well worth a read. Otherwise, its in the background as only a potential problem to iOS users.
iOS bug sends iPhones into endless crash cycle when exposed to rogue Wi-Fi
SSL cert parsing error allows attackers to create "No iOS Zone," researchers say.
- Dan Goodin, Ars Technica
“No iOS Zone” – A New Vulnerability Allows DoS Attacks on iOS Devices
- Yair Amit, Skycure
Both articles provide videos illustrating the SSL certificate bug.
Share and Enjoy,
:-Derek
--
Go to link Download
Sunday, October 30, 2016
New Adobe Flash Exploits In The Wild New Critical Adobe Flash Update v11 6 602 171
New Adobe Flash Exploits In The Wild New Critical Adobe Flash Update v11 6 602 171
--
Where to download the latest version of Flash, in this case v11.6.602.171:
http://get.adobe.com/flashplayer/
Adobes related security reports:
Security updates available for Adobe Flash Player (APSB13-08)
Today, a Security Bulletin (APSB13-08) has been posted to address security issues in Adobe Flash Player 11.6.602.168 and earlier versions for Windows, Adobe Flash Player 11.6.602.167 and earlier versions for Macintosh, and Adobe Flash Player 11.2.202.270 and earlier versions for Linux.
Adobe is aware of reports that CVE-2013-0643 and CVE-2013-0648 are being exploited in the wild in targeted attacks designed to trick the user into clicking a link which directs to a website serving malicious Flash (SWF) content. The exploit for CVE-2013-0643 and CVE-2013-0648 is designed to target Flash Player in Firefox.
Adobe recommends users apply the updates for their product installations.
Security Bulletin (APSB13-08)
- Users of Adobe Flash Player 11.6.602.168 and earlier versions for Windows and Adobe Flash Player 11.6.602.167 and earlier versions for Macintosh should update to Adobe Flash Player 11.6.602.171.
- Users of Adobe Flash Player 11.2.202.270 and earlier versions for Linux should update to Adobe Flash Player 11.2.202.273.
- Adobe Flash Player installed with Google Chrome will automatically be updated to the latest Google Chrome version, which will include Adobe Flash Player 11.6.602.171 for Windows, Macintosh and Linux.
- Adobe Flash Player installed with Internet Explorer 10 for Windows 8 will automatically be updated to the latest version of Internet Explorer 10, which will include Adobe Flash Player 11.6.602.171 for Windows.
This update resolves a permissions issue with the Flash Player Firefox sandbox (CVE-2013-0643).
This update resolves a vulnerability in the ExternalInterface ActionScript feature, which can be exploited to execute malicious code (CVE-2013-0648).
This update resolves a buffer overflow vulnerability in a Flash Player broker service, which can be used to execute malicious code (CVE-2013-0504).
Stop Adobe Flash In Your Web Browser!
Because of drive-by infections via malicious Flash files, I HIGHLY recommend stopping Flash files dead in your web browsers until YOU approve them running. I have updated my list of web browser Flash blocking add-ons/extensions:
Safari: ClickToFlash, Plugin Customs
Firefox: Flashblock, NoScript
Chromium: Flashblock, FlashControl, SafeScript (ScriptNo)
Opera: Use the Preferences:Advanced:Content:"Enable plug-ins only on demand" checkbox. Also sort of useful is NotScripts. (Note: NotScripts is kind of a PITA to setup, but works once you have your JavaScript cache set, as prescribed, to 5000K).
:-Derek
--
Go to link Download
Sunday, October 23, 2016
MS Silverlight Exploit In The Wild Uninstall Silverlight NOW! Or update if youre stuck using it
MS Silverlight Exploit In The Wild Uninstall Silverlight NOW! Or update if youre stuck using it
--
I dont know of any reason to continue using Microsofts Silverlight Internet plug-in and neither does Microsoft! The company has, albeit quietly, stated that they are eventually discontinuing all support of Silverlight and that everyone should move on to more modern technologies. That includes ALL Mac users. So bully for Microsoft for sort of warning people ahead of time that Silverlight Is Dead. HTML5 and other MS technologies replace it in entirety.
But the damned thing is still being used by many websites. Meanwhile, further security holes in Silverlight have been found and are being exploited on the web at this moment, in-the-wild. Mac users are susceptible and are going to suffer. Uninstall Silverlight NOW! Dont update it. Just UNINSTALL IT! That is my personal advice.
Heres whats going on:
Malicious websites exploit Silverlight bug that can pwn Macs and Windows
Code execution exploit for just-fixed bug makes encore appearance in Angler.
. . . Exploit code for the patched vulnerability is being distributed through Angler, one of several toolkits that criminals use to seed websites with code that carry out drive-by attacks. The Silverlight attack was spotted earlier this week by a researcher who goes by the moniker Kafeine. The vulnerability is indexed as CVE-2016-0034. . . .
Microsoft has been clear that exploits have the ability to remotely execute malicious code on both unpatched Windows and OS X devices. . . .
While Silverlight vulnerabilities arent nearly as numerous as security bugs in Adobes Flash or Oracles Java, Kafeines discovery shows that the Microsoft framework has the potential to endanger a broad base of people using both Windows and OS X. Readers who can browse the Internet without Silverlight are best off uninstalling it. Everyone else should religiously update it as soon as patches become available. Patched versions are 5.1.41212.0 or higher.Here are Microsofts instructions for removing the Silverlight Internet plug-in from Mac computers:
Removing Silverlight plugins on Macintosh
1. Access your hard driveI must add:
Double-click the hard drive icon on your desktop
2. Find the plugin
Navigate to your Internet Plug-Ins directory: /Library/Internet Plug-Ins/
3. Remove the plugin
Drag any of the following into your trash bin:
• Silverlight.plugin
• WPFe.plugin
4. Restart ALL your web browsers. Otherwise Silverlight will still be running in them.
And again: Dont patch Silverlight. UNINSTALL Silverlight. Get it over with. If you run into some retrograde website that insists upon using Silverlight, send them this link, dated January 16, 2014:
Silverlight Support Roadmap
Microsoft will continue to support Silverlight 5 until 10/12/2021Thats the cutoff date.
Microsoft continues to release updates to Silverlight 5 to address security and compatibility issues.But thats it for the future of Silverlight.
So get rid of it! Immediately! So say I.
--
Go to link Download
Subscribe to:
Posts (Atom)