An Astonishing Collaboration

On Tuesday, software developers and network-hardware providers released a patch for a significant flaw in the domain-name service (DNS) system. The researcher who found the bug, Dan Kaminsky, talks about the issue and the history of DNS problems in the column, reprinted with permission from his site.

read more | digg story

Latest phishing schemes target Apple - SC Magazine US

It was only a matter of time before Apple users became attractive targets. If you think about the demographics of the typical Mac user it is obvious why they could be perceived as "easy targets"1. The belief that Apple software is not vulnerable2. Economic profile - higher income3. More trusting - not been burned before

read more | digg story

Three Cisco advisories released today

Cisco has released three advisories this week, two that cover DOS vulnerabilities in IOS SSH and the Secure Control Engine (SCE) and one privilege escalation in Cisco Voice Portal (CVP).Of course it was only a matter of time before we start hearing about Cisco IOS have many of the same issues as OS Software. Even more interesting however is the idea that Cisco is promoting the notion that you do not need to buy servers anymore. Instead you can run your server applications on your Cisco enterprise switching infrastructure. Let the patching cycle begin!

read more | digg story

Data Loss Prevention: Where Do We Go From Here?

I would change the idea that it is the CIO that is responsible for protecting information in the enterprise. It is in reality a business responsibility and as such the CEO should take the protection of enterprise data as a priority to protect the organizations information.

read more | digg story

Apple Mac trojan horse aims to steal money from Mac users

"Apple Macintosh users need to learn from the mistakes made by their Windows cousins in the past and ensure that they have defences in place, are up-to-date with patches and exercise caution about what they run on their computer."

read more | digg story

Apple less secure than Microsoft!

I recently heard a so called "security professional" state that security software is not necessary for the Mac. Well, not only are they wrong but the Mac is more likely to be comprimised since Apple is slower to patch than Microsoft. If you have a Mac you might already be 0wnd.

read more | digg story

Mac is the first to fall in Pwn2Own hack contest

A brand-new MacBook Air running a fully patched version of Leopard was the first to fall in a contest that pitted the security of machines running OS X, Vista and Linux. The exploit took less than two minutes to pull off.For all you so called "security professionals" that maintain the Macintosh does not need security software. We people, Mac is the first to fall in Pwn2Own hack contest.

read more | digg story

Have iTunes? "Free" upgrade to vulnerable browser for you!

Not only has Apple engaged in a questionable practice of "upgrading" software that is not installed (read Safari) but as an added feature your new software comes preinstalled with security vulnerabilites. Nice!

read more | digg story

No security software for Apple Macintosh?

I recently read an article from a so call "security expert" that stated Macintosh computers do not need security software. This is the most idiotic statement that I have ever heard a "security expert" make. Blatently irresponsible!

read more | digg story

Technical Cyber Security Alert TA08-079A - Apple Updates for Multiple Vulnerabilities

This could get tiresome, almost like watching Microsoft patches...

National Cyber Alert System

Technical Cyber Security Alert TA08-079A


Apple Updates for Multiple Vulnerabilities

Original release date: March 19, 2008
Last revised: --
Source: US-CERT

Systems Affected

* Apple Mac OS X versions prior to and including 10.4.11 and 10.5.2
* Apple Mac OS X Server versions prior to and including 10.4.11
and
10.5.1
* Apple Safari prior to 3.1, including both OS X and
Windows
versions

Overview

Apple has released the Apple Security Update 2008-002 and Apple
Safari
3.1 to correct multiple vulnerabilities affecting Apple Mac OS X,
Mac
OS X Server, and Apple Safari. Attackers could exploit
these
vulnerabilities to execute arbitrary code, gain access to
sensitive
information, execute cross-site scripting attacks or cause a denial
of
service.

I. Description

Apple Security Update 2008-002 and Apple Safari 3.1 to address
a
number of vulnerabilities affecting Apple Mac OS X, OS X Server,
and
Safari. Further details are available in the US-CERT
Vulnerability
Notes Database.

II. Impact

The impacts of these vulnerabilities vary. Potential
consequences
include arbitrary code execution, sensitive information
disclosure,
cross-site scripting, and denial of service.

III. Solution

Install updates from Apple

Install Apple Security Update 2008-002. These and other updates
are
available via Software Update or via Apple Downloads.

IV. References

* US-CERT Vulnerability Notes for Apple Security Update 2008-002 -

_2008_002>

* About the security content of Apple Security Update 2008-002 -


* About the security content of Safari 3.1 -


* Mac OS X: Updating your software -


* Apple Support Downloads -


_______________________________________________
ENT_CYBER_STF mailing list
ENT_CYBER_STF@listsmart.osl.state.or.us
http://listsmart.osl.state.or.us/mailman/listinfo/ent_cyber_stf
Hosted by the Oregon State Library (503)378-4246
Please use this contact for technical list questions only.
For informational questions related to message content, please contact the sender of the message, by phone or email.

Cyber Security Alert SA08-079A - Apple Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

National Cyber Alert System

Cyber Security Alert SA08-079A


Apple Updates for Multiple Vulnerabilities

Original release date: March 19, 2008
Last revised: --
Source: US-CERT

Systems Affected

* Apple Mac OS X
* Apple Safari for Mac and Windows

Overview

Apple Mac OS X and Apple Safari are affected by multiple
vulnerabilities. Apple has released Security Update 2008-002 and
Safari 3.1 to address these vulnerabilities, the most serious of
which may allow a remote attacker to take control of your computer.

Solution

Install an Update

Use Software Update to install Apple Security Update 2008-002 or
Safari 3.1.

Description

Apple Mac OS X is affected by multiple vulnerabilities. These
vulnerabilities could allow an attacker to run malicious programs
on your computer, crash your computer, or access your data without
your approval.

For more technical information, see US-CERT Technical Alert
TA08-079A.

References

* US-CERT Technical Cyber Security Alert TA08-079A -


* Vulnerability notes for Apple Security Update 2008-002 -


* About the security content of Security Update 2008-002 -


* About the security content of Safari 3.1 -


* Mac OS X: Updating your software -


_________________________________________________________________

The most recent version of this document can be found at:


_________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send
email to with "SA08-079A Feedback VU#766019" in the
subject.
_________________________________________________________________

For instructions on subscribing to or unsubscribing from this
mailing list, visit .
_________________________________________________________________

Produced 2008 by US-CERT, a government organization.

Terms of use:


____________________________________________________________________

Revision History

March 19, 2008: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBR+FiIvRFkHkM87XOAQIxVAf/ScYjb31IbAATwvPA1JpHNgQq/lUuXATt
kaTBFJBK1Ih1ZAy7ht/dh2B6ADCMeytokRGtdhEIGd74M8pPJNL2tXbP4EuhMiH9
Lis56P6HM8+wXxbGvl+fFs5MrNgxmvz++EL3LwlZlN+hR2d0J1w3Gxh/GbcPsSRa
3WvbLEpnTAXs+oDydwoe3MYGMTh9tTwj/g8rPX3t692plYVSiDV9R1a4oFKJfZEA
z6zNu9K4xfE2U6qxev87JxaJHyRv22rWk+jo2tXv3SDcnNNlMvjHaxGpQ29/xd1a
A5CcmQmDeyXHfvpL4TbCpmsIlvkbgkn69ujOg1rNHYMJWvdWlULq4A==
=Xs7c
-----END PGP SIGNATURE-----

Apple Safari Prior to 3.1 Multiple Security Vulnerabilities

Apple Safari is prone to 12 security vulnerabilities. Attackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. I guess I'll focus on Apple vulnerabilities for awhile :DSince Mac's are so secure maybe we should have some fun pointing out how wrong this assumption is! "Execute arbitray code" anyone?

read more | digg story

Macintosh Computers Increasingly Vulnerable to Comprimise

If you are a "Security Professional" and you don't think that a Mac needs protection get a new job!Read the previous post!

read more | digg story

Should Mac Users Run Antivirus Software?

With fewer than 200 known viruses over all time, is there really any reason to run antivirus software on a Mac, given the cost, intrusiveness, and resource usage? Macintosh security expert Rich Mogull doesn't use antivirus software and recommends that the average Macintosh user avoid it as well. Should you bother?Are you kidding? This is such a stupid argument I don't even know why I'm wasting a blog on it.

read more | digg story

Holes In Your Programs And How They Can Help Install Rootkit

Have you ever wondered why you have anti virus, anti spyware, anti adware ( Microsoft Windows Defender, Spybot, Spywareblaster ) but but still get windows popping up with ads, your hard drive is constantly churning or your internet usage stats have gone sky high. If you run as administrator you are probably already owned.

read more | digg story

We Don’t Need No Education

Security awareness training is costly and does go beyond how we interact with our PC's. I agree one hundred percent with the idea that awareness training should cover physical security, emergency response, and reporting suspicious activity.

read more | digg story

Mac Vs. PC, how about Apache Vs. IIS?

With the proliferation of "drive by" web server comprimises it serves the best interest of the "bad guys" when Apache people on Linux think that because they are not Windows they are immune from Windows exploits. iFrame exploits and malicious Javascript are OS agnostic. Safe surfing!

read more | digg story

Built-in Windows commands to determine if a system has been

Ed Skoudis identifies five useful Windows command-line tools for machine analysis and discusses how they can assist administrators in determining if a machine has been hacked.It's always good to have a command line toolset!

read more | digg story

Data loss prevention (DLP) tools: The new way to prevent ide

To protect confidential information, some security pros are turning to data loss prevention technology. Peter Giannoulis explains the strengths and weaknesses of DLP products.As part of a data classification effort DLP can help a great deal with "tagging" classified data.

read more | digg story

Customized security for virtual machines

As Virtual Machines become more popular methods to increase the security posture of these devices will become increasingly important.

read more | digg story