Security Stallions Blog "Musings of all things infosec…"

Daily Digs – 08.31.2009

It's Monday and, unfortunately, that means August 2009 is almost behind us.  That means, for many, back to school and the end of summer.  If only I was that lucky!  It's this time of year that the cool air and soon-to-be-colorful trees remind me of those days gone by of college campus life.  Enjoy it while you can you youngins!  On to the digs...

Uh oh!  Microsoft and the Linux kernel today faced exploit code being posted to milw0rm.  Although the Microsoft vuln is, obviously, getting much more attention do your due diligence to check both out.  The Microsoft exploit affects IIS5.0/6.0 and is a remote overflow while the Linux sploit code is the local NULL pointer dereference we've seen talked about more recently.  Get 'em while they're hot!
[Linux Kernel sock_sendpage()]
[Microsoft 5.0/6.0 FTPd Remote Root]

ThreatChaos is claiming Cisco better be watching their back due to a new integrated platform 3COM has just unveiled.  Basically the claim is that routing platforms are, and have been, a commodity for years now and that integrating security functionality (not sure how firewall functionality is "new" here since all of the features listed are, and have been in high-end firewall platforms for a considerable time now) will be the new defacto standard.
[Watch out Cisco]

MacPorts, today, get's a significant point release.  1.8.0 is out on the table now with disk images out for Snow Leopard if you've done a clean install over the weekend (I did).
[MacPorts 1.8.0 Released]

The TrendLabs Malware Blog has a good rundown of info around the trojan that's targeting Skype users.  The trojan hooks the send and receive APIs so that the voice conversations can be saved before any encryption is applied.  Trend says the trojan looks to be rather tame now with regards to the fact that it's not actively sending data out today, but that doesn't mean it won't in the future either.
[Trojan Targets Skype Users]

Now I'm not a big fan of SolarWinds utilities to begin with.  Sure, over the years I've used some of their utilities but when it takes multiple megs of proprietary code to install a TFTP server one has to wonder what's really packed in there.  The products themselves are rather underwhelming and there's far better free alternatives available.  But, if you'd like to mess with that coworker that is all about SolarWinds tools tell him/her to spin up the TFTP server for you to DoS.  The PoC code is there in the links as well.
[SolarWinds TFTP Server DoS]

Saint 7.1.1 was released today with some handy new features and vulnerability checks.  Check out the Security Database Tools site for the rundown.
[Saint 7.1.1 Released]

Could that medical imaging procedure you just had pose a serious risk to your long-term health?  CNET has published that 2% of all cancers could be attributed to radiation during CT scans alone.  Scary stuff.  So should more disclosure be required to help patients make a more informed decision?
[Medical-Imaging Procedures Always Worth the Risk]

The SSA is supposedly testing Microsofts HealthVault (their online health record service).  It's one thing for a particular hospital or clinic to do this, because then I can avoid them at all costs.  The SSA on the other hand, not very avoidable.  Who's making these decisions?
[SSA Testing Microsoft HealthVault]

When in doubt, reformat.  An interesting and, rather non-technical and unscientific, reasoning behind the motto.  Interesting for the perspective alone from a typical end user.  I got the chills when reading the part about IE 6.
[When in Doubt, Reformat]

So is the Conficker worm sitting dormant until an opportune time?  John Markoff has a slightly FUDish piece up that describes the "rogue software" as a ghost ship.  Maybe it was written by the Chinese government to see how far it could infect machines deep within the confines of the Pentagon?  But maybe our own government is behind it...  What do YOU think?
[Conficker Waiting to Strike]

And that's all for the commentary tonight boys and girls.  Here's some links that are news noteworthy as well!
-windexh8er

[Best Definition Ever]
[Security Solution for Craigslist]
[St. Luke Worker Accused of Stealing CC]
[Bill Tones Down Power to Shut Web]
[Trend Launches New Security Tracking Tool]