- Oct 23 Tue 2007 16:33
Adobe Reader 8.1 update available
- Oct 23 Tue 2007 11:49
2007 資訊安全自主研發研討會
 |
若您無法看到完整頁面，請按此處：here |
|
|||||||||||||||||||||||||||||||||||||||||
中華軟協資安促進會 / 陳振楠 會長- Oct 22 Mon 2007 11:13
[大砲開講]電線電纜產業服務網被植入惡意連結
電線電纜產業服務網被植入惡意連結，此惡意程式為 PE_LOOKED.GEN、BKDR_HUPIGON.EVG 和其他惡意程式，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒。(Credit: 匿名網友)
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_21.html
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_21.html
- Oct 22 Mon 2007 10:41
RealPlayer發現嚴重漏洞 僅影響Windows版
【賽迪網訊】10月21日消息，據外電報導，賽門鐵克研究人員發現一種惡意軟件能夠攻擊沒有使用補丁的RealNetworks的媒體播放器中一個嚴重安全漏洞。在發現這個惡意軟件一天之後，RealNetworks表示要馬上發佈修復這個漏洞的補丁。
RealNetworks產品開發總經理Russ Ryan星期五（10月19日）在博客中稱，RealNetworks已經製作了RealPlayer 10.5和11版本的補丁，修復了賽門鐵克發現的安全漏洞。該公司將將通過這個博客和公司安全更新網頁在星期五晚些時候向用戶提供這個補丁。
RealNetworks產品開發總經理Russ Ryan星期五（10月19日）在博客中稱，RealNetworks已經製作了RealPlayer 10.5和11版本的補丁，修復了賽門鐵克發現的安全漏洞。該公司將將通過這個博客和公司安全更新網頁在星期五晚些時候向用戶提供這個補丁。
- Oct 22 Mon 2007 10:37
以議會網站遭黑客攻擊 多名議員資料被修改
以色列議會網站20日遭黑客攻擊，多名議員的個人資料被惡意修改。警方已經對此展開調查。
據《耶路撒冷郵報》網站報導，以色列總理奧爾默特在議會網站裡的個人資料被黑客添加了「很快將入獄」的內容。
據《耶路撒冷郵報》網站報導，以色列總理奧爾默特在議會網站裡的個人資料被黑客添加了「很快將入獄」的內容。
- Oct 19 Fri 2007 15:43
[大砲開講]國光客運網站被植入惡意連結
國光客運網站被植入惡意連結，此惡意程式為 TROJ_HEURI.AW，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒。(Credit: Jimau 和匿名網友)
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_607.html
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_607.html
- Oct 19 Fri 2007 15:42
[大砲開講]臺北市商業處網站被駭
臺北市商業處網站被駭，在這裡要注意的是這個網站有可能被植入惡意連結或惡意程式碼，所以，他們的網管應該要找出系統或軟體的安全漏洞，然後，儘快修補這些漏洞，而不是只是移除/修改那些遭駭的檔案。
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_3599.html
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_3599.html
- Oct 19 Fri 2007 15:39
[大砲開講]中國國民黨網站被植入惡意連結
中國國民黨網站被植入惡意連結，最近有瀏覽這個網頁的網友，應該要盡速檢查自己的電腦，請各位暫時不要瀏覽這個網站，以免中毒。(Credit: Jimau)
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_18.html
詳情請按 rogerspeaking.blogspot.com/2007/10/blog-post_18.html
- Oct 18 Thu 2007 13:42
蠕蟲Win32/Pushbot.S 利用 MSN 進行傳播
- Oct 18 Thu 2007 13:41
Linux系統存在與Windows同樣的安全漏洞
【賽迪網訊】近日，微軟稱它會修復Windows安全漏洞以減少新的基於網絡的安全風險。但是，安全研究人員稱，其它操作系統可能也有同樣的安全風險。
一直在認真研究這個問題的安全研究人員之一Nathan McFeters稱，他希望在本星期在聖地亞哥舉行的Toorcon黑客會議上介紹Linux和Mac OS X等其它基於Unix的操作系統也存在URI（統一資源識別符）協議處理程序安全漏洞的細節。
一直在認真研究這個問題的安全研究人員之一Nathan McFeters稱，他希望在本星期在聖地亞哥舉行的Toorcon黑客會議上介紹Linux和Mac OS X等其它基於Unix的操作系統也存在URI（統一資源識別符）協議處理程序安全漏洞的細節。
- Oct 18 Thu 2007 13:38
[轉貼]溢出提權攻擊的解決辦法
在頻頻惡意攻擊用戶、系統漏洞層出不窮的今天，作為網絡管理員、系統管理員雖然在服務器的安全上都下了不少功夫，諸如及時打上系統安全補丁、進行一些常規 的安全配置，但有時仍不安全。因此必須惡意用戶入侵之前，通過一些系列安全設置，來將入侵者們擋在「安全門」之外，下面就將最簡單、最有效的防 (Overflow)溢出、本地提供權限攻擊類的解決辦法給大家分享。
一、如何防止溢出類攻擊
一、如何防止溢出類攻擊
- Oct 18 Thu 2007 13:28
Kaspersky Web Scanner ActiveX Format String Vulnerability
iDefense has published an advisory for a high-risk vulnerability in the Kaspersky online virus scanner which was discovered by Stephen Fewer of Harmony Security. You can read the full iDefense advisory here:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=606
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=606- Oct 18 Thu 2007 11:34
Cyber Security Awareness Tip #13: Patches and Updates
When I first started thinking about how to approach this topic, my mind instantly went to the technical side such as centralized patch management and staggered deployments etc. It would be very easy to present a checklist of do's and don'ts pertaining to updates and patching. However, when you think about it, the "non-technical" side is just as important.
Consider this statement made by Robert Conquest in his book called "Reflections on a Ravaged Century":
Consider this statement made by Robert Conquest in his book called "Reflections on a Ravaged Century":
- Oct 18 Thu 2007 11:28
Cyber Security Awareness Day #17 - Windows XP & Vista Security
[welcome our new handler, Mari Kirby Nichols! JBU]
One of the first ways to start a security discussion is with physical security. Yes, I know this is a technical forum, but really, is the system secure physically? Make sure the location can be secured. Utilize some type of locking mechanism to keep the machine safe. This may be a cable lock for a laptop computer or a lock on the CPU case. This is a pretty basic rule, but surprisingly many people forget this essential component of cyber security. One of the ways to increase your information security effort is to combine your program with the physical security department. Have you met with them and pooled your resources? Are you able to obtain audit logs of physical access as easily as you are able to pull up an event log?
One of the first ways to start a security discussion is with physical security. Yes, I know this is a technical forum, but really, is the system secure physically? Make sure the location can be secured. Utilize some type of locking mechanism to keep the machine safe. This may be a cable lock for a laptop computer or a lock on the CPU case. This is a pretty basic rule, but surprisingly many people forget this essential component of cyber security. One of the ways to increase your information security effort is to combine your program with the physical security department. Have you met with them and pooled your resources? Are you able to obtain audit logs of physical access as easily as you are able to pull up an event log?
- Oct 18 Thu 2007 11:21
Storm Botnet Kits Loom on the Horizon
The Storm Worm botnet is now using 40-byte encryption on traffic running with the Overnet peer-to-peer protocol—a weak encryption scheme but one that allows a malware author to segment the botnet into smaller networks that soon may show up as turnkey spam botnets for sale in malware forums.
"It is [pretty weak encryption]. I don't think the point was to make [the botnet's activity stealthier] or harder to crack. I think the idea was to segment out the network" in order to sell off Storm variants, SecureWorks Senior Security Researcher Joe Stewart told eWEEK in an interview.
"It is [pretty weak encryption]. I don't think the point was to make [the botnet's activity stealthier] or harder to crack. I think the idea was to segment out the network" in order to sell off Storm variants, SecureWorks Senior Security Researcher Joe Stewart told eWEEK in an interview.
