Previous Gnews

1
Previous Gnews
2
Patch Tuesday

• April 8 Patches (5 high/critical), Windows,
  Excel, ISA, IE, HTTP Services
• MS09-009 thru MS09-016
• May 1 Patch (critical) Office
• Other updates, MSRT, Defender Definitions, Junk
  Mail Filter

• MS09-017 MS Office PowerPoint, Remote Execution

3
Holes / Patches

• Oracle Quarterly Release, 43 bugs patched
• Apple 2009-002 / OS X 10.5.7
• Safari 3.2.3 / 4 Public Beta
• Firefox
• .blah blah blah monthly update of web browsers
• sctp_houdini.c, remote kernal exploit
• Charles Miller, shellcode on iPhone
• Divx WebPlayer, allows code execution
• Windows changes AutoRun in wake of ConFicker

4
Hacking

• MS009-014 PoC posted to Milw0rm
• Adobe exploits / PoC posted to Milw0rm
• PIN Block cracking
• Cell Phone Treasure, German made Nokia 1100
• Hi-jack one time passwords for bank transactions
• Dallas Cops get socialed
• Ryan Caskey rides shotgun while armed
• Govt. Commissions secure XP configuration
• Local policy template??
• Mac based bot net, iServices trojan ? iWork,
  Photoshop CS4
• TippingPoint DVLabs calls out Black Security
• GDIEMF vulnerability (ms09-006 I think)

5
Books
6
Corp. Hell

• Oracle acquires Sun
• Symantec buys Mi5
• DHS recruiting WhiteHats
• Secunia challlenges vendors for standard update
  API
• "90 percent of vulnerabilities on Windows
  machines are in third-party applications.
• Yahoo drops Geocities
• Apple / Twitter love tirangle

7
WTF
Pig Breeding Patented
8
Updates
process hacker 1.3.6.5 bind 10 dev
begins curuncula   - rootkit detection mobiusft
0.4.5  - forensics Fiddler Screenstamp Charles
proxy
9

• Interop, 27 Apr - 2 May / Las Vegas NV
• http//www.interop.com/lasvegas/
• Layerone, 17 18 May / Pasadena CA
• http//layerone.info
• MS BlueHat Spring 2008, May 2 2008 / Redmond WA
• http//www.microsoft.com/technet/security/bluehat/
  
• Black Hat USA, 25 30 July / Las Vegas NV
• http//www.blackhat.com/
• DefCon, 31 July 2 Aug / Las Vegas NV
• http//www.defcon.org/

10
All images scavenged without permission
All images scavenged without permission