7/31/09-8/06/09
Police Computers Paralysed
Flagstaff(AZ) Police Dept and Coconino County Sheriff's Office have been down since Tuesday (6/28/09). 10 days after the initial system outage, staff still inconvienced but it looks like the worst is behind them. Countywide at 40 sites, more than 1,800 workstations had to undergo the debugging process. Costs are not available at this time. Looks like the culprit has been Conficker Strains A and D.
11/3/2009
FBI Warns of Fradulant ACH Transfers
Washington D.C. Customers who use online banking services are advised to contact their financial institution to ensure they are employing all the appropriate security and fraud prevention services their institution offers.
FBI Press Release
Banking Securely Online PDF
(ACH) Automated Clearing House
11/6/2009
Visa Data Security Alert - Targeted Hospitality Sector Vulnerabilities
Memory Parsing Vulnerability is actively targeting and being exploited within the hospitality industry. This vulnerability is being carried out by hackers in which they install debugging software on point-of-sale systems in order to extract full magnetic strip data from volatile memory, otherwise known as RAM
2/26/2010
Wyndham Hotels Hacked Again!!!
The break-in occurred between late October 2009 and January 2010. It affected an undisclosed number of company franchisees and hotel properties that Wyndham manages. Wyndham warned customers of a second breach in August 2009. Also, in Aug 2008 Wyndham also lost 480,000 credit card records to hackers at its Phoenix, AZ location.
Wyndham, operates Days Inn, Ramada and Super 8 motels.
4/26/2010
Microsoft DLL Hijacking Vulnerability
To summarize it, when an application dynamically loads a DLL without specifying a full path, Windows tries to locate the DLL by searching through a set of directories, known as DLL Search Order, which consists of
1. The directory from which the application loaded
2. The system directory
3. The 16-bit system directory
4. The Windows directory
5. The current working directory (CWD)
6. The directories that are listed in the PATH environment variable
Now, if the attacker discovers a vulnerable application they can place a malicious DLL and a file to be opened by the vulnerable application (to set the current working directory) on a remote orWebDav share so that the malicious DLL gets dynamically loaded to handle the designated file type.
A number of proof of concept exploits are out and there are reports that the issue has been actively exploited in the wild.
Microsoft has released guidance and tools for mitigating the issue both for the end users and for developers. Unfortunately, there must be hundreds of applications affected by the issue and it will take some time for their developers to fix them. In the mean time, it is important to follow the Microsoft Guidance to mitigate the threat.
This is a 'low-skill' exploit and is very scary since it affects all Microsoft Systems and cannot be easily fixed.
