Actus de la semaine [43/10]
Bonjour à tous 
La sélection des liens de la semaine. Pour ceux qui découvrent, et afin de repréciser l'intérêt de la démarche, il s'agit de recenser, via un filtre-Gof, arbitraire certes, l'actualité sécu grand public de la semaine, et les sujets généralistes du moment. Un petit peu en retard cette semaine 
Actus Sécurité Grand public
=> Faux flag Firefox, fabuleux filoutages et filtrages fantaisistes. 21/10/2010. «Le blog F-Secure est tombé sur une nouvelle technique d’attaque d’un genre inattendu : la fausse page d’alerte Firefox. De l’onglet au contenu du message, en passant par l’apparence générale, tout laisse à penser que l’internaute visé a sous les yeux un message d’alerte généré localement par son propre navigateur alors qu’il s’agit en fait d’une véritable page HTML distante imitant le goût, l’odeur et la couleur de ladite page d’alerte. Ce n’est là techniquement qu’une attaque en « ingénierie sociale », mais qui se distingue par son originalité (...).»
Source : http://www.cnis-mag.com/faux-flag-firefox-fabuleux-filoutages-et-filtrages-fantaisistes.html
=> [sCADA] SCADA Security ... or not. 24/10/2010. «J'ai eu l'occasion dernièrement de travailler sur des environnements SCADA : ça change ! Mais en quoi ? Comment aborder ces bêtes là ? Quelles sont les failles les plus récurrentes ? Et déjà, est-ce que c'est sécurisé ? Petit point sur mes premiers retours d'expérience (...).»
Source : http://mission-security.blogspot.com/2010/10/scada-scada-security-or-not.html
Billets en relation :
28/10/2010. SCADA sous les balles : http://bluetouff.com/2010/10/28/scada-sous-les-balles/
=> Dans l'estomac du python. 24/10/2010. «Après un long silence sur ce blog (mais une longue période d'intense activité IRL) il est temps de résumer certains trucs qui m'ont occupé niveau informatique ces derniers temps ! Comme le titre le laisse présumer ça parle pas mal de python mais ne vous enfuyez pas pour autant si vous ne maitrisez pas ce langage de script sur le bout des doigts : je vais esquiver les détails gorets du code cette fois et me contenter de donner un aperçu high-level des possibilités qui sont offertes (...).»
Source : http://www.ozwald.fr/index.php?post/2010/10/24/Dans-l-estomac-du-python
=> Un hacker surdoué de 12 ans trouve une faille critique dans Firefox. 25/10/2010. «Lorsque Mozilla a décidé de multiplier par six la récompense pour la découverte d'une vulnérabilité importante, le jeune prodige s'est mis en tête de remporter la prime (...).»
Billets en relation :
25/10/2010. 12-year old awarded $3,000 for Firefox vulnerability : http://www.h-online.com/open/news/item/12-year-old-awarded-3-000-for-Firefox-vulnerability-1124547.html
=> Interesting Insider Threat Statistics. 25/10/2010. «When members of our team give presentations, conduct assessments, or teach courses, one of the most common questions is, "Just how bad is the insider threat?" According to the 2010 CyberSecurity Watch Survey, sponsored by CSO Magazine, the United States Secret Service (USSS), CERT, and Deloitte, the mean monetary value of losses due to cyber crime was $394,700 among the organizations that experienced a security event (...).»
Source : http://www.cert.org/blogs/insider_threat/2010/10/interesting_insider_threat_statistics.html
=> The Botnet Wars: a Q&A. 25/10/2010. «Botnet kits. Crimeware kits. Exploit kits. Who hasn’t heard these words nowadays ? Sold in underground forums, they are becoming more popular due to a drop in prices and the fact you do not need to be a technological wonder to use them (...).»
Source : http://malwaredatabase.net/blog/index.php/2010/10/25/the-botnet-wars-a-qa/
=> L'extension Firesheep pour Firefox permet de détourner des comptes personnels. 26/10/2010. «Firesheep balaie les réseaux WiFi ouverts, repère les internautes visitant des sites non sécurisés et permet de s'y connecter en usurpant leur identité (...).» A chaque semaine son buzz... J'aime le tweet malwarescene ^^.
Billets en relation :
25/10/2010. Firesheep: Making the Complicated Trivial : http://www.f-secure.com/weblog/archives/00002055.html
25/10/2010. Piratage de session web à grande échelle : http://sebsauvage.net/rhaa/index.php?2010/10/25/14/12/00-piratage-de-session-web-a-grande-echelle
26/10/2010. Se protéger de FireSheep : http://www.korben.info/se-proteger-de-firesheep.html
26/10/2010. Firesheep: who is eating my cookies : http://pandalabs.pandasecurity.com/firesheep-who-is-eating-my-cookies/
26/10/2010. La psychose Firesheep : http://twitter.com/MalwareScene/statuses/28796930344
27/10/2010. Unencrypted Wireless: In Like a Lion, Out Like a Lamb : http://blog.eset.com/2010/10/27/unencrypted-wireless-in-like-a-lion-out-like-a-lamb
27/10/2010. New FireSheep-Style Tool Hijacks Twitter Session : http://threatpost.com/en_us/blogs/new-firesheep-style-tool-hijacks-twitter-sessions-102710
27/10/2010. Firesheep : le vol de cookie pour les nuls : http://systemf4ilure.blogspot.com/2010/10/firesheep-le-vol-de-cookie-pour-les.html
27/10/2010. Firesheep: Baaaaad News for the Unwary : http://krebsonsecurity.com/2010/10/firesheep-baaaaad-news-for-the-unwary/
28/10/2010. Sniffer les mots de passe avec Firesheep : http://www.zataz.com/news/20772/Sniffer-les-mots-de-passe-avec-Firesheep.html
29/10/2010. FireShepher - switch OFF Firesheep : http://notendur.hi.is/~gas15/FireShepherd/
=> E-Mail Spam Falls After Russian Crackdown. 26/10/2010. «MOSCOW — You may not have noticed, but since late last month, the world supply of Viagra ads and other e-mail spam has dropped by an estimated one-fifth. With 200 billion spam messages in circulation each day, there is still plenty to go around (...).»
Source : http://www.nytimes.com/2010/10/27/business/27spam.html
Billets en relation :
28/10/2010. Un spammeur russe s'enfuit et le nombre de pourriels chute : http://www.france24.com/fr/20101028-igor-gusev-spam-russie-viagra-poursuite-spamit-pourriel
28/10/2010. Il y a 20 % de spam en moins dans le monde suite à l'arrestation d'un cyber-criminel Russe : http://www.developpez.com/actu/22858/Il-y-a-20-de-spam-en-moins-dans-le-monde-suite-a-l-arrestation-d-un-cyber-criminel-Russe
=> Contre-vérités sur les botnets... . 26/10/2010. «Les botnets sont actuellement parmi les menaces les plus sérieuses sur Internet. Leur capacité à se répandre sur de très nombreuses machines et l'aspect "couteaux-suisses" les rend en effet très dangereux. Généralement, les botnets présentent des architectures relativement similaires autour de 3 composants principaux (...).»
Source : http://cidris-news.blogspot.com/2010/10/contre-verites-sur-les-botnets.html
=> Zeus Attacks and the Global Fight. 26/10/2010. «Zeus is getting more sophisticated, and two arrests last month -- one in the United Kingdom and one in the United States -- made for crimes linked to Zeus attacks prove law enforcement is taking Zeus seriously (...).»
Source : http://www.bankinfosecurity.com/articles.php?art_id=3036
Billets en relation :
26/10/2010. Source : http://twitter.com/MalwareScene/statuses/28790300657
=> Thales lance CYBELS. 26/10/2010. «Thales annonce aujourd'hui le lancement de CYBELS (CYBer Expertise for Leading Security), solution globale, modulaire et évolutive, dédiée à la cybersécurité. Conçue pour protéger les systèmes d'information critiques contre les cyber-menaces en anticipant, bloquant et répondant rapidement aux attaques (...).» Quand les industriels de la Défense investissent massivement le numérique... La médiatisation de futurs et actuels cyberconflits que l'on constate sur le web n'est sans doute pas fortuite.
Source : http://www.thalesgroup.com/Press_Releases/Markets/Defence/2010/26102010_CYBELS/?LangType=1036
=> Feds warn of money mule and takeover scams . 26/10/2010. «The U.S. Secret Service, the FBI, the Internet Crime Complaint Center and the Financial Services Information Sharing and Analysis Center have issued a pair of advisories detailing the threat to job seekers from money mule scams and to small and medium size businesses from the bank-account takeovers that use the mules (...).»
Source : http://sunbeltblog.blogspot.com/2010/10/feds-warn-of-money-mule-and-takeover.html
Billets en relation :
27/10/2010. Cybercriminals aggressively recruiting money mules : http://www.net-security.org/malware_news.php?id=1513
=> M00p virus-writing gang member pleads guilty. 26/10/2010. «A Scottish computer hacker has pleaded guilty at Southwark Crown Court to breaking the Computer Misuse Act, after spreading malware around the world via spammed out emails (...).»
Source : http://nakedsecurity.sophos.com/2010/10/26/m00p-viruswriting-gang-member-pleads-guilty
=> CERT-XMCO : de nouvelles informations sur les AET. 26/10/2010. «Il semblerait que cette nouvelle soit plus du recyclage d’information qu’une réelle nouveauté. Les éléments actuels en notre possession nous poussent à penser qu’il s’agirait plus d’un coup de communication/marketing à l’approche de la sortie de la solution Stonesoft qu’autre chose... (...).»
Source : http://www.globalsecuritymag.fr/CERT-XMCO-de-nouvelles,20101027,20315.html
=> How Google Locates and Identifies Malware. 27/10/2010. «Google knows a thing or two about malware on the Web. Google comes across malware on a regular basis and has made a number of efforts to help secure Web users against potential malware risk. In a session at the SecTOR security conference in Toronto, Google security researcher Fabrice Jaubert detailed how the search engine giant identifies malware and what it does to help protect the safety and security of Web users (...).»
Source : http://www.esecurityplanet.com/news/article.php/3910241/article.htm
Billets en relation :
29/10/2010. A peek into Google's anti-malware operation : http://www.net-security.org/malware_news.php?id=1516
=> Cybercriminalité : le ministère de l'intérieur s'emmêle les pinceaux. 27/10/2010. «Le ministère de l'intérieur fait le bilan de sa plateforme Internet-Signalement dédiée à la dénonciation des infractions sur Internet, mais semble se tromper sur les chiffres. Il annonce par ailleurs sa volonté de renforcer les partenariats privés, pour "que l'internet ne devienne pas un espace de non-droit" (...).»
=> Attention aux virus d'Halloween !. 27/10/2010. «Halloween approchant à grand pas, nombreux sont les faux virus qui circuleront, envoyés par vos amis pour vous faire frissonner devant votre écran... (...).» Comme à chaque actualité récurrente et médiatique, l'offensive a le temps d'être soigneusement préparée. Illustration avec le thème d'Halloween.
Source : http://blog.pandasecurity.fr/2010/10/halloween-virus-peur-securite.html
Billets en relation :
26/10/2010. Malware Spreading via Halloween Related Keywords : http://pandalabs.pandasecurity.com/malware-spreading-via-halloween-related-keywords/
28/10/2010. Halloween, la campagne de Black Hat SEO sévit sur les moteurs de recherche : http://www.malwarecity.com/fr/blog/halloween-la-campagne-de-black-hat-seo-sevit-sur-les-moteurs-de-recherche-887.html
29/10/2010. Halloween Likejacking Campaign : http://research.zscaler.com/2010/10/halloween-likejacking-campaign.html
29/10/2010. Battle the Bogeyman this Halloween! : http://blogs.technet.com/b/mmpc/archive/2010/10/29/battle-the-bogeyman-this-halloween.aspx
=> Q&A: Evercookie Creator Samy Kamkar. 27/10/2010. «Samy Kamkar has been making quite a bit of noise lately, beginning with his release of the Evercookie earlier this month and continuing with his talk at the SecTor conference this week on novel methods for stealing users' cookies without any browser bugs. In this interview, he discusses both of those methods, as well as a new technique he developed that can use Google data and simple attacks to find a user's physical location within a few feet (...).»
Source : http://threatpost.com/en_us/blogs/qa-evercookie-creator-samy-kamkar-102710
=> Why Cybercriminals “Outsource” Malware Distribution. 28/10/2010. «During a recent analysis of a particular malware sample, we came across the author’s online nickname. After some digging, we found a link to the location where the author advertised his malware and allowed others to freely download its source code (...).»
Source : http://blog.trendmicro.com/why-cybercriminals-outsource-malware-distribution/
=> Adobe Flash Player & Adobe Reader and Acrobat 0-day. 28/10/2010. «The vulnerability can be delivered directly via a SWF file (Flash) or via a PDF file with an embedded Flash file object. An attack using the vulnerability with a PDF file has been spotted in the wild by Contiago Malware Dump (...).»
Billets en relation :
28/10/2010. Flash and Acrobat/Reader Hit by New Zero-Day Exploit : http://blog.trendmicro.com/flash-and-acrobatreader-hit-by-new-zero-day-exploit/
28/10/2010. CVE-2010-3654 - New dangerous 0-day authplay library adobe products vulnerability : http://isc.sans.edu/diary.html?storyid=9835
28/10/2010. APSA10-05 : http://www.adobe.com/support/security/advisories/apsa10-05.html
29/10/2010. New Zero-Day Attack in Adobe Products (CVE-2010-3654) : http://community.ca.com/blogs/securityadvisor/archive/2010/10/29/new-zero-day-attack-in-adobe-products-cve-2010-3654.aspx
=> Another 1.5 million Twitter links scanned. 28/10/2010. «In March 2010, I analyzed about 1 million links taken from public tweets on Twitter. I showed that the number of malicious links was less than 1%. I have scanned another 1.5 million links in the past 3 months from Twitter public time line (1,587,824 exactly). I analyzed these URLs and the server content to find how many of them lead to malicious pages by running them through the Zscaler cloud (...).»
Source : http://research.zscaler.com/2010/10/another-15-million-twitter-links.html
=> Demystifying KB976902, a.k.a. Microsoft’s “Blackhole” Update. 28/10/2010. «I’ve received several e-mails from readers concerned about a mysterious, undocumented software patch that Microsoft began offering to Windows 7 users through Windows Update this week. Some Microsoft users have been spinning conspiracy theories about this patch because it lacks any real description of its function, and what little documentation there is about it says that it cannot be removed once installed and that it may be required as a prerequisite for installing future updates (...).»
Source : http://krebsonsecurity.com/2010/10/demystifying-kb976902-a-k-a-microsofts-blackhole-update/
=> Payer ou être poursuivi pour pornographie, la dernière arnaque sur internet. 29/10/2010. «Amener une personne à se dévêtir devant sa webcam lors de "chats" érotiques, puis la menacer de poursuites en se faisant passer pour une administration, avant de lui proposer un arrangement financier, c'est la dernière arnaque sur internet, révélée vendredi par les gendarmes (...).»
Billets en relation :
30/10/2010. Source : http://cybercriminalite.wordpress.com/2010/10/30/payer-ou-etre-poursuivi-pour-pornographie-la-derniere-arnaque-sur-internet/
=> IE Tab Plus (FF 3.6+) 1.95 - Adware.. 29/10/2010. «Beginning with v1.95.20100930, IE Tab Plus now includes the optional Price Comparison feature powered by Superfish. Price Compare uses sophisticated visual search technology to find you deals while you shop on hundreds of U.S. merchant sites. This feature is by default disabled and will only be enabled in "Featured Mode" or "Advanced Mode". If you try it and still wish to disable the feature, just go to the Settings window and select Basic mode. However, if you really don't like this extra plugin, you can also uninstall this version and try a clean version (...).» Attention aux utilisateurs de cette extension. Il y a eu plusieurs versions qui posent soucis avec l'apparition et disparition de "sponsors", au gré des positions de l'auteur. Il semble en être revenu, mais prudence.
Source : https://addons.mozilla.org/fr/firefox/addon/10909/#reviews
Billets en relation :
16/10/2010. Spyware found in (Coral) IE Tab Plus (3.6) - 1.95 : http://forums.mozillazine.org/viewtopic.php?f=38&t=2014247
21/10/2010. IE Tab Plus (FF3.6+, No Adware, Absolutely Clean) 1.96.2010102 : https://addons.mozilla.org/fr/firefox/addon/52809/
Actus Sécurité Confirmé(s)
=> SpyEye v. ZeuS Rivalry Ends in Quiet Merger. 24/10/2010. «Leading malware developers within the cyber crime community have conspired to terminate development of the infamous ZeuS banking Trojan and to merge its code base with that of the up-and-coming SpyEye Trojan, new evidence suggests. The move appears to be aimed at building a superior e-banking threat whose sale is restricted to a more exclusive and well-heeled breed of cyber crook (...).»
Source : http://krebsonsecurity.com/2010/10/spyeye-v-zeus-rivalry-ends-in-quiet-merger/
Billets en relation :
26/10/2010. Mergers and Acquisitions in the Malware Space : http://www.symantec.com/connect/fr/blogs/mergers-and-acquisitions-malware-space
=> Qakbot Spreads like a Worm, Stings like a Trojan. 25/10/2010. «While the name Qakbot may sound funny, the Trojan is targeting business and corporate accounts—and no one is laughing. Named after its main executable file, _qakbot.dll, the Qakbot Trojan is not new; however the RSA FraudAction Research Lab has uncovered some unique attributes of Qakbot rarely seen before in other financial crimeware (...).»
Source : http://blogs.rsa.com/rsafarl/businesses-beware-qakbot-spreads-like-a-worm-stings-like-a-trojan/
Billets en relation :
26/10/2010. Emerging Qakbot Exploit Is Ruffling Some Feathers : http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=228000087
=> Spyeye using MitB to make fraudulent transactions. 25/10/2010. «Recently our e-crime team has discovered that Spyeye is using Man in the Browser (MitB) techniques in order to make fraudulent transactions. Thanks to MitB cybercriminals can make the transactions in the same banking online session as the real user, therefore they can do it in a quickly and clean way. I say clean because in the logs of the online banking application there won't be more IPs than the real user ones. It means less proofs in an hypothetical court against the bad guys, for example (...).»
Source : http://eternal-todo.com/blog/spyeye-mitb-javascript
=> Bredolab - Severely Injured but not dead. 26/10/2010. «Today started with some good news. The mega botnet known as Bredolab has been taken down. Kudos to the Dutch police and involved ISPs. Over the years, Bredolab evolved into a powerful pay per install network. The bot herders behind it have shown great expertise in spreading their core malware using different infection vectors such as drive by downloads and social engineering. The sole purpose of Bredolab was to spread itself as aggressively as possible and offer pay per install services (normally a few cents per installation) to other cyber criminals who might not be very good at spreading their own malware (...).»
Source : http://blog.fireeye.com/research/2010/10/bredolab-severely-injured-but-not-dead.html
Billets en relation :
26/10/2010. Bredolab, dead, dying or dormant? : http://countermeasures.trendmicro.eu/bredolab-dead-dying-or-dormant/
26/10/2010. Bredolab botnet shut down : http://www.f-secure.com/weblog/archives/00002056.html
26/10/2010. Suspected Bredolab botnet operator arrested at Armenian airport : http://nakedsecurity.sophos.com/2010/10/26/suspected-bredolab-botnet-operator-arrested-armenian-airport/
26/10/2010. Bredolab Takedown, Another Win for Collaboration : http://blogs.technet.com/b/mmpc/archive/2010/10/26/bredolab-takedown-another-win-for-collaboration.aspx?
27/10/2010. Bredolab - "It's not the size of the dog in the fight : http://blog.fireeye.com/research/2010/10/bredolab-its-not-the-size-of-the-dog-in-fight.html
27/10/2010. Le Botnet BredoLab démantelé : http://www.zataz.com/news/20774/Botnet-BredoLab.html
27/10/2010. CERT-XMCO : la police néerlandaise met à terre le botnet Bredolab : http://www.globalsecuritymag.fr/CERT-XMCO-la-police-neerlandaise,20101027,20316.html
28/10/2010. "Your are infected with Bredolab" Message Problem : http://www.norman.com/security_center/blog/righard_zwienenberg/129332/en
29/10/2010. [Video] Security Minute: October Edition looks at Bredolab, Ransomware and Money Mules : http://blog.fortinet.com/video-security-minute-october-edition-looks-at-bredolab-ransomware-and-money-mules/
30/10/2010. Bredolab Mastermind Was Key Spamit.com Affiliate : http://krebsonsecurity.com/2010/10/bredolab-mastermind-was-key-spamit-com-affiliate/
=> Capturing Packets in JavaScript with node_pcap. 26/10/2010. «OK, I hear you. Capturing packets is hard and best left to kernel hackers, assembly language programmers, and black hat security researches. If you just want to make things for the web using node.js, why should you care? (...).»
Source : http://howtonode.org/capturing-packets-in-javascript
Billets en relation :
26/10/2010. Source : http://twitter.com/MalwareScene/statuses/28798669176
=> Koobface: the cross-platform version. 27/10/2010. «The Koobface worm makes the news again with a cross-platform version of the Worm (...).»
Billets en relation :
27/10/2010. Mac users hit with Windows-style 'Koobface' Trojan : http://news.techworld.com/security/3246147/mac-users-hit-with-windows-style-koobface-trojan/
28/10/2010. A look behind the new cross-platform Facebook Worm : http://blogs.paretologic.com/malwarediaries/index.php/2010/10/28/a-look-behind-the-new-cross-platform-facebook-worm/
29/10/2010. OS X the main target of new Facebook Worm? : http://blogs.paretologic.com/malwarediaries/index.php/2010/10/29/os-x-the-main-target-of-new-facebook-worm/
=> Hosting backdoors in hardware. 27/10/2010. «Have you ever had a machine get compromised? What did you do? Did you run rootkit checkers and reboot? Did you restore from backups or wipe and reinstall the machines, to remove any potential backdoors? (...).»
Source : http://blog.ksplice.com/2010/10/hosting-backdoors-in-hardware/
=> SSI offensive et infections de masse à Milipol Qatae. 27/10/2010. «Doha, Qatar - Si par chez nous le débat sur la capacité offensive des Etats en matière de SSI semble encore divertir l'opinion, dans le désert du Qatar les choses sont beaucoup plus simples : l'on propose aux gouvernements des outils d'infection clés en mains. Milipol Qatar 2010 est ainsi l'occasion de découvrir deux offres commerciales de SSI offensive destinées, on s'en doute, uniquement aux forces de l'ordre et autres entités gouvernementales (...).»
=> Sniff sniff, ça sent le GSM!. 28/10/2010. «C'est un fait connu, l'industrie de la sécurité se penche de plus en plus vers les smartphones (ordiphones selon l'académie) et les communications sans-fils. On entend parler que le GSM est broken, et qu'il ne faut plus l'utiliser. Est il réellement possible avec du matériel standard d'écouter des conversations GSM? (...).»
Source : http://exploitability.blogspot.com/2010/10/sniff-sniff-ca-sent-le-gsm.html
=> Vecebot Trojan Analysis. 28/10/2010. «SecureWorks' Counter Threat UnitSM (CTU) security research team has discovered a new DDoS (Distributed Denial of Service) Trojan horse malware family involved in denial-of-service attacks against Vietnamese blogs. Currently no unique name exists for this trojan in anti-virus detections, therefore SecureWorks has dubbed this trojan "Vecebot" (...).»
Source : http://www.secureworks.com/research/threats/vecebot/?threat=vecebot
Billets en relation :
29/10/2010. New Trojan, Vecebot, Targets Anti-Communist Bloggers : http://threatpost.com/en_us/blogs/new-trojan-vecebot-targets-anti-communist-bloggers-102910
=> Some thoughts and facts about ZeuS MitMo. 28/10/2010. «One month ago David Barroso and me visited one online banking user. David extracted one file from his mobile phone and I picked some ZeuS files up from his computer.This was the starting point of the so-called ZeuS MitMo (...).»
Source : http://eternal-todo.com/blog/thoughts-facts-zeus-mitmo
=> ZeuS: Bot to Master early communication protocol (Part one of two). 28/10/2010. «We’ve just spent two days looking into the ‘new’ variant of Zbot, a.k.a. ZeuS, the infamous crimeware kit. There are many interesting features, like the VNC plugin, API hooks, ftp password stealer, etc. In this series of posts, we’ll focus on the communication protocol between the bot and its Command & Control Server, in the early stages of infection. (...).»
Source : http://blog.fortinet.com/zeus-bot-to-master-early-communication-protocol-12/
=> Exploitation using publicly available Base64 encode/decode code . 29/10/2010. «Earlier, I blogged about malicious hidden Iframes using publicly available Base64 encode/decode scripts. Recently, we have seen additional malicious JavaScript hosted on one website, using another publicly available Base64 encode/decode scheme. Here is the initial screenshot of the malicious JavaScript code (...).»
Source : http://research.zscaler.com/2010/10/exploitation-using-publicly-available.html
=> Hack.lu 2010 CTF – Fun 300 writeup. 30/10/2010. «Une fois de plus Nibbles a concouru lors du CTF Hack.lu 2010 organisé par les FluxFingers (@Fluxfingers), on a pas réussi à poncer la première team « bobsleigh » (Française aussi) mais on a poncé la team Russe de Leetmore, résultats des courses on a fini second (...).» Je suis admiratif, bravo
Source : http://blog.nibbles.fr/2278
Billets en relation :
30/10/2010. Hack.lu 2k10 CTF "Pirates crackme" write-up : http://xylibox.blogspot.com/2010/10/hacklu-2k10-ctf-pirates-crackme-write.html
30/10/2010. Hack.lu : http://hacklu.fluxfingers.net/
30/10/2010. Hack.lu 2010 materials : http://twitter.com/sbrabez/status/29186756878
=> SpyEye Builder v1.2.50 (Botnet cracking session) . 30/10/2010. «SpyEye is a trojan that captures keystrokes and steals login credentials through a method known as "form grabbing". It sends captured data to a remote attacker, may download updates of the components and has a rootkit component to hides it malicious activity. (...).»
Source : http://twitter.com/Xylit0l/status/29174753554
Billets en relation :
30/10/2010. 8-bit lagerfeuer : http://m58-www.jamendo.com/fr/album/750
La suite en commentaires.
1 Commentaire
Commentaires recommandés
Rejoindre la conversation
Vous publiez en tant qu’invité. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.