Passive Automotive Systems Bypassed.

Car thieves of the future might be able to get into a car and drive away
without forced entry and without needing a physical key, according to
new research that will be presented at the Network and Distributed
System Security Symposium next month in San Diego, California.

The researchers successfully attacked eight car manufacturers' passive
keyless entry and start systems—wireless key fobs that open a car's
doors and start the engine by proximity alone.

Source:http://www.technologyreview.com/computing/27037/

Flash Player sandbox can be bypassed.

Flash applications run locally can read local files and send them to an online server - something which the sandbox is supposed to prevent. Flash includes a number of sandboxes which impose restrictions depending on the origin of, and access rights for, the SWF file. Local SWF files, for example, run within the local-with-file-system sandbox, are permitted to access local files. They are not able to access the network, so a malicious SWF applet should not be able to send local data to a remote server. However, an H Security specialist has determined that Adobe controls access to the network using a blacklist of protocol handlers. Protocols such as HTTP and HTTPS are blacklisted. He reports it is in principle possible to send files to a server using the file: protocol handler, but that this is only possible within the local area network. He has identified another protocol handler which can be used to send data to remote servers - mhtml.

Source: http://www.h-online.com/security/news/item/Flash-Player-sandbox-can-bebypassed-%201164376.html

Exploit for critical vulnerability in Microsoft Office appears in the wild

An exploit has been discovered in the wild that can successfully attack a critical vulnerability in the way Microsoft Office handles Rich Text Format data, allowing remote execution of code on a victim computer. Microsoft released a patch for the vulnerability, known as CVE-2010-3333, in November 2010, and no widespread outbreaks of exploits have yet been reported. The public availability of an exploit lowers the bar for attackers, however, and increases the urgency for seeing that affected software is patched.

Source: http://fcw.com/articles/2011/01/04/ms-office-rtf-exploit.aspx

Microsoft issues IE advisory, warns on FTP flaw

Microsoft's security team announced late December 2010 that it is investigating two proof-of-concept flaws in Microsoft's Web-related software. One of the flaws offers a possible avenue for remote code execution attacks via Internet Explorer (IE). The other flaw could enable denial-of-service attacks by exploiting a vulnerability in Internet Information Services FTP 7.5, which runs as a part of Windows 7 and Windows Server 2008 R2. The IE proof-of-concept flaw potentially affects all versions of Microsoft's Web browser. It supposedly works by bypassing protections normally enabled by Microsoft's address space layout randomization (ASLR) and data execution prevention (DEP) technologies. Microsoft described the problem in a blog post in December 2010, suggesting that users could deploy Microsoft's Enhanced Mitigation Experience Toolkit (EMET) as a workaround.

Source: http://fcw.com/articles/2011/01/04/ecg-microsoft-investigating-ie-and-ftpsecurity-%20flaws.aspx

New Stealth Rootkit Steals Windows 7, Server 2008 Privileges On The Fly.

A European researcher has created a rootkit that can evade detection in Windows 7 and Windows Server 2008 machines and reset user passwords. The rootkit was initially a project meant for training purposes. But its designer, a security expert for Deloitte in Hungary who works on penetration testing and forensic cases, says he eventually discovered he could perform new types of attacks with the rootkit, which he plans to deliver to antivirus firms as well as to the International Council of E-Commerce Consultants (EC-Council) for its certified hacker training program. He demonstrated the rootkit for the first time at the recent Hacker Halted conferences in Miami, Florida, and Cairo, Egypt. One particularly powerful module of the rootkit is based on the concept of a cached data attack. The cached data attack has to do with how the operating system caches data in physical memory. It lets an attacker clear and reset passwords in memory without being detected by the operating system.

Source: http://www.darkreading.com/authentication/167901072/security/vulnerabilities/229000%20060/new-stealth-rootkit-steals-windows-7-server-2008-user-privileges-on-the-fly.html

Microsoft Warns of Thumbnail Hole in Windows

In a security advisory, Microsoft warns of a new, previously unknown security hole in Windows which can be exploited to inject and execute arbitrary code. Sample code that demonstrates how to go about an exploit is already in circulation. In December 2010, two people gave a presentation entitled "A Story about How Hackers' Heart Broken by 0-day" at the "Power of Community" security conference. Their presentation documents describe a security hole in Windows that is connected to the display of thumbnails and can reportedly be exploited locally via Explorer as well as remotely via WebDAV. Displaying a file with a specially crafted thumbnail is all that is required for a successful attack. The vulnerability is exploited by setting a negative number of colour indexes in the colour table (biClrUsed). According to Microsoft's security advisory, all versions of Windows except Windows 7 and Server 2008 R2 are vulnerable. Microsoft say that they are currently not aware of any attacks which try to exploit the reported vulnerability. However, this could soon change, as a Metasploit module for creating suitable malicious files was released almost simultaneously with Microsoft's advisory.

Source: http://www.h-online.com/security/news/item/Microsoft-warns-of-thumbnailhole-%20in-Windows-1163562.html

I have returned...

Sorry for the long hiatus.  I accepted a new position and took a couple of weeks off to relocate across the country.  Uneventful trip, nearly all settled in and I will get back to posting the Security Daily information.