GNUCITIZEN

Stefano DiPaola, Elia Florio and Giorgio Fedon has discovered quite serious vulnerability in Adobe’s Flash player. If you haven’t heard about it, let me tell you something: It is big. Read more about the vulnerability from here and here.

The video above was assembled by the Symantec guys. It shows working examples for Firefox on Windows, Safari on MacOS and Opera on Wii. Demonstration exploit code is available from SecurityFocus. [...]

I have a video for you, which demonstrates an iPhone exploit in action. Keep in mind that this is just one of the many exploits that have been discovered lately.

Once again, the problem is within the browser. Again? Well, browsers are quite complex piece of software. They usually work with loads of strings, due to JavaScript, and in general it is easy to screw up regardless of vendors efforts. [...]

Firebug is a very powerful JavaScript debugger for Firefox. I love it! It has tones of useful features like a dynamic console, DOM tree explorer, CSS viewer/editor, script explorer and my favorite, a network monitor where I can see all Flash, XMLHttpRequest, JS and Image requests.

Firebug is mainly used by web developers to find bugs in their code but it can also be used from security guys like me to find and explore various client-side and server-side vulnerabilities. [...]

There was a discussion on Full-disclosure and Bugtraq about a very peculiar vulnerability in Internet Explorer and Mozilla Firefox which can be used by attackers to trick victims into uploading local files.

It was Michal Zalewski who brought this subject back on the table. The vulnerability he described is not new. In fact, it is a variation of an issues discovered back in 2000. The peculiar thing about it is that it was reported to Mozilla’s Bugzilla back then but never fixed. [...]

The WEB has gone crazy. I know that this is not news for some of you but you will be surprised to what extend this craziness has just developed. Among the traditional QuickTime Movie, QTL, Flash, Image, HTML and PDF vulnerabilities, there is now another one trivially exploitable with somewhat high degree of impact.

Back in September 2006 David and I had a small adventure with Adobe’s PDF technology. [...]

This month we have a guest blogger and his name is David Kierznowski, the founder of Operation n – the adventures of Michaels Daw. David and I have been working together on various security related projects. He currently works as a security analyst and researcher. David contacted me after he found interesting anomaly with Sage Firefox Extension. These are his words:

I would often keep abreast of new vulnerabilities and exploits via my RSS feeds. [...]