New iphone 4s security vulnerability

Security technology company Sophos published, the Siri on iPhone 4S exists security vulnerability, people can use the phone even in the screen locked.

Many people like the Siri oniPhone 4S, but this app flawed in security. The iPhone 4S also supports Siri running even if iPhone’s screen locked. That means if users need to quickly make a phone call or a massage, they will not need to unlock the screen.

The reason for this vulnerability is, iPhone 4S allows Siri app to run on the locked-screen by default settings.

If you want to prevent this vulnerability, the you need to change settings, to disable the Siri when you select the password protection on the iPhone 4S.

Read more »

Posted in: Iphone,Vulnerabilities

what is exploit ???

To take advantage of a vulnerability, you often need an exploit, a small and highly specialized computer program whose only reason of being is to take advantage of a specific vulnerability and to provide access to a computer system. Exploits often deliver a payload to the target system to grant the attacker access to the system.

Read more »

Posted in: Vulnerabilities

What is vulnerability ??

A vulnerability is a security hole in a piece of software, hardware or operating system that provides a potential angle to attack the system. A vulnerability can be as simple as weak passwords or as complex as buffer overflows or SQL injection vulnerabilities.

To test if you have any vulnerabilities in your systems, you typically use a vulnerability management solution, also known as a vulnerability scanner or vulnerability assessment solution. If you would like to get your hands on a free vulnerability scanne

Read more »

Posted in: Vulnerabilities

Microsoft PowerPoint flaw

A serious security hole affecting Microsoft PowerPoint is being attacked in the wild by a Trojan horse, Symantec Corp.'s DeepSight Threat Analysis Team warned late Wednesday. 

In an email analysis to customers, the Cupertino, Calif.-based antivirus giant said it is investigating to see if the exploit is tied to the previously known Microsoft Excel style handling and repair remote code execution flaw, with PowerPoint simply being used as a new attack vector. The company has advised IT administrators to make sure regular antivirus updates are applied as it carries out its investigation.

In its advisory, the DeepSight team said it has confirmed reports of an in-the-wild attack being performed with a maliciously crafted Microsoft Office PowerPoint file. "These attacks are exploiting a previously unknown and currently unpatched vulnerability affecting PowerPoint, and possibly Microsoft Office in general," Symantec said.The exploit arrives via email as a Microsoft PowerPoint document attachment, Symantec said. When a user launches the PowerPoint document, the vulnerability is triggered and attackers are then able to run malicious code

Read more »

Posted in: Vulnerabilities

Mozilla Firefox CSS Handling Status Bar Spoofing Vulnerability

Mozilla Firefox is prone to a weakness that may allow an attacker to obfuscate a malicious link.

Successful exploits of this issue will cause the status bar to display spoofed content that may aid in further attacks.

Mozilla Firefox 4.0 is vulnerable; other versions may also be affected.

Same vulnerability also existing in google chrome , internet explorer

Read more »

Posted in: Vulnerabilities

Adobe issues fix for Acrobat, Reader to block ongoing Flash attacks

Adobe Systems Inc. issued an update for users of its Reader and Acrobat products, fixing a serious Flash Player zero-day vulnerability that has been an active target of attackers.

Adobe issued a security update Thursday, repairing critical flaws that affect current versions of Adobe Reader and Acrobat for Windows.
Attacks targeting the vulnerability have used specially crafted Flash files embedded in a Microsoft Word document or Excel spreadsheet and delivered them as an attachment. The flaw enables an attacker to execute malicious code and gain control of a victim’s machine.
Adobe addressed the vulnerability in its Flash Player earlier this month. The company is advising users of Mac OS X and Windows to use update utilities to acquire the patch.

Current Adobe Reader products for UNIX, Adobe reader for Android, and Adobe Reader and Acrobat 8 remain unaffected by this vulnerability.

Read more »

Posted in: Vulnerabilities

ASP.NET Misconfigurations Vulnerability

Today we will be learning about the ASP.net MisConfiguration Vulnerability which is found in most of the ASP.net Webpages .

Asp.net application can be configured to produce debug binaries . These binaries give detailed debugging messages and should not be used in production environments. The debug attribute of the <compilation> tag defines whether complied binaries should include debugging information . Symbols (.pdb) files tell the debugger how to find the original source file for a binary , and how to map breakpoints in code to lines in those source files . 

The use of debug binaries causes an application to provide as much information about itself as possible to the user . Debug binaries are meant to be used in a development or testing environment and can pose a security risk if they are deployed to production . Attackers can get the additional information they gain from debugging out to mount attacks targeted on the framework , database , or other resources about the application which they are using

How to identify this vulnerability ??? 

For identifying this vulnerability you need to search for the 

following pattern in System.web in Web.config file at application 

root directory 

 <configuration>
<compilation debug="true"/>
 </configuration>

How to fix this Vulnerability ?? 

You can fix this loophole by  enabling  custom error pages . Custom

error messaes will prevent attackers from mining information from 

the framework's built-in error responses.

You can enable the Custom error pages by including the following code in the web.config file

<customErrors mode="on"/>

You can disable the Custom error pages by including the following  code in the web.config file

<customErrors Mode="off"/>

Read more »

Posted in: Vulnerabilities