royans

How fast is an security patch converted into an exploit ?  F-secure's  @ TimoHirvonen  did a study and came with this example to document a time-to-exploit timeline.   •  2012-08-14: Security update available for Adode Flash player, patches vulnerability CVE-2012-1535.      ( Security update available for Adobe Flash Player )   •  2012-08-15: Microsoft Office Word documents with embedded Flash exploit for CVE-2012-1535 seen in the wild.      ( CVE-2012-1535: Adobe Flash being exploited in the wild ,  CVE-2012-1535 - 7 samples and info )   •  2012-08-17: Exploit is added to Metasploit Framework — a public, open-source tool for developing and executing exploits.      ( Adobe Flash Player Exploit CVE-2012-1535 Now Available for Metasploit ) Took just one day for it to be converted into an exploit. In other words, it is not enough to release a patch. What matters now is how fast can all the clients can be updated after a patch is released.

In the browser world, Java and Adobe look very similar. Not only are they similar in the kind of stuff they allow embedded applets/flash_Code to do, but also in the way its exploited to get out of the security container which anonymous code should never be able to do. So here are couple of interesting news items you should know more about... Adobe revokes certificates : Some tools found in the wild were found to be signed with Adobe's signature which should have never leaked Adobe's infrastructure. Adobe had no option but to initiate the process to revoke the impacted signatures and are conducting forensics to understand what really happened and what else is exposed. More Java holes reported :   A number of readers alerted ISC of news reports stating that new "full sandbox escape" vulnerabilities had been reported to Oracle. At this point, there are no details available as to the nature of these vulnerabilities, and there is no evidence that any of these vulnerabiliti

Honeymap is  a real-time world map which visualizes attacks captured by honeypots of the  Honeynet Project . Red markers on the map represent attackers, yellow markers are targets (honeypot sensors). Not terribly useful in its current form, but a very interesting way to watch attacks to see if infected systems for a particular type of attack is geo-specific.