You may remember in November 2005 when I wrote about [1] the Sony/BMG rootkit scandal. To summarize: they put software on their music CDs that, when run in a computer, automatically installed files you couldn't detect (this was the rootkit part) that acted a lot like malware, and screwed with your CD-ROM drivers so that if you tried to uninstall it ( Read more... )

There is an exploit in the Adobe PDF plugin for web browsers. Adobe has already fixed the vulnerability, so you should all update your plugins. This vulnerability affects users of Internet Explorer and Firefox, on Windows and Linux (and any other browser/OS combination that uses the Adobe plugin).

I'm sure all the CS people reading this (and maybe even some of the non-CS types!) are familiar with buffer overflow attacks, and know how to both protect against them and exploit them in other people's code, or at least have a vague idea about how to do it. However, fewer people have heard of format string attacks. Here's a fairly detailed ( Read more... )

Coming back from DEFCON, I felt like Jack, coming down the beanstalk to announce that "there are giants in the sky! There are big, tall, terrible* giants in the sky!" I was introduced to a whole new world with new ways to look at everything. I had no idea most of that stuff was out there and accessible to me. Everyone seemed more knowledgable about ( Read more... )