The Power of Scapy
There is a special place in my heart for someone who accidentally causes all the Macs in the office to repeatably crash at the Grey Screen of Death. If you too like fun "accidents" or need to craft up some packets check out Judy Novak's SANS class on Scapy. This is
Vulnerability Report - July 2010
Sourcefire VRT Vulnerability Report July 2010 from Sourcefire VRT on Vimeo.
New Rule Categories
Three new rule categories were introduced yesterday (Tuesday, 13th July 2010) in SEU 348 and into the VRT Certified Rule packages. I'd like to take a moment to explain what's in these categories, where the data behind them is coming from, and what you should do if you tur
Rule Release for Today, Tuesday July 13th, 2010
Microsoft Security Advisory MS10-042: Microsoft Help and Support Center contains a programming error that may allow a remote attacker to bypass security restrictions on an affected system. The error occurs when invalid hex-encoded characters are used as a parameter to a search
Fundamentals of Exploit Development Class in VEGAS!
Need some more exploit fun? Want to stay in Vegas a little longer? Need some face time with the VRT? We are holding the fundamentals of exploit development class right after DefCon this year. August 2nd, 3rd and 4th in Las Vegas, NV. For more details and to book your place, take
Increase in attacks on CVE-2010-1885
Microsoft is warning that there has been an increase of attacks against a zero-day vulnerability in Microsoft Help and Support Center. The vulnerability is due to an error when using invalid hexadecimal characters in the search topic parameter of a URI. It can be used to bypass r
Yes, Virginia, There is Cyberwar
DEAR EDITOR: I have been in security for 8 years. Some of my friends say there is no such thing as cyberwar. My manager says, "If you see it on the VRT Blog then it's so" Please tell me the truth; is there cyberwar? Virginia O'Hanlon. 115 West Ninety-Fifth
Rule Release for Today, Thursday July 1st, 2010
Remote code execution in Adobe Acrobat and Reader. Some folks are claiming it's a denial of service, heh, right. RCE is possible, get your rules here: http://www.snort.org/vrt/advisories/2010/07/01/vrt-rules-2010-07-01.html/
Rule Release for Today, Tuesday June 29th, 2010
We added and modified multiple rules in the backdoor, dos, exploit, misc, multimedia, netbios, oracle, pop3, rpc, specific-threats, web-activex, web-client and web-misc rule sets . Information is here: http://www.snort.org/vrt/advisories/2010/06/29/vrt-rules-2010-06-29.html/