DoJoSec and dnssnarf
One of our IT guys, (total security geek Christopher McBee) found some interesting information from last nights DoJoSec meeting. Here's what he has to say: During Sean Wilkerson's talk at last nights DojoSec meeting (http://www.dojosec.com), Sean discussed some simple op
Rule release for today - May 5th 2009
Adobe Reader Code Execution (CVE-2009-1492): The JavaScript API in Adobe Reader may allow a remote attacker to execute code on an affected system. The problem occurs when specially crafted JavaScript uses the getAnnots method in a PDF document. A rule to detect attacks targeting
Virut Analysis and Snort Rule
Virut (from virus + trojan) is a family of malware that has been around in since about 2006. Unfortunately for us, it is still around 3 years later with new variants being released on regular basis. We came across a recent Virut sample (MD5:e68c4b9428f41036b1cf890d93bdf390) and t
Some days you just can't walk away.....
I apologize ahead of time for the marketing fluff in this post, I promise the next several posts after this will be much heavier on the tech and the cool. However, I just couldn't let this one go and neither could any of the Sourcefire VRT. Today we got an anonymous email wi
DoJoSec Meeting - May 7th
Here lie the details: http://www.dojosec.com/?p=109 A few of us are planning on attending the meeting, come and say hello. Also, from last month's meeting, our fearless leader and Senior Director of Chaos and Mayhem gave a talk that had something to do with PDFs and Adobe :
Rule release for today - April 21st 2009
A small set of new rules in today's release and a couple of modifications. Here are the highlights: Adobe Flash Player Buffer Overflow (CVE-2009-0520): Adobe Flash Player contains a programming error that may allow a remote attacker to execute code on a vulnerable system via
New Snort.org Website
As many of you know the Snort project recently reached its 10th Anniversary. In honor of this milestone we’re giving Snort a new website to call home. This site update is much more than just a new look and feel. We’re rebuilding the site from the ground up to better serve the nee
Microsoft Tuesday Coverage for April MS09-009, MS09-010, MS09-011, MS09-012, MS09-013, MS09-014, MS09-015, MS09-016
Microsoft Security Advisory MS09-009: A programming error in Microsoft Excel may allow a remote attacker to execute code on a vulnerable system via a specially crafted XLS file. A rule to detect attacks targeting this vulnerability is included in this release and is identified w
Rule release for today - April 10th 2009
Rule for Powerpoint memory corruption bug, CVE-2009-0556, extra rule for MS08-068 and Conficker detection update. More details here: http://www.snort.org/vrt/advisories/vrt-rules-2009-04-10.html