Category: Internet Security

Researchers Crack WPA, No Brute Force Needed

Internet Security Leave a comment
Bring your laptop, leave your dictionary

A pair of security researchers claim to have partially cracked WPA encryption, with an attack that takes around 15 minutes.

The technique relies on an undisclosed “mathematical breakthrough,” say researchers Erik Tews and Martin Beck, and breaks the Temporal Key Integrity Protocol (TKIP) key used to encrypt data between a wireless router and its clients. Currently, the attack works only one way: data traveling from the access point to its clients is vulnerable, while data traveling in the opposite direction is not.

Read more here.


World’s electrical grids open to attack

Internet Security Leave a comment

By Dan Goodin in San Francisco • Get more from this author

Posted in Security, 25th September 2008 18:03 GMT

A serious vulnerability has been found in yet another computerized control system that runs some of the world's most critical infrastructure, this time in a product sold by a vendor known as the ABB Group.

According to researchers from C4 - a firm specializing in the security of so-called SCADA, or Supervisory Control And Data Acquisition, systems - ABB's Process Communication Unit (PCU) 400 suffers from a critical buffer overflow bug.

"The vulnerability was exploited by C4 to verify it can be used for arbitrary code execution by an unauthorized attacker," researcher Idan Ofrat wrote in this advisory published on Thursday. "In addition, an attacker can use his control over the FEP server to insert a generic electric grid malware...in order to cause harm to the grid."

Read more.


World’s electrical grids open to attack

Internet Security Leave a comment

By Dan Goodin in San Francisco • Get more from this author

Posted in Security, 25th September 2008 18:03 GMT

A serious vulnerability has been found in yet another computerized control system that runs some of the world's most critical infrastructure, this time in a product sold by a vendor known as the ABB Group.

According to researchers from C4 - a firm specializing in the security of so-called SCADA, or Supervisory Control And Data Acquisition, systems - ABB's Process Communication Unit (PCU) 400 suffers from a critical buffer overflow bug.

"The vulnerability was exploited by C4 to verify it can be used for arbitrary code execution by an unauthorized attacker," researcher Idan Ofrat wrote in this advisory published on Thursday. "In addition, an attacker can use his control over the FEP server to insert a generic electric grid malware...in order to cause harm to the grid."

Read more.

Popular Web Attacks Go Stealth

Internet Security Leave a comment
Attackers are increasingly using encoding to sneak their SQL injection, cross-site scripting attacks past Web security

By Kelly Jackson Higgins


Senior Editor, Dark Reading

A sneaky form of Web attack is emerging that masks the more popular methods used by attackers today.

Encoded SQL injection and cross-site scripting (XSS) attacks are becoming all the rage as Web defenses are getting better at catching these popular scripting attacks, according to WhiteHat Security’s Website security statistics report released today. “Your garden variety SQL and XSS is being replaced by encoded versions” of them, says Jeremiah Grossman, CTO of WhiteHat Security. “Any injection-style attack can be encoded using 100 different techniques and variations.”

Attackers have begun hiding the malicious code by encoding so they can keep using these old-school attacks, which organizations are getting better at detecting in the clear, says Grossman.

Read more here.


Popular Web Attacks Go Stealth

Internet Security Leave a comment
Attackers are increasingly using encoding to sneak their SQL injection, cross-site scripting attacks past Web security

By Kelly Jackson Higgins


Senior Editor, Dark Reading

A sneaky form of Web attack is emerging that masks the more popular methods used by attackers today.

Encoded SQL injection and cross-site scripting (XSS) attacks are becoming all the rage as Web defenses are getting better at catching these popular scripting attacks, according to WhiteHat Security’s Website security statistics report released today. “Your garden variety SQL and XSS is being replaced by encoded versions” of them, says Jeremiah Grossman, CTO of WhiteHat Security. “Any injection-style attack can be encoded using 100 different techniques and variations.”

Attackers have begun hiding the malicious code by encoding so they can keep using these old-school attacks, which organizations are getting better at detecting in the clear, says Grossman.

Read more here.