Microsoft desmascarada

sábado, 28 de abril de 2012

Microsoft Patches Major Hotmail 0-day Flaw After Widespread Exploitation

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ibOTWugzWH4/microsoft-patches-major-hotmail-0-day-flaw-after-widespread-exploitation

suraj.sun writes "Microsoft quietly fixed a flaw in Hotmail's password reset system that allowed anyone to reset the password of any Hotmail account last Friday. The company was notified of the flaw by researchers at Vulnerability Lab on April 20th and responded with a fix within hours — but not until after widespread attacks, with the bug apparently spreading 'like wild fire' in the hacking community. Hotmail's password reset system uses a token system to ensure that only the account holder can reset their password — a link with the token is sent to an account linked to the Hotmail account — and clicking the link lets the account owner reset their password. However, the validation of these tokens isn't handled properly by Hotmail, allowing attackers to reset passwords of any account. Initially hackers were offering to crack accounts for $20 a throw. However, the technique became publicly known and started to spread rapidly with Web and YouTube tutorials showing the technique popping up across the Arabic-speaking Internet."

terça-feira, 3 de abril de 2012

Xbox usado é vulnerável a roubo de dados, diz estudo

URL: http://exame.abril.com.br/tecnologia/noticias/xbox-usado-e-vulneravel-a-roubo-de-dados-diz-estudo

Pesquisadores da Universidade Drexel, nos Estados Unidos, conseguiram recuperar dados sensíveis armazenados no console antigo após utilizarem ferramentas comuns

Attached media file [image/jpeg] (67085 bytes)

terça-feira, 20 de março de 2012

Windows 8 terá um “Kill Switch" - Verdade Explícita

quinta-feira, 15 de março de 2012

Critical Windows bug could make worm meat of millions of high-value machines

URL: http://arstechnica.com/business/news/2012/03/remote-desktop-bug-in-windows-makes-worm-meat-of-high-value-machines.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss

Microsoft has plugged a critical hole in all supported versions of Windows that allows attackers to hit high-value computers with self-replicating attacks that install malicious code with no user interaction required.

The vulnerability in the Remote Desktop Protocol is of particular concern to system administrators in government and corporate settings because they often use the feature to remotely trouble-shoot e-mail servers, point-of-sale terminals and other machines when they experience problems. RDP is also the default way to manage Windows machines that connect to Amazon's EC2 and other cloud services. That means potentially millions of endpoints are at risk of being hit by a powerful computer worm that spreads exponentially, similarly to the way exploits known as Nimda and Code Red did in 2001.