Happy Super Tuesday
It's patch-time. This month, Microsoft is providing patches for 3 Critical, 1 important, and 1 Moderate - all remote code execution vulnerabilities. The IE patches provide fixes for vulnerabilities that have been know about for some time and have exploits out in the wild. For a detailed explanation of this round of patches, the ISC has a good write up.
Hybrid Viruses: The Omen
There tends to be lots of omens in in the InfoSec world these days, usually centered around a new kind of attack or vulnerability/exploit class rarely seen. The so-called Apple bluetooth (lab created) and iChat worms (rare) are good examples. Well, it seems that Kaspersky labs has found examples of Windows-Linux hybrid viruses. While this is only proof of concept code, such code is usually adapted by virus and worm writers. Though based on the information provided by Kaspersky, it seems like it would be easy to detect without significant development.
Many of you who frequent the web have noticed that many websites implement widgets called CAPTCHAS to help thwart bots and spam scripts that sign up to access forums. The basic gist is that its a way to (hopefully) tell that a human is behind the computer registering for a site by requiring the user to pick out letters and numbers from a random image, and provide that information with their submission. While doing some of my daily reading the other night, I ran across this blog posting about another and possibly easier way to perform some sort of real-user authentication; the author calls it "KittenAuth". Since picking out those oddly shaped letters and numbers in CAPTCHAS are difficult, what if you just have to identify something a computer isn't likely to identify - perhaps, pictures of kittens? Of course there eventually will come along ways to thwart this (sooner, depending on implementation), but as David suggested; should we look into Purdue PeteAuth? :-) It should be noted that there is a question as to whether such implementations are valid under the Americans with Disabilities Act.
Posted by Matthew Wirges on April 11, 2006, in Handlers Log.