Ryan Naraine

A public claim by hackers that Mozilla’s Firefox browser is vulnerable to multiple code execution vulnerabilities may be an overblown hoax. On the heels of a ToorCon presentation where two security researchers—Mischa Spiegelmock and Andrew Wbeelsoi—warned that Firefox’s implementation of JavaScript was badly flawed and could allow PC takeover attacks, Mozilla’s engineers say the risk […]

The emergence of a high-profile group of security professionals promising third-party software fixes during zero-day attacks has rekindled a debate on the merits—and risks—associated with deploying unsupported product updates. The Zero Day Emergency Response Team, or ZERT, stepped out of stealth mode on Sept. 22 with a stopgap patch for a VML (Vector Markup Language) […]

Microsoft researchers are experimenting with an automatic code zapper for the company’s Internet Explorer Web browser. Researchers at the Redmond, Wash., company have completed work on a prototype framework called BrowserShield that promises to allow IE to intercept and remove, on the fly, malicious code hidden on Web pages, instead showing users safe equivalents of […]

Botnet herders have reloaded and launched a new round of worm attacks against Windows users, exploiting multiple product flaws to hijack unpatched computers. In addition to the MS06-040 Windows Server Service flaw, attackers have added exploits for three other Windows worm holes as part of the latest wave of attacks, according to anti-virus experts tracking […]

Microsoft has temporarily delayed the re-release of a critical Internet Explorer browser patch because of problems with the way its proprietary Systems Management Server handles cabinet (.cab) files, according to sources familiar with the matter. The Redmond, Wash., software giant markets SMS as a business tool for simplifying patch management, but because of a bug […]

Microsoft is pouring cold water on a warning from anti-virus vendor Trend Micro that a new PowerPoint zero-day attack is under way. The Trend Micro warning, first issued Aug. 19, said that a specially crafted “.ppt” file was being used to exploit an undocumented PowerPoint vulnerability. The Japanese anti-virus company said it received a sample […]

An anonymous security researcher has posted a proof-of-concept exploit for a flaw patched in Microsoft’s “critical” MS06-035 bulletin, but the company’s security response team says the issue is actually a brand-new, unpatched vulnerability. The researcher, who uses the online moniker “cocoruder,” published the attack code on the Milw0rm Web site alongside a claim that it […]

Security researchers have a brand-new tool to use to go digging for malicious executables on the Web: the Google SOAP Search API. Malware hunters at Websense Security Labs have figured out a way to use the freely available Google API to find dangerous .exe files sitting on thousands of Web servers around the world. The […]

Researchers at Microsoft are working on an ambitious new project to hunt down and neutralize large-scale search engine spammers. The Redmond, Wash., software giant’s Cybersecurity and Systems Management Research Group has taken the wraps off Strider Search Defender, an experimental project that automates the discovery of search spammers through non-content analysis. The project integrates technology […]

Microsoft plans to release seven security bulletins on July 11 to cover a range of critical vulnerabilities affecting Windows and Office users. Four of the seven bulletins will include patches for flaws in the Windows operating system, while three will deal with bugs in the Microsoft Office productivity suite. eBay ends the bidding on a […]

A security feature used in the open-source world is now helping to harden Windows Vista against buffer overrun exploits. Microsoft has quietly fitted the feature, called ASLR (Address Space Layout Randomization) in Windows Vista Beta 2 as part of a larger plan to make it more difficult to automate attacks against the operating system. “Not […]

Use Microsoft Word in safe mode to protect against targeted zero-day attacks. That’s the advice from Microsoft’s security response team to counter known attacks against a serious code execution vulnerability in the widely used word processing program. In a pre-patch security advisory, Microsoft said the flaw can be exploited when a user opens a specially […]