Hacker exploits PDF files without using a vulnerability

A security researcher has managed to create a proof-of-concept PDF file that executes an embedded executable without exploiting any security vulnerabilities.

The PDF hack, when combined with clever social engineering techniques, could potentially allow code execution attacks if a user simply opens a rigged PDF file.

 http://threatpost.com/en_us/blogs/hacker-finds-way-exploit-pdf-files-without-vulnerability-033010

Academic Paper in China Sets Off Alarms in U.S.

Larry M. Wortzel, a military strategist and China specialist, told the House Foreign Affairs Committee on March 10 that it should be concerned because “Chinese researchers at the Institute of Systems Engineering of Dalian University of Technology published a paper on how to attack a small U.S. power grid sub-network in a way that would cause a cascading failure of the entire U.S.”

http://www.nytimes.com/2010/03/21/world/asia/21grid.html

Thanks Captain Picard

I love this graphic. It says so much. I actually have it pinned up at my desk at work so it's easy for me to roll my eyes over and ask him the same question - usually several times a night.

Tonight I will share this graphic with you in response to this "Severe" OpenSSL vulnerability recently released. And this quote:

The university scientists found that they could deduce tiny pieces of a private key by injecting slight fluctuations in a device's power supply as it was processing encrypted messages. In a little more than 100 hours, they fed the device enough "transient faults" that they were able to assemble the entirety of its 1024-bit key.

http://www.theregister.co.uk.nyud.net/2010/03/04/severe_openssl_vulnerability/

Fraudsters target IT Workers

Dear Valued Customer,
We are pleased to announce the go-live date for a new Data Center, scheduled to go live on April 19, 2010.
Please update your firewall rules to allow SMTP traffic on port 25 from the following IP address ranges:xxx.xxx.xxx.xxx/xx (xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx)xx.xxx.xxx.xx/xx (xx.xxx.xxx.xx - xx.xxx.xxx.xxx)

http://infoworld.com/print/115086