"Russia has become a major breeding ground for hackers who 
    use their anonymity to inflict mayhem on the West, aided 
    by the Russian government's apparent indifference to their 
    activities. The roots of Russian hacktivism include the 
    country's strong system of math and science education, 
    generally poor job prospects for graduates of Russian 
    technical institutions, and societal encouragement of 
    rule-breaking as a form of resistance against the strictures 
    and despotism of the Communist regime."

This is little doubt that Russian programmers are excellent programmers.

   "There was always a great entrepreneurial spirit in Russia, 
    but it has always been directed at things that not only help 
    people, but also hurt people." notes Russian-American author 
    Gary Shteyngart. 

Entrepreneurialism is a big deal in the U.S. these days. Numerous universities are offering degrees in this area.

   "Rough estimates place 28 million Internet users in Russia, 
    versus 150 million in China and 210 million in America. 
    Russian hackers are considered by VeriSign to be the worst 
    type of hackers because of their links to organized crime 
    outfits that embezzle money with stolen bank and credit 
    card information.

Seems appropriate to add line to Don Henley's lyric...

   "The man with a briefcase and steal more money 
    than a man with a gun."

to include...

   "And a cracker with a high-speed Internet connection
    can steal more money than a man with a briefcase."

NYTimes.com:: What's Russian for 'Hacker'?

Good headlines often tell the story...

NewScientist.com:: Hackers have poor nations' PCs in their sights

[Extra] This is old news from last month...

   "A zero-day vulnerability in the latest version of 
    RealPlayer and RealPlayer 11 Beta is actively being 
    exploited, Symantec said Friday morning."
 
   "The issue affects an ActiveX object in the RealPlayer 
    component called 'ierpplug.dll.'"

Crackers can exploit the RealPlayer crack by putting crack code in dot-html files. If the dot-html files are rendered by IE (Internet Explorer), then...

   "The malicious .html page checks several versions of 
    RealPlayer to determine if the installed application 
    is vulnerable. If it is, the attacker can potentially 
    take control of the computer." -- Symantec

   "12/7/2007:  The Oak Ridge National Laboratory (ORNL) said a 
    'sophisticated cyberattack' executed over the past several 
    weeks might have allowed hackers to steal the personal 
    information of thousands of lab visitors."

The ORNL has massive quantities of computing capability.

The ORNL alerted employess with the following message.

   "[...] to be part of a coordinated attempt to gain access 
    to computer networks at numerous laboratories and other 
    institutions across the country."

It's not a "hack attack," it is a crack attack...

NewsFactor.com:: Hack Attack Compromises National Lab

   AP Headline:  "U.S. Withdraws Subpoena Seeking Identity of 
                  24,000 Amazon Customers Sought As Witnesses"

Federal prosecutors created a subpoena seeking the "identities of thousands of people who bought used books through online retailer Amazon.com Inc."

The following quote from U.S. Magistrate Judge Stephen Crocker is chilling in itself.

   "The (subpoena's) chilling effect on expressive e-commerce 
    would frost keyboards across America." 

   "Well-founded or not, rumors of an Orwellian federal criminal 
    investigation into the reading habits of Amazon's customers 
    could frighten countless potential customers into canceling 
    planned online book purchases."

The AP reported that "federal prosecutors issued the subpoena last year as part of a grand jury investigation into a former Madison [Wisconsin] official who was a prolific seller of used books on Amazon.com. They were looking for buyers who could be witnesses in the case."

The AP quoted the government saying: "We didn't care about the content of what anybody read. We just wanted to know what these business transactions were. These were simply business records we were seeking to prove the case of fraud and tax crimes against Mr. D'Angelo."

   "With the increasing word size and sophisticated optimizations 
    of multiplication units in modern microprocessors, it becomes 
    increasingly likely that they contain some undetected bugs. 
    This was demonstrated by the accidental discovery of the obscure 
    Pentium division bug in the mid 1990's, and by the recent discovery 
    of a multiplication bug in the Microsoft Excel program."

According to Wei Dai, co-creator of the "VMAC message authentication code and author of Crypto++, a free C++ class library of cryptographic algorithms, there are ways to protect against CPU math errors and that 'the RSA implementation in Crypto++ is already protected against this attack...'. In a nutshell, Wei Dai said, "[...] after doing the RSA private key operation y=x^d mod n, one should check that the result is correct by verifying that x=y^e mod n. Crypto++ has done this since version 5.1."

• InformationWeek.com:: Math Error Could Compromise Cryptographic Systems
• Groups.Google.com

   "Most of the country moved their clocks back one hour when 
    daylight saving time ended Sunday, but some Alltel Corp. 
    customers saw their cellular phone clocks jump forward 
    an hour instead."

According to Alltel, cellular towers provide the time to the phones and the problem was with the towers.

The following was reported by eWeek.com.

   "Spammers have taken to using MP3 attachments in e-mails 
    named after recording artists as part of a pump-and-dump 
    stock scam. Most of the e-mails have no subject name; others, 
    however, appear to be named after the artist the MP3 file is 
    named after, according to several security vendors."

   "When recipients click on the attachment, a voice relays a 
    message promoting stock for a particular company."

The Security Watchdog's primary email account gets hit by a couple of stock market spams a day.

The following quotes were issued by McAfee Avert Labs.

   "Today's Microsoft patches emphasize the need for proactive 
    browser protection and the risk of surfing the Web unprotected." 

All crackers need is one wrong click.

   "Many of the vulnerabilities addressed by the fixes could be 
    exploited if a Windows user simply clicks a malicious Web link, 
    a favorite attack method among cybercriminals. Users need to 
    be more careful than ever when surfing the Internet." 

The Security Watchdog gets the shakes when he reads about defects with Microsoft Word.

   "One of the other four critical patches is MS07-060, which 
    addresses previously reported 'in-the-wild' Microsoft Word 
    vulnerabilities that allow an attacker to send an infected 
    Word document as an attachment or as a downloadable file 
    from a Web site."

Infected word documents? Yuck!

   "A security hole in widely used versions of AOL's instant-messaging 
    program could let a crook grab control of a victim's computer, 
    according to a security firm that says AOL's steps to repair the 
    problem don't go far enough."

AOL's IM has been cracked time and time again. Not all of the cracks have been serious, but in this case the finder of crack was quoted saying: "This is critical, this is very serious."

Beware of dangerous emoticons...

   "The security hole arose because of the way the vulnerable versions 
    of AIM let instant-messaging chatters augment their conversations 
    with various fonts and pictographic 'emoticons.' The flawed versions 
    of AIM do this by using Microsoft Corp.'s Internet Explorer program 
    to render images."

The Security Watchdog is not sure why anybody uses AOL.

InformationWeek would be doing the computing profession a favor if it started using the term crackers instead of hackers. The headline should read: "Crackers Push Trojan With Promises of 'Nude Angelina Jolie' Pics."

InformationWeek reported that Sophos reported that "in September, one in every 833 e-mails were carrying malicious attachments, compared to 1 in every 1,000 during August." For some reason the Security Watchdog thought these ratios would be worse than they are.

InformationWeek.com quoted a senior security consultant at Sophos saying, "The trick of tempting users with scantily clad pictures of hot-looking girls is as old as the hills, but people still fall for it."

InformationWeek.com:: Spam Is Gateway To Malware Economy, Feds Say

   "While the financial assets our clients hold with us were 
    never touched, and there is no evidence that our clients' 
    Social Security Numbers were taken, we understand that this 
    issue has increased unwanted SPAM, which is annoying and 
    inconvenient for them." --Joe Moglia, CEO

The TD Ameritrade CEO needs to learn that junk email messages are spam and not SPAM. In addition, phrase "unwanted spam" is redundant. Who wants spam?

Security guru Bruce Schneier thinks Monster's security woes should prompt other online services to look more closely at their security practices, but it probably won't happen.

   "You're going to see this happen again and again and again.
    I assure you, every other company didn't say, `Wow, look 
    what happened to Monster, we have to fix our problem.'"
    --Bruce Schneier

Help.Monster.com:: Security Notice

AvertLabs.com:: More on the Yahoo! Messenger Webcam 0day

   "Hackers stole information from the Department of Transportation 
    and several U.S. corporations by seducing employees with fake 
    job-listings on ads and e-mail."

Hackers didn't steal information; crackers did!

   "What is most worrying is that this particular sample of malware 
    wasn't recognized by existing antivirus software. It was able to 
    slip through enterprise defenses." said Yankee Group security 
    analyst Andrew Jaquith, who learned of the breach from Morris.

Security software is software; therefore, it can be cracked especially if it is running on poorly administrated systems. An ethically grounded guruish SysAdmin is priceless.

Somebody discovered that Fox had the webserver configured to allow directory listings. They following the listings until they found a shell script that in turn had a FTP password embedded in it. Note: shell script files are POT files (i.e. plain-old-text); therefore, the password was human-readable.

LinuxInit.net:: Oops?

   "A Swiss Internet start-up is raising the ire and eyebrows 
    of the computer security community with the launch of an 
    online auction house where software vulnerabilities are 
    sold to the highest bidder."

WabiSabiLabi.com wants to be an eBay for crackers and they claim their "service will serve to make software users safer in the long run."

WashingtonPost.com:: Site Plans to Sell Hacks to Highest Bidder

   "A British court last week handed down prison sentences of 
    up to 10 years to three Muslim men it called 'cyber-jihadis' 
    and convicted of using the Internet to urge Muslims to wage 
    holy war on non-Muslims. And the U.S. Computer Emergency 
    Readiness Team reported politically motivated cyberattacks 
    in Russia."

I've said it before on this blog and I'll say it again: Cyberwarfare is not going to be fun.

Bill Joy is infinitely more expert than me when it comes to this stuff. Here is a quote from Joy that is in my quote collection.

   "September 11 was essentially a collision of early 20th-century 
    technology: the aeroplane and the skyscraper. We don't want to 
    see a collision of 21st-century technology."

InformationWeek.com:: Cyberterrorism: By Whatever Name, It's On The Increase

Fidelity National Information Services announced that a "senior-level database administrator at one of its subsidiaries stole 2.3 million consumer records containing credit card, bank account and other personal information."

The criminal sold the information to a "data broker" who in turn sold the information to marketing firms. I suspect the data broker and the "marketing firms" are criminals just like the guy who sold the information in the first place.

NetworkWorld.com:: Fidelity National: Ex-worker stole 2.3 million customer records

   "As more and more users come online in China, there's 
    a good chance those computers are using pirated software 
    without up-to-date security fixes, making them prime targets 
    for hackers who are actually located elsewhere in the world."

NetworkWorld.com:: Beijing scores number one spot for malware

   "China is seeking to unseat the United States as the dominant 
    power in cyberspace, so says a U.S. Air Force general leading 
    a new push in this area."

The general was quoted saying:

   "They're the only nation that has been quite that blatant about 
    saying, 'We're looking to do that.'" 

The following blurb was noteworthy.

   "The Defense Department said in its annual report on China's 
    military power last month that China regarded computer network 
    operations -- attacks, defense and exploitation -- as critical 
    to achieving 'electromagnetic dominance' early in a conflict."

   "China's People's Liberation Army has established information 
    warfare units to develop viruses to attack enemy computer systems 
    and networks, the Pentagon said."

Bottom-line: Cyberwarfare is going to suck. Bill Joy was right when he said we don't want to experience 21st century warfare.

A new mall in Tempe has digital billboards. Somebody was quoted saying the following.

   "With digital billboards, a company only has to e-mail a message 
    to the company's Phoenix hub and they can be quickly changed."

The comment prompted me to post the following to AzCentral.com.

   Just wait and see what shows up when these billboards get cracked. 
   I hope they aren't using Windows. Porn anyone?
   (Gerald9588, May 29, 2007 08:16AM)

Dave DeWalt, president and CEO of McAfee, says things are going to get a lot worse in computer security before they get better.

   "Walking off the stage and down the aisle in his Tuesday 
    afternoon keynote at the Interop trade show in Las Vegas, 
    Dave DeWalt told the audience of IT and business professionals 
    that we will see more malware in the next 18 months than we have 
    in the past 20 years. Researchers at the company's legendary Avert 
    Labs are seeing 17,000 new phishing sites every month. He pointed 
    to a 50% to 80% growth in spyware."

There's money to be made by cyber-criminals.

   "During his keynote, DeWalt noted that 37,413 new pieces of malware 
    hit the Internet last year. A hacker, with a multi-star rating, was 
    actually selling an exploit for a Microsoft Excel vulnerability on 
    eBay for $55. And DeWalt, who said he's had his own credit card 
    information stolen, estimated that one out of four people will 
    suffer some kind of digital crime."

DeWalt claims that "cyber crime, as a whole, will cost $105 billion this year alone."

   "In yet another case of stolen confidential data, the 
    Social Security numbers and other personal details for 
    all 64,467 employees in the Ohio state government have 
    been stolen, Governor Ted Strickland announced Friday."

   note:  "Friday" being 15 June 2007.

The NewsFactor.com posting went on to say it the data was on a device that "requires special equipment to be accessed." It further quoted Ohio's governor as saying: "There's no reason to believe a breach of information has occurred."

Doesn't matter if a "breach of information" took place on not; this type of stuff has to stop.

NewsFactor.com:: Today's Confidential Data Loss Is in Ohio

InformationWeek.com:: Yahoo Hacker Uses Story To Find, Exploit Yahoo Messenger Bug

InformationWeek.com:: Two Universities Hit By Security Breaches

   "The University of Colorado at Boulder said sensitive 
    information on 44,998 students was exposed because a 
    worm attacked the network through an un-patched bug 
    in Symantec's anti-virus software."

   "On May 12, the university's IT security investigators 
    discovered that the worm entered the server through the 
    vulnerability, which the IT staff had failed to patch."

Defective software is one issue and sloppy system administration is a second issue. Bobby Schnabel, CU-Boulder vice provost for technology, wrote the following.

   "The server's security settings were not properly configured 
    and its sensitive data had not been fully protected. Through 
    a combination of human and technical errors, these personal 
    data were exposed, although we have no evidence that they 
    were extracted."

Colorado.edu:: CU-Boulder Arts And Sciences Server Hacked On May 12

The "lost" disk contains "names, addresses, Social Security numbers, birth dates and salary data for thousands of employees, retirees and dependents on the company's U.S. payroll."

Money.CNN.com:: Alcatel-Lucent trying to find lost disk

Tom Chomicz, a network security engineer at CDW Government, was quoted saying the following.

   "Higher education is a completely different animal when it 
    comes to security. Universities aren't under mandates to 
    encrypt data in the same way as financial institutions, 
    and they still have some issues with identity management."

It appears as though the University of Missouri needs to tighten up their IT practices.

Wikipedia.org says the Advanced Access Content System (AACS) is a standard for "content distribution and digital rights management, intended to restrict access to and copying of the next generation of optical discs and DVDs."

   "As was reported back in February, an enterprising hacker 
    unearthed and posted one of the decryption keys used by 
    AACS to decode HD-DVD movies (other keys and exploits have 
    been made available in the weeks since). Now the AACS-LA 
    (the entity that licenses AACS to makers of HD-DVD players) 
    has set its lawyers on the futile mission of trying to get 
    every instance of at least one key (hint: it begins with 
    09 f9) removed from the Internet."

EFF.org:: 09 f9: A Legal Primer

The following is difficult to believe: "The identifying information has been online since 1996, but was finally removed last week."

Marc Rotenberg of EPIC (Electronic Privacy Information Center) was quoted saying the following: "It was simply wrong for the Department of Agriculture to post Social Security numbers on a Web-accessible database." In that infamous proclaim of Homer Simpson... "doh!"

I remember embedding data within data... "The USDA said all of the private identifying information was embedded in a larger number and therefore not immediately identifiable."

The USDA claims "there is no evidence that this information has been misused" -- at least not yet.

   McAfee Avert Labs:
   "The tactic for the e-mail is to make you think you've been 
    infected, and that you need to open the ZIP file to run a 
    patch or removal tool to fix your machine." 

I try to never say never, but I'd never click on a dot-exe file attached to an email message.

   VeriSign iDefense:
   "Once executed the worm installs a rootkit on the system 
    (wincom32.sys) and communicates over a private peer-to-peer 
    network to update itself." 

Zombie computers that have high-speed Internet connections are dangerous and they represent a major homeland security issue.

   NewsFactor.com::
   "In essence, the infected computer becomes a zombie machine 
    on a botnet that can be used to send out spam that will 
    launch new attacks. It can also open the door for additional 
    malware to be installed on the victim's system."

What happens when we have zombie supercomputers?

NewsFactor.com:: New Storm Surges Through I.T. World

A few years ago I modernized the following song lyric by Don Henley... A man with a briefcase can steal more money than a man with a gun ...into... a person with a high-speed Internet connection can steal more money than a person with a briefcase. [20 April 2007, top]

   "Some lending companies with access to a national database 
    that contains confidential information on tens of millions 
    of student borrowers have repeatedly searched it in ways that 
    violate federal rules, raising alarms about data mining and 
    abuse of privacy, government and university officials said."

The Washington Post reported that the database contains "60 million records." There are some who believe data mining of student records has "grown exponentially."

WashingtonPost.com:: Lenders Misusing Student Database

   "A government counterintelligence office in charge of 
    protecting information about nuclear technology from 
    foreign espionage has lost 20 desktop computers -- most 
    of them containing classified information, according to 
    a report from the department's Office of Inspector General."

This is downright frightening...

   "In the initial inventory of 618 computers assigned to the 
    directorate's headquarters, 241 were not immediately located. 
    Eventually, all but the 20 were found. The audit report, which 
    was released late last week, also showed that the 'inventory 
    records were so imprecise and inaccurate that the directorate 
    had to resort to extraordinary means" to locate 125 of those 
    241 computers.'"

InformationWeek.com:: Department Of Energy Loses 20 Classified PCs

[Extra] While reading about the sloppy IT practices at the DOE, the following headline was eye-catching... InformationWeek.com:: Hackers Promise 'Nude Britney Spears' Pix To Plant .ANI Exploit

   Comment from: Gerald8100
   03/31/07 @ 06:37

   I need to do my hacker/cracker bit...

   People who access computers without permission are crackers. 
   Not all crackers are hackers, but most of them probably are. 
   A very large percentage of hackers are not crackers. The computing 
   ethics followed by hackers prohibits them from being crackers (i.e. 
   hackers good, crackers bad).

My comment to the AzCentral.com blog ended with a hyperlink to Raymond's "How To Become A Hacker" essay.

Catb.org:: What is a hacker?

   "The report found that Microsoft Windows had the fewest 
    number of patches and the shortest average patch development 
    time of the five operating systems it monitored in the last 
    six months of 2006."

Six months is not a very long time to monitor how secure systems are, but kudos to Microsoft for coming out on top when it comes to security.

Red Hat came in second followed by Mac OS, HP-UX and Solaris.

Sun Microsystems issued the following statement to InternetNews.com: "Symantec's data on security vulnerabilities simply does not match Sun's. We can't verify Symantec's sources and consider their report on Sun inaccurate."

InternetNews.com:: Surprise, Microsoft Listed as Most Secure OS

Phil Howard, an assistant professor of communication at the University of Washington, issued a report that included the following.

   "By year's end the 2 billionth personal record -- some 
    American's social-security or credit-card number, academic 
    grades or medical history -- will become compromised, and 
    it's corporate America, not rogue hackers, who are primarily 
    to blame. By his reckoning, electronic records in the United 
    States are bleeding at the rate of 6 million a month in 2007, 
    up some 200,000 a month from last year."

According to Howard, crackers have accounted for about 31% of the 550 "malicious intrusions" between 1980 and 2006. The balance is due to sloppy IT operations and untrustworthy employees.

I found the following tidbit edifying: "The education sector, primarily colleges and universities, amounted to less than 1 percent of all lost records, but accounted for 30 percent of all reported incidents."

Washington.edu:: Hackers get bum rap for corporate America's digital delinquency

A cracker "gained user-level access to one of the servers that powers wordpress.org, and had used that access to modify the download file." The cracker made code modifications that "allow for remote PHP execution."

WordPress is an Open Source project that was "started in 2003 with a single bit of code to enhance the typography of everyday writing and fewer users than you can count on your hands and toes. Since then it has grown to be the largest self-hosted blogging tool in the world, used on hundreds of thousands of sites and seen by tens of millions of people every day."

WordPress.org:: WordPress 2.1.1 Dangerous, Upgrade

InformationWeek.com:: Who's Responsible For Customer Data?

Blog.WashingtonPost.com:: Judge: MySpace Guiltless In Child Assault

   "University of Maryland researchers from the James Clark School 
    of Engineering observed the activities of hackers as they try 
    to gain access to a computer and exploit it. "Brute force" hackers 
    were the focus of the study, which set up four Linux computers with 
    weak security and Internet connections. The computers were attacked 
    an average of 2,244 times each day, or every 39 seconds on average, 
    confirming suspicions that the average computer is almost constantly 
    under attack."

Crackers like to crack systems so they can setup "botnets," which in turn can used for them to do more cracking.

   "Hackers would typically check the computer's software configuration, 
    change the password, check the configuration again, and download and 
    install a program, which they would then run. 'Often they set up back 
    doors--undetected entrances into the computer that they control--so 
    they can create 'botnets,' for profit or disreputable purposes."

If only crackers were called crackers instead of hackers.

PRNewswire.com:: UM Study: Hackers Attack Computers Every 39 Seconds

   "Three to four laptops are lost or stolen from the FBI 
    every month, according to a report issued this month 
    from the Justice Department's Inspector General."

It is difficult to believe that stuff is stolen from the FBI.

   "While 116 FBI laptops were reported lost and 44 were 
    reported stolen in the last 44 months, the agency is 
    doing better than it was five years ago, the DOJ's audit 
    said of one of the nation's top investigative agencies. 
    Another audit, conducted in 2002, showed that in a 
    28-month period 300 FBI laptops had been lost and 
    17 had been stolen."

InformationWeek.com:: Report: FBI Loses 3 To 4 Laptops Every Month

   "The telnet daemon passes switches directly to the 
    login process which looks for a switch that allows 
    root to login to any account without a password. If 
    your telnet daemon is running as root it allows 
    unauthenticated remote logins."

ISC.SANS.org:: Another good reason to stop using telnet

NewsFactor.com:: Hackers Strike at Key Internet Servers

   "Microsoft late Friday (2007.02.02) warned users to be on the 
    lookout for Excel files that arrive unexpectedly -- even if 
    they come from a co-worker's e-mail address."

   [...]

   "This is the fourth known zero-day attack against the ever-present 
    Microsoft Office suite since early December 2006.  The three previous 
    attacks, all aimed directly at specific targets, used rigged Microsoft 
    Word .doc files."

I am glad to see the Wikipedia has a webpage that discusses what is meant by a "zero-day (or zero-hour) attack." I've always thought it meant crackers used zero to exploit program defects, but I was wrong. A "zero-day attack" is a computer threat that "exposes undisclosed or unpatched computer application vulnerabilities. Zero-day attacks can be considered extremely dangerous because they take advantage of computer security holes for which no solution is currently available." I wonder... Is a zero-hour attack worse than a zero-day attack?

• Blogs.ZDNet.com:: Zero-day #5: Beware of (unexpected) Excel files
• Wikipedia.org:: Zero-Day Attack

InformationWeek reported that "TJX was storing credit and debit card data in violation of the Payment Card Industry Data Security Standard created by Visa and MasterCard."

Needless to say, lawyers are going to make money thanks to TJ Maxx weak IT efforts.

   "Red Hat developer Alan Cox told a House of Lords committee on 
    science and technology that a developer's obligation to create 
    secure software is ethical, not legal."

With respect to "closed-software," Cox said the following.

   "[Code] should not be the [legal] responsibility of software 
    vendors, because this would lead to a combatorial explosion 
    with third-party vendors. When you add third-party applications, 
    the software interaction becomes complex. Rational behavior for 
    software vendors would be to forbid the installation of any 
    third-party software." 

With respect to FLOSS, Cox said: "Potentially there's no way to enforce liability."

ZDNet.com.au:: Linux guru argues against security liability

According to the makers of security software, virus writers (i.e. crackers) have "begun responding more quickly to top news headlines, rather than using sex and celebrity as a means to ensure their viruses get activated."

NewsFactor.com:: New 'Storm Worm' Pummels PCs

[Extra] Yikes... While at the NewsFactor.com website reading about the "Storm Worm," I came across a news story about a retailer named TJX being cracked. What warranted using the work Yikes is the fact that the cracked happened in May of 2006.

NewsFactor.com:: Retail Giant TJX Discloses Massive Data Breach

Blog.Wired.com:: When Hippies Turn to Cyber Terror

Cisco Systems has about 50,000 employees. On 6 January 2007, at a stock price of $28.47, Cisco had a market value of approximately $172.89 billion.

San Bruno, CA-based IronPort is a privately-held company "known for 'reputation filters' that block spam by examining a sender's record." IronPort has about 408 employees.

Symantec found the defect and reported that "a weakness was discovered in the way that the Adobe Reader browser plug-in can be made to execute JavaScript code on the client side." Damn JavaScript.

NewsFactor.com:: Security Flaw Discovered in Acrobat

Security Watchdog Archives: 2006 | 2005 | 2004 | 2003 | 2002 | 2001 | 2000

Thanks for Visiting