1. PREVIOUS GNEWS

2. August 9 Patches – 14 bugs addressed Affecting XML, Office, Visual Basic, GDI, VML (IE), Media Player, Windows Gadgets, Vista, Virtual PC / Server Patch Tuesday 9 Security Patches - 6 Critical, 3 Important –MS07-042 – XML Core Services - Remote Code Execution (IE) –MS07-043 – OLE Automation - Remote Code Execution (Office, VB) –MS07-044 – Excel – Remote Code Execution –MS07-045 – IE Cummulative –MS07-046 – GDI - Remote Code Execution (Windows) –MS07-047 – Media Player – Code Execution –MS07-048 – Windows Gadgets - Code Execution –MS07-049 – Virtual PC / Server – Privilege Escalation –MS07-050 - VML - Remote Code Execution (IE, Windows)

3. September X Patches – X bugs addressed Affecting Windows, Visual Studio, Windows Services for Unix, Messenger Patch Tuesday 4 Security Patches, X bugs addressed –MS07-051 - X - Remote Code Execution (Windows) –MS07-052 - X - Remote Code Execution (Visual Studio) –MS07-053 - X - Privilege Escalation (Windows Services for Unix) –MS07-054 - X - Remote Code Execution ( MSN / Live Messenger)

4. DATA LOSS 32 + reported incidents Launch of SSNBreach.org Monster.com trojan –1.6 million Records OK Law Enforcement Breached –Kiowa County police departments affected, no details Verisign, Stolen Laptop, Fired Employee –HR, Employee data Scotland Yard, Stolen Laptop –Wire tap data and evidence

5. Holes / Patches Out of Cycle Vista Patches –5 patches - 2 Important, 2 Recommended, 1 Optional Apple Patches iTunes - Buffer over flow in album cover art Cisco VOIP - SIP, IPv6, Secure Copy –Dos code posted to milw0rm Cisco VPN – Privilege Escalation in cvpnd.exe Cisco Catalyst – Dos in CSM and CSM-S WireShark – Crash on MMS message parsing

6. Hacking R.I.P. Joybubbles 1949- 2007 KeeLog anti-theft cipher cracked (copy key and travel) –Used on Chrysler, Daewoo, Fiat, General Motors, Honda, Toyota, Volvo, Volkswagen, and Jaguar Still more iPhone, new hardware and software unlock methods Site with foreign embassy accounts / passwords shutdown by US law enforcement –Story still on going –Account list still available, but in motion –Data collected via tor exit nodes MS starts ‘Hackers’ blog (looking for a few good white hats)

7. Holes StormWorm –DoS in Canada –Uses Google Blogger –Now using Tor –Local sightings? Opera - Unspecified error in JavaScript pointer 5 of 8 Ubuntu servers hacked Oracle JInitiator – Overflow in beans.ocx Activex Control Novell Client – Overflow in NWSPOOL.DLL German hacker clones e-passport

8. Corp. Hell WhiteDust.net closes under peer pressure / animosity More Sony RootKits –MicroVault USM-F Fingerprint Reader and USB Stick SourceFire buys ClamAV Acer to buy Gateway Oracle buy BridgeStream PathLink preps for IPO, changes name – Lumension Security NetApp sues Sun, Patent infringement related to ZFS file system FaceBook to be opened to search engines MS to ‘bundle’ Windows Live Messenger to OS (like IE) VMware IPO may violate Copyrights

9. Holes Medeco announces it will change lock design after Defcon demo SIP ease dropping possible on undisclosed VOIP vendor –Other vendors may also be vulnerable Multiple vulnerabilities in PHP Bind 8 End-of-Life and cache poisoning MS Genuine Advantage triggered false positives due to human error Vista audio bug may cause network performance to drop Skype outage (it’s hackers, no windows patches, no wait…..)

10. Film / Music Paramount drops Blu-Ray NY Times, Paramount and DreamWorks paid for HD allegiance Court rules no violation, AllofMP3.com vows a come back Wachowski Brothers rendering of Speed Racer Live action Robotech with Toby McGuire New Medium Enterprises launches HD VMD (Versatile Multilayer Disc) –Players for $150, 30 GB capacity, 40 Megabits / second Zap2it closes, MythTV loses tv guide service Safari ‘Active Window’ feature used to slurp music off of MySpace profiles

11. Papers HD Moore “Tactical Exploitation” WhitePaper Follow-up to Anti-Forensics Stanford Law “Evidentiary Implications of Potential Security Weaknesses in Forensic Software”

12. WTF!? Johnson & Johnson sues Red Cross over cross logo Drug test the Metroplex, Raw sewage used to show “area” drug use Thieves use surveillance gear to heist stores remotely Comcast forges bit torrent traffic to throttle P2P, may be violating criminal impersonation statutes Skype reads /etc/passwd Cleveland Copper thieves cause network outage UK Judge wants DNA stored in national database

13. Updates Apple iTunes 7.4.1 Apple Airport Firmware 7.2.1 Apple iPhoto, iMovie, iWeb updated / Apple drops Apple Works New iPods XeroBank xbMachine Launch XeroBank xbBrowser 2.0.0.6 Eudora is back Pwdump 6 and fgdump 1.6.0 Sqlninja 0.1.3 Aanval 3.2 (snort frontend) Simpleness 2.0 (nessus frontend) Redcurtain malware detection luanched BotHunter OpenWall Kernel Patch Tenshi 0.8 (log monitor) MS Live ID Launch (replaces passport) MS SilverLight 1.0 (cross browser plug-in like Adobe Flash) Vista SP1 due Q1 2008

14. Legal Caller ID Spoofing to be illegal German law follow-up –Stefan Essar, removes code from old PHP sites (Month of…) –THC migrates web site, is reported as “last to leave” NY Judge overturns portion of Patriot Act Electronic Crimes Bill 2007 could usher in Death Penalty for cyber terrorism RIAA can’t pay it’s court ordered fines Coupons.com sues user under DMCA for deleting registry key –Deleting key allows for multiple use of coupons California RFID implant follow-up, Bill was based to ban company implants 9 th Circuit court rules AT&T terms of service clause “unconscionable” –Clause states that by using AT&T’s service you waive the right to class actions suits

15. CON Results Chaos Camp Summary, a call to Americans on how to run a con Virtualization rootkit slides posted (from defcon) Oracle 11g exposed at Hack in the Box

16. CON Events Completed Cons –Chaos Communications Camp, 8 - 12 August - Berlin –Hack In The Box, 3 – 6 Sept. – Kuala Lumpur Future Cons –ToorCon, 29 Sept - 1 Oct 2007 - San Diego CA –Phreaknic, 20 - 22 Oct 2007 - Nashville TN –LISA, 11 - 16 Nov 2007 - Dallas TX –OWASP + WASC, 12 -15 Nov - San Jose CA –BreakPoint, 15 - 18 Nov - Mexico –Chaos Communication Congress, 27 - 30 Dec 2007 - Berlin

17. All images scavenged without permission