null Bangalore Chapter, January 2013 Meet

1. Information security news
News Bytes

2. Cisco VoIP vulnerability allows eavesdropping
remotely
The lack of input validation
at the syscall interface
allows arbitrary
modification of kernel
memory from userland, as
well as arbitrary code
execution within the kernel.
This, in turn, allows the
attacker to become root,
gain control over the DSP ,
buttons, and LEDs on the
phone

3. And the saga continues
New java 0-day vulnerability
discovered that allow a
remote, unauthenticated
attacker to execute arbitrary
code on a vulnerable system.
Oracle delivers an unusual
emergency patch to Java's
critical 0-Day vulnerability. Two
days later, a Java exploit is
advertised for $5,000 a piece
in an underground Internet
forum is apparently already in
at least one attacker's hands.

4. Operation Red October
Large scale and complex cyber-
espionage operation has been
discovered, named Red
October. Started in 2007 and
mainly targeting international
diplomatic service agencies.
The attackers had evaded
detection for over five years,
giving them access to victims'
passwords, network
configurations and sensitive
information on workstations
and mobile devices.

5. Malware Infects US power Plants through USB Drives
Some unknown malware
infected two power plants
control systems using
unprotected USB drives as
an attack vector. Reports
that current antivirus
softwares would have
found the malware.

6. Child porn on Indian Govt websites
'entegramam.gov.in'
forums hosting Child Porn
content from last four
months and authorities or
the moderators of the
website were not aware
about the issue even after
Google giving notification
"This site may be
compromised" for few
websites.

7. Internet explorer vulnerable to remote code
execution
Remote code execution
vulnerability exists in the way that
Internet Explorer accesses an
object in memory that has been
deleted or has not been properly
allocated.
The vulnerability may corrupt
memory in a way that could allow
an attacker to execute arbitrary
code in the context of the current
user within Internet Explorer. An
attacker could host a specially
crafted website that is designed
to exploit this vulnerability
through Internet Explorer and
then convince a user to view the
website.

8. Hacking facebook password like changing your own
password
Flaw allows anyone to
reset the password of any
Facebook user
without knowing his last
password. The
Vulnerability was very
simple to execute, but
now patched by Facebook
Security Team.
https://www.facebook.com/hacked
https://www.facebook.com/checkpoint/checkpointme?f=[userid]&r=web_hacked

9. Facebook Hacker cup 2013
• Jan 7 — Jan 27 — Registration
• Jan 25 — Jan 27 — Online
Qualification Round
• Feb 2 — Online Elimination
Round 1
• Feb 9 — Online Elimination
Round 2
• Feb 16 — Online Elimination
Round 3
• March 22 -23 — Onsite Finals
at Facebook
Registration :
https://www.facebook.com/hack
ercup/register

10. RIP Aaron Swartz