ryan naraine

ZDNet Resources

• sort by:
• Relevance
• Date
• Popularity

Gaping holes in RealPlayer patched

Digital media delivery firm RealNetworks has shipped a high-prority patch to cover four gaping holes in its flagship RealPlayer software, warning that the vulnerabilities could put users at risk of code execution attacks. The patch comes a few hours after Secunia released an advisory warning for one...

Tags: Vulnerability, RealNetworks Inc., RealNetworks RealPlayer, Digital Music, Digital Media, Security, Personal Technology, Consumer Electronics, Ryan Naraine

Blog posts 2008-07-25

Microsoft joins 'patch DNS now' chant; Apple patch missing

On the heels of the release of weaponized exploit code for the DNS cache poisoning vulnerability, Microsoft has joined the chorus of security pros pleading with DNS server providers to immediately apply patches to protect users from malicious attacks. The Redmond, Wash. security...

Tags: Apple Macintosh, DNS, Vulnerability, Apple Inc., Exploit Code, Microsoft Corp., Attack, Dan Kaminsky, Domain Names, Apple Mac OS X, Networking, Security, Internet, Operating Systems, Software, Apple Mac OS, Ryan Naraine

Blog posts 2008-07-25

GMail adds "https:"-only connections but still not by default

Google has added a new "Browser Connection" feature to GMail to allow users to force e-mail sessions to always use the more secure "https:" protocol but, strangely, this is not turned on by default. In the Settings tab, at the very bottom, GMail users can now select...

Tags: Google Inc., Google Gmail, HTTP, E-mail Providers, Cloud Computing, Internet, Ryan Naraine

Blog posts 2008-07-25

Escapee 'Spam King' dead in apparent murder-suicide

Convicted spammer Eddie Davidson, who escaped from federal prison over the weekend, killed his wife and 3-year-old daughter before killing himself in what is being described as a murder-suicide. Colorado's 9News.com said the tragic end of the man known as the "Spam King" was confirmed by the...

Tags: Prison, Sheriff, Internal Revenue Service, Attorney, Healthcare, Ryan Naraine

Blog posts 2008-07-24

AT&T iPhones exposed to DNS cache poisioning? Or not?

Here's a photo of my iPhone after running Dan Kaminsky's Doxpara DNS Checker tool a few minutes ago: I ran the same test at the DNS-OARC's DNS checker and got this:  209.183.33.23 (schinetdns.mycingular.net) appears to have GREAT source port randomness and GREAT transcation...

Tags: DNS, AT&T Corp., Domain Names, Networking, Internet, Ryan Naraine

Blog posts 2008-07-24

Speculation over possible Skype backdoor

There's growing speculation coming out of Europe that there's a backdoor in Skype that allows remote eavesdropping of telephone conversations. A report in the reputable Heise Online says the issue was discussed at a meeting with ISPs last month where high-ranking officials at the Austrian interior...

Tags: Skype Technologies S.A., Telecom & Utilities, Internet Service Providers (ISPs), Internet, Ryan Naraine

Blog posts 2008-07-24

Apple looking to hire iPhone hacker

Apple is in the market for someone capable of hacking into the iPhone. According to this job listing, the company is looking for an iPhone Security Engineer capable of, among other things, developing "proof of concept" attacks on the device's current security mechanisms. ...

Tags: Apple iPhone, Apple Inc., Hacker, Security Mechanism, Security, Ryan Naraine

Blog posts 2008-07-24

Attack code published for DNS flaw

The urgency to patch Dan Kaminsky's DNS cache poisoning vulnerability just went up a few notches. Exploit code for the flaw, which allows the insertion of malicious DNS records into the cache of the target nameserver, has been added to Metasploit, a freely distributed attack/pen-testing tool....

Tags: Ryan Naraine

Blog posts 2008-07-23

'Spam King' escapes from federal prison

[ UPDATE:  Davidson was found dead, involved in an apparent murder-suicide that involved his wife and 3-year-old daughter. ] Edward "Eddie" Davidson, a notorious e-mail spammer who was sentenced to jail time in April, has escaped from a federal prison camp in Florence, Colorado. Davidson...

Tags: Internal Revenue Service, Restitution, Davidson, Federal Prison Camp, E-mail, Security, Online Communications, Ryan Naraine

Blog posts 2008-07-23

iPhone vulnerable to phishing, spamming flaws

Security researcher Aviv Raff left has discovered a pair of basic design flaws that could turn your iPhone into easy bait for malicious phishing and spamming attacks. According to an advisory from Raff, the iPhone's Mail and Safari applications are susceptible to a URL Spoofing vulnerability which...

Tags: Apple iPhone, Apple Safari, Vulnerability, Spamming, Flaw, Aviv Raff, Phishing, Spam, Security, Spam And Phishing, Ryan Naraine

Blog posts 2008-07-23

Researchers borrow from Google PageRank for network defense service

Using a link analysis algorithm similar to Google PageRank, researchers at the SANS Institute and SRI International have created a new Internet network defense service that completely revamps the way network blacklists are formulated and distributed. The service, called Highly Predictive Blacklisting (.pdf), will be unveiled next...

Tags: Google PageRank, Attacker, Network, DShield, Highly Predictive Blacklist, Internet, Networking, Security, Ryan Naraine

Blog posts 2008-07-23

RIM ships fix for BlackBerry code execution bug

Just a quick note to update a story I wrote last week on an unpatched remote execution vulnerability affecting BlackBerry business users: Research in Motion RIM has finally shipped patches to cover the issue, which affects the BlackBerry Attachment Service component of the BlackBerry Enterprise Server. ...

Tags: Research In Motion Ltd., RIM BlackBerry, Handhelds, Hardware, Ryan Naraine

Blog posts 2008-07-22

Vulnerability disclosure gone awry: Understanding the DNS debacle

On July 7, the day before the release of the patch for the now infamous DNS design flaw, hacker Dan Kaminsky with the help of Black Hat conference organizers invited reporters to a press conference to "discuss the massive multivendor patch being released this Tuesday." "A synchronized...

Tags: Black Hat, DNS, Conference, Dan Kaminsky, Thomas Ptacek, Domain Names, Patches, Security, Networking, Internet, Ryan Naraine

Blog posts 2008-07-22

Has Halvar figured out super-secret DNS vulnerability?

[ UPDATE:  Kaminsky has all but confirmed that, yes, the cat is out of the bag ] It looks very much like the nitty gritty of Dan Kaminsky's super-secret -- and heavily hyped -- DNS cache poisoning vulnerability has been figured out by reverse engineering guru Halvar...

Tags: DNS, Vulnerability, Server, Referral, Mallory, Domain Names, Networking, Security, Internet, Ryan Naraine

Blog posts 2008-07-21

Unpatched code execution bug haunts BlackBerry

Security alerts aggregator Secunia has raised an alarm for a "highly critical" vulnerability that puts users of the BlackBerry Enterprise Server at risk of code execution attacks. Technical details of bug are not available but Secunia says it is caused by an unspecified error in the BlackBerry...

Tags: Adobe PDF, Smart Phone, RIM BlackBerry, Handhelds, Smart Phones, Hardware, Consumer Electronics, Personal Technology, Ryan Naraine

Blog posts 2008-07-17

WordPress 2.6 disables remote access, swats 194 bugs

WordPress, one of the fastest growing blog software providers, has shipped a new update with fixes for nearly 200 bugs and a major security-related change to disable remote publishing protocols by default. With WordPress 2.6, the open-source software promises to be more secure out-of-the-box with full SSL...

Tags: Remote Access, Wordpress, SSL, WordPress 2.6, Ssl/Tls, Authentication/Encryption, Security, Ryan Naraine

Blog posts 2008-07-15

On deck from Oracle: 45 critical database, server patches

Database server giant Oracle plans to ship patches for a total of 45 security vulnerabilities on Thursday (July 17), bringing the vulnerability count for 2008 to a whopping 112. Since January 2006 this CPU included, Oracle has shipped fixes for a total of  572 vulnerabilities. ...

Tags: Oracle Corp., Vulnerability, Patch Management, Server, Storage, Patches, Databases, Security, Enterprise Software, Hardware, Software, Data Management, Ryan Naraine

Blog posts 2008-07-14

Apple ships (long overdue) iPhone security patches

Finally, after months of waiting, iPhone users finally get security fixes for a batch of known software vulnerabilities. The latest iPhone 2.0 and iPod Touch 2.0 update patches at least 13 documented vulnerabilities, including several code execution holes in the Safari mobile Web browser. The...

Tags: Apple iPhone, Apple Safari, JavaScript, Apple Inc., Web Site, Arbitrary Code Execution, Application Termination, Memory Corruption, Web Site Development, Web Technology, Security, Internet, Ryan Naraine

Blog posts 2008-07-11

Security is hard, accept it

* Ryan Naraine is on vacation. Guest editorial by Dr Jose Nazario The past 10 or 15 years have been about the same things, largely, over and over again: input problems into single system applications or kernels. Buffer overflows (splitvt! NCSA...

Tags: Security, Ryan Naraine

Blog posts 2008-07-10

The key to an open, transparent malware filtering system

* Ryan Naraine is on vacation. Guest editorial by Max Weinstein It's no secret that Web sites have become a medium of choice for delivering malware and soliciting personal information for criminal use. One increasingly popular approach to addressing this problem is warning...

Tags: Malware, Web Site, Site, Web Site Development, Web Technology, Cyberthreats, Spyware, Adware & Malware, Viruses And Worms, Security, Internet, Ryan Naraine

Blog posts 2008-07-09