A person or other entity such as a computer program that attempts to cause harm to an information system; for example, by unauthorized access or denial of service. Human attackers are also called "crackers" and "hackers." See attack.
 | Reproduced with permission from Computer Desktop Encyclopedia. Copyright (c) 1981-2007 The Computer Language Company Inc. All rights reserved. |
Additional Resources
- Novell GroupWise 'mailto' URI handler buffer overflow vulnerability
- Researcher Juan Pablo Lopez Yacubian has reported another URI abuse exploit. From Security Focus: Novell GroupWise is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue will allow an attacker to execute...
- Blog posts 2008-04-29
- MS08-025: Microsoft Windows kernel vulnerable to local privilege escalation flaw
- From Microsoft: A local attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts. This is an important security update for all supported editions of Windows 2000, Windows XP, Windows Server...
- Blog posts 2008-04-29
- Developers at fault? SQL Injection attacks lead to wide-spread compromise of IIS servers
- There's been a lot of noise and violent thrashing over the last couple days regarding a flaw that was originally believed to be a flaw in Microsoft's IIS (Internet Information Server), but has since been pointed out as simply a well thought out SQL Injection attack. For those of...
- Blog posts 2008-04-28
- Recent CNN Distributed Denial of Service (DDoS) attack explained
- According to Netcraft: "The CNN News website has twice been affected since an earlier distributed denial of service attack last Thursday. CNN fixed Thursday's attack by limiting the number of users who could access the site from specific geographical areas. Subsequently, an attack was purportedly organised to...
- Blog posts 2008-04-23
- Oracle patches DB, apps
- Oracle patches DB, appsOracle Critical Patch Update Risk Matrix & CVSSHi Larry! This is Eric Maurice of Oracle. An important document for Oracle customers, the Critical Patch Update (CPU) Advisory lists vulnerabilities addressed in the CPU as well as provides other information related to the patches (affected platforms,...
- Discussion threads 2008-04-16
- Adobe patches 7 issues, including Pwn2Own contest flaw and DNS rebinding issues
- Adobe published an advisory covering issues, including a fix for the Pwn2Own flaw that we previously discussed here. Adobe's details are published here. One of the issues that was patched was discovered by myself and fellow researcher (and co-worker at Ernst & Young's Advanced Security Center) Rob Carter, see the picture to the...
- Blog posts 2008-04-09
- Apple bolsters QuickTime defenses... or do they?
- A couple of great articles came out recently, one from Ryan Naraine and one from our very own Larry Dignan, about some of the defenses that Apple is trying to build into QuickTime to defend Vista users. As we've talked about here before, with Vista, it's all...
- Blog posts 2008-04-08
- Adobe Flash Pwn2Own details released by ZDI...
- ... and unfortunately leaves much to be desired. I think many people were hoping for the disclosure from ZDI to contain a lot of details on what could've been exploited with this issue, unfortunately, the details just aren't really there. In fact, after reading it, I think I have more...
- Blog posts 2008-04-08
- Microsoft patches Vista, Windows Server 2008, IE
- Microsoft delivered 10 patches including six critical ones on Tuesday. Among the critical patches for Vista, Windows Server 2008 and Internet Explorer. Critical patches by the CVEs: CVE-2008-0083: Covers Windows Vista and Windows Server 2008. Microsoft says: "A remote code execution vulnerability...
- Blog posts 2008-04-08
- Secure coding: the invisible elephant
- The last couple of weeks, I've been trying to vaguely connect the dots between social computing, cloud computing and traditional process based systems. There are multiple legs to the story but one that had pretty much escaped my attention was the security angle. I will not claim any special expertise...
- Blog posts 2008-04-08
- Hidden Secrets: The Nightmare (zip)
- Hidden Secrets: The Nightmare Attempted murder victim Flora Dale wakes up briefly as she is rushed into the ER. Uncertain of how she got there, and with her strength failing, she is unable to tell the doctors anything and quickly falls into a deep coma. As she lies trapped in...
- Software downloads 2008-03-25
- Defeating the Same Origin Policy part 2
- In my first post in this series, I discussed the Same Origin Policy and how it protects us from some very serious attacks, the dangers of domain name based trust, and how to attack implementations of the Same Origin Policy within the Java Virtual Machine (JVM). In order to demonstrate...
- Blog posts 2008-03-24
- Security: Lintel vs Wintel
- In the PC community "security" just means defending against attacks aimed at destroying or misusing all or part of a computer system. In that context most of the complexities associated with trying to decide whether wintel or lintel will expose you to less security risk arise from the absense of...
- Blog posts 2008-03-24
- Microsoft confirms Word attacks
- Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine, which shares data with Access, Visual Basic and third party applications. Microsoft in its advisory said the potential for attack is "very limited." Reports of...
- Blog posts 2008-03-24
- Apple's week of patching: Camera compatibility flaw patched
- Apple on Friday shipped a security update for Aperture 2, iPhoto 7.1.2 with iLife Support 8.2. Here's what Apple had to say in an advisory about CVE-2008-0987: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution Description: ...
- Blog posts 2008-03-20
- Security update breaks printer drivers, Instant Hijack component
- Discussion boards are breaking with reports of SSH and printer problems caused by Apple's late Tuesday release of Mac OS X's Security Update 2008-002. However, fixes can be had. Rogue Amoeba Software released a compatibility fix for its Instant Hijack component that is often installed by the...
- Blog posts 2008-03-19
- Major flaw in State of Pennsylvania online voter registration puts user data at risk
- Update: Microsoft is NOT at fault for this! There seems to be some confusion within the talkbacks on this subject about this being Microsoft's fault, and also some strange claims that development shops who do only .NET programming are more likely to program insecurely. This is just, in fact,...
- Blog posts 2008-03-18
- Someone get me rewrite: Apple delivers monster security update for OS X
- Apple delivered a security update for Tiger and Leopard Tuesday with at least 80 patches addressing multiple vulnerabilities. You know it's a big patch haul from Apple when you read the advisory and: You're not sure where to begin; You're IMing fellow security...
- Blog posts 2008-03-18
- Defeating the Same Origin Policy part 1
- Defeating the Same Origin Policy part 1ouh... That made my head hurt.Excellent post. I wasn't sure wither to laugh or scream. Worrisome, I will say that.And while this subject is, in fact, no laughing matter, the way you made it look so easy made me laugh anyway. ...
- Discussion threads 2008-03-14
- Defeating the Same Origin Policy part 1
- The Same Origin Policy is one of the guiding principles that seek to protect our browsing experience. The Same Origin Policy was originally released with Netscape Navigator 2.0 and has been incorporated in one form or another in every major browser since. The concept has additionally been extended...
- Blog posts 2008-03-14
Neighboring Terms
Premier Vendor Content Whitepapers, webcasts & resources from our Power Center Sponsors
- Visual Demo: Quad-Core Intel Xeon Processor 7300 Series-Based Servers
-
Discover how Quad-Core Intel Xeon processor 7300 series offer innovations in data traffic optimization.
- View the Flash demo now >>
- Business Software Center
- The Customer Collective: Join the online network for sales and marketing executives
- From our sponsors
- Oracle White Papers
-
- Data Grids and Service-Oriented Architecture »
-
- What's Required to Secure a Service-Oriented Architecture »
-
- Business Intelligence and Enterprise Performance Management »
-
- Making the Case for Oracle Database on Windows »
-
