Flash, again, has problems:
Macromedia has warned that its Flash Player, a ubiquitous application for playing multimedia files, has a vulnerability that could allow attackers to run malicious code on Windows and Unix-based operating systems.PGP is pretty good, not perfect. Specifically, it doesn't protect cryptographically naive users from the same kinds of attacks that allowed Bletchley Park decipher Fish:Separately, researchers discovered a flaw in the player that could allow an attacker to read files on a personââ¬â¢s local hard drive.
The software flaws are serious because the Flash Player is so widespread. Macromedia estimates that more than 90 percent of PCs are capable of playing Flash content.
Researchers working at Columbia University discovered the flaw, which requires a hacker to intercept and modify an encrypted message. If the recipient attempts to decrypt the message, he or she will be presented with a string of gibberish. If the recipient then replies to that message, saying, for instance, "what were you trying to say?" and quotes the string of gibberish, the attacker could use that response to decode the original message.IE and Konqueror have bugs handling SSL certificates. Mozilla may have the same security bug, but the overall bugginess of Mozilla may be hiding that fact. The flaw is based on the ever-popular man-in-the-middle attack:
The wind-up is that any fool with an SSL cert can spoof certs for popular, trusted sites, and intercept communications widely imagined to be secure with a man-in-the-middle attack. If this should happen to you, that reassuring little padlock icon is essentially worthless.And finally, regardless of what Theo de Raadt may say, OpenBSD does have bugs, including security bugs. It may be one of the best things out there, but nothing is impervious (except for WinNT 3.51, when it's physically secure and disconnected from all networks... :-):
1. Systems affected:All versions of OpenBSD.2. Overview:Insufficient boundary checks in the select call allow an attacker to overwrite kernel memory and execute arbitrary code in kernel context.
Today's lessons: a healtly ecosystem is always better than a monoculture, and technology is not an excuse to stop being vigilant. But you already knew that. :-)
