Tag: flaw

Serious Window Problem indentified by Microsoft

After listening to Security now Episode 58, I had write a quick blog post to warn people about this very (I would say) critical flaw in Windows XP and IE. I have temporarily patched my systems by unregistering the VGX DLL. I would highly suggest everyone do the same by copying the following code into your run dialog box and restarting your machine.

regsvr32 -u “%CommonProgramFiles%Microsoft SharedVGXvgx.dll”

Much more information and another flaw affecting only Windows 2000 users can be found at the security now notes page.

Comments [Comments]
Trackbacks [0]

BA site compromised, again?

British Airways

From Slashdot yesterday, Identity Theft from Tossed Airline Boarding pass?

The Guardian newspaper has a great story about how the gathering of information for anti-terrorist passenger screening databases allowed a reporter and security guru Adam Laurie to lay the groundwork for stealing the identity of a business traveller by using his discarded boarding-pass stub. From the article: We logged on to the BA website, bought a ticket in Broers name and then, using the frequent flyer number on his boarding pass stub, without typing in a password, were given full access to all his personal details – including his passport number, the date it expired, his nationality (he is Dutch, living in the UK) and his date of birth. The system even allowed us to change the information.

So my take on it is, maybe this story is not quite what its cracked up to be. According to many Slashdotters there calling bullshit. But in the past I've also seen how easy it is to exploit BA's online system. I'm actually sure I've emailed BA over 2 years ago and maybe blogged it a while ago. See the problem I had was that my password timed out and I needed to get a eticket for the return journey. So I logged in as Sarah who had a different account then changed a few things in the URL and bingo I was able to see my account details including address, passport number, etc. Now from what I remember I couldn't get the password, but I could change it (which I did). I do remember the membership number, firstname, lastname and email address was all I needed to change the account.

I remember being so shocked at the lack of security and privicy that I tried to delete my account once I got back to the UK. I know for sure I told quite a few people about this flaw but can't quite remember exactly who. Honestly the problem seems to be when your already logged in accessing someone elses account other than your own. Anyway, I guess I should go and see if I can get my old details without a password… Hopefully some mainstream attention like this will force BA to recheck there site and maybe solve the flaw I identified all that time ago.

Comments [Comments]
Trackbacks [0]

Steve Gibson says Windows Metafile was a backdoor

So while in the shower today I was listening to Leo Laporte and Steve Gibson's Security now number 22. I almost fell in the shower after hearing the possibility that Microsoft maybe covered up a backdoor in Windows. Simply put Steve Gibson is suggesting that Microsoft or some people involved in the code for the Windows Metafile (WMF) put in a backdoor. Aka it was not a flaw or vunerability, a backdoor! If this is true I'm speechless.

Its easy to think of this as a conspiracy and put on your foil hats now but this deadly serious. Even Steve has admitted if he's wrong he will be the first to admit he's wrong but he really doesnt believe this. He's actually put a lot on the line for this. Personally I think this is just a long line of the mainstream lying to us. Think about it Sony and there badly written DRM and worst still badly written Rootkit. Lies and more damm lies. Even when there pants were down they tried to cover it up by saying people didnt even know what a rootkit was so why tell them. I remember quoting Miles in my post about the Rootkit saying Apple and Microsoft must be pissing themselves with laughter. Well its now Microsoft's time and Apple are not getting away clean. Theres lots of talk about iTunes in the context of useage patterns feedback and the reduction of uses of the sharing feature across the versions. So Apple users don't even laugh because Apple are hardly saints either.

But back to this claim of a backdoor in Windows. If it turns out to be true (and honestly Steve's explaining actually makes a lot of sense I have to say). We have to wonder how many more there are? Who put this backdoor there and who actually knows about it? I expect by the time this gets out there it will make the large news sources quickly. I've not looked on Digg, slashdot, boingboing yet because I'm on the 10am train into London Bridge. Tell a lie, I just did a search through Digg on the my aggregator and this came up (which is close but not the same) this came up.. I'll digg it when I get back online in about 20mins. Looking at the date of the Digg story (7:30am) its still too early for most of the Western world and may not have had time to circlate yet. Steve did say this was a exclusive to Security now and he's only known about it for about a day at most. Anyhow, we shall see what happens. By the way the people who came out of this smelling pretty sweet has to be Hackers. If it wasn't for hackers and reverse engineering we would never know. This is critical to remember no matter how it turns out.

Comments [Comments]
Trackbacks [0]