c69's Browser Pit

http://expertmiami.blogspot.com/2012/05/skype-does-away-with-random-supernodes.html
via arstechnica

Interesting project by microsoft. Main idea - "no matter how you hard you encode your code, you will need to decipher it eventually - so it will run, and here we will see it!". Very low overhead, very promising results.
http://research.microsoft.com/en-us/projects/nozzle/

p.s.: it has a subproject dedicated to finding out if the script was obfuscated or not, sounds nice for automated submission systems in app stores and so on.

Connections between social networks and intelligence agencies of different kinda are not very new, but most people ignore it. Maybe, the hyped dude from tv can persuade people to listen and think:

Facebook in particular is the most appalling spying machine that has ever been invented. Here we have the world’s most comprehensive database about people, their relationships, their names, their addresses, their locations and the communications with each other, their relatives, all sitting within the United States, all accessible to US intelligence. Facebook, Google, Yahoo – all these major US organizations have built-in interfaces for US intelligence. It’s not a matter of serving a subpoena. They have an interface that they have developed for US intelligence to use.

Now, is it the case that Facebook is actually run by US intelligence? No, it’s not like that. It’s simply that US intelligence is able to bring to bear legal and political pressure on them. And it’s costly for them to hand out records one by one, so they have automated the process. Everyone should understand that when they add their friends to Facebook, they are doing free work for United States intelligence agencies in building this database for them.

http://rt.com/news/wikileaks-revelations-assange-interview/

p.s.: and do not forget, CIA is by far not the worst possible information collector so when you [plan] to use any social network site, think about it.

The exploit shown in this video is one of the most sophisticated codes we have seen and created so far as it bypasses all security features including ASLR/DEP/Sandbox (and without exploiting a Windows kernel vulnerability), it is silent (no crash after executing the payload), it relies on undisclosed (0day) vulnerabilities discovered by VUPEN and it works on all Windows systems (32-bit and x64).

The exploit works on both Chrome versions 11.x and 12.x. It was tested with Chrome v11.0.696.65 and v12.0.742.30.

http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php

new kit named the Weyland-Yutani BOT that is being marketed as the first of its kind to attack the Mac OS X platform.

The seller of this crimeware kit claims his product supports form-grabbing in Firefox and Chrome, and says he plans to develop a Linux version and one for the iPad in the months ahead. The price? $1,000, with payment accepted only through virtual currencies Liberty Reserve or WebMoney.

http://krebsonsecurity.com/2011/05/weyland-yutani-crime-kit-targets-macs-for-bots/

Some russian guy Sergey Glazunov is robbing google:

We’re delighted to offer our first “elite” $3133.7 Chromium Security Reward to Sergey Glazunov. Critical bugs are harder to come by in Chrome, but Sergey has done it. Sergey also collects a $1337 reward and several other rewards at the same time, so congratulations Sergey!

Study well, kids, and you can be like him

http://googlechromereleases.blogspot.com/2011/01/chrome-stable-release.html