us-cert

Some Samsung printers vulnerable to hackers

Owners of certain Samsung printers may find their devices a target for hackers.

Samsung printers and some Dell printers made by Samsung have a hardcoded account that someone could use to control and access information on the devices, according to US-CERT (United States Computer Emergency Readiness Team).

As described by the security team, these printers contain a hardcoded SNMP (Simple Network Management Protocol) string that has full read/write access and stays active even if the network protocol is disabled by the user.

"A remote, unauthenticated attacker could access an affected device with administrative privileges," US-CERT said. "… Read more

US-CERT warns of SAP vulnerability

The U.S. Computer Emergency Readiness Team has warned of a vulnerability in SAP GUI, the graphical user interface client in the German company's enterprise resource-planning software.

The unspecified flaw can cause Microsoft's Internet Explorer browser to crash in an exploitable manner. The flaw lies in an ActiveX control called MDrmSap, a component of SAP GUI.

US-CERT warned in an advisory, updated on Monday, that if users are fooled into viewing a specially crafted HTML document, external attackers might be able to gain control of their system, with their privileges.

A patch is available from SAP, through SAP … Read more

Former 'cyberczar' goes corporate

On Wednesday, HBGary announced that Andy Purdy has joined their advisory board.

Purdy, while a member of the White House, co-drafted the 2003 edition of the National Strategy to Secure Cyberspace, then joined the Department of Homeland Security. There, he served on the tiger team that helped to form the National Cyber Security Division (NCSD) and the U.S. Computer Emergency Readiness Team (US-CERT). He went to head both organizations and was dubbed by the media as the "cyberczar" of the United States until DHS appointed Greg Garcia as assistant secretary for cybersecurity and communications.

In 2006, Purdy … Read more

Vulnerable to a DNS cache poisoning at home?

On Wednesday, an exploit code allowing someone to attack the domain name system (DNS) became available. No one has yet used the code, but the advice is simple: Patch. Now. While most of the burden is on the Domain Name System servers and the various systems that support them, the nature of the flaw is such that desktop clients also need to patch their software as well.

First, to determine whether your DNS system is vulnerable, use either of these tests:

Dan Kaminsky DNS Operations, Analysis, and Research Center

If the test returns a message similar to "Your name … Read more