This has just been posted to Bugtraq.

For now you can test if your version is vulnerable, here. (will cause Firefox to close)

So far Firefox 1.5.0.7 and 2.0 (Linux) have been tested, and both vulnerable. Firefox 1.0.7 (Win32), not vulnerable.

The code used on the test page and the one submitted to Bugtraq can be found here.

Severity: … not really

Update: This attack does not allow remote code execution! It has been posted on the mailing lists and several news sites.

CAPTCHA, acronym for “completely automated public Turing test to tell computers and humans apart” is used, most of the times at least, as an authentication mechanism. Not to prove your identity, but to do a much simpler job than that; to prove your a human.

With the bad guys always a step ahead (which is cool by me), older forms of CAPTCHA have become unsafe and easy to hack – very easy actually.

A few months ago, we saw a new implementation of this method, using cats instead of numbers. That’s a great idea. It’s much difficult for a bot and/or crawler to detect in 9 figures which ones are cats and which ones are not. However, things have taken another step forward.

Introducing, HOTCAPTCHA – literally

Proving your a human has *never* been easier – there are some really ‘bad’, to be gentle, photos there – and fun.

If the author manages to add more pictures to the database, it will be pretty secure.

Get ready for a complete month of fun with H D Moore’s Month of Browser Bugs.

Quoting from Browser Fun blog:

This blog will serve as a dumping ground for browser-based security research and vulnerability disclosure. To kick off this blog, we are announcing the Month of Browser Bugs (MoBB), where we will publish a new browser hack, every day, for the entire month of July. The hacks we publish are carefully chosen to demonstrate a concept without disclosing a direct path to remote code execution. Enjoy!

He say’s he has plenty of vulnerabilities to go around.

You can also read his post at Metasploit’s blog.

An interesting find made by John Hackenger surfaced today. For those of you familiar with MySpace, you’ll know that it uses ‘Bulletins’ to send a single message to multiple friends in your list.

Because the message is sent only to the people you have authorized to be on your list, sometimes you get a feel of safety that will make you post information that otherwise you would not want available on the Internet.

What if this information wasn’t private and could be available to everyone?

Because the messages are numeric and sequential at the URL, you can easily get information out of those bulletins.

John Hackenger explains his finding with a complete post of the information.

As you can see, he coded a little application in C to make the whole process simpler – needs some work with the syntax errors.

No, it wasn’t Microsoft.com, still, a very cool hack.

Microsoft France suffered an attack by a Turkish group, going by the handle of TiTHacK. You can check TiTHacK ‘profile’ over at Zone-H. By the looks of things, he has been really busy today.

At the time of this writing, the site still hasn’t been fixed. However, and just to be sure you’ll check it, you can use this mirror to see the defacement at Microsoft’s site.

Can we expect some new exploit to emerge?

Following Darknet post regarding SyScan’06, I decided to make a little resume of the most important security events all around the world.

Unfortunately we won’t be able to go, so all the pictures are welcome. (-:

If there’s any missing do let us know.

Recon 2006 – WWW – 16 June to 18 June 2006 – Plaza Hotel Centre-Ville, Montreal, Canada

InfoSecurity Canada 2006 – WWW – 20 June to 21 June 2006 – Metro Toronto Convention Center, Toronto, Canada

HOPE Number Six – WWW – 21 July to 23 July 2006 – Hotel Pennsylvania, New York, USA

Secure Malaysia 2006 – WWW – 24 July to 26 July 2006 – Putra World Trade Centre, Kuala Lumpur, Malaysia

The Third Conference on e-Mail and Anti-Spam – WWW – 27 July to 28 July 2006 – Mountain View, California, USA

Defcon 14 – WWW – 4 August to 6 August 2006 – Riviera Hotel & Casino, Las Vegas, USA

RuxCon 2006 – WWW – 30 September to 1 October 2006 – University of Technology, Sydney, Australia

Mobile Security – WWW – 3 October to 5 October 2006 – Crowne Plaza, St James, London, UK

Infosecurity New York 2006 – WWW – 23 October to 25 October 2006 – Jacob K. Javits Convention Center, New York, USA

You can also visit SecurityPark for a complete list of Information Security events.