Violet Blue

Violet Blue is the author of The Smart Girl's Guide to Privacy. She contributes to ZDNet, CNET, CBS News, and SF Appeal.

Larry Seltzer

Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years

Latest Posts

DoS Attacks Using SQL Wildcards Revealed

Yesterday, Ferruh Mavituna of Portcullis released a whitepaper entitled "DoS Attacks Using SQL Wildcards", with some  insightful comments on how it's possible to multiply the attack tactics discussed to the point where not even a botnet would be needed to successfully accomplish them.Summary of the paper :This paper discusses abusing Microsoft SQL Query wildcards to consume CPU in database servers.

May 20, 2008 by Dancho Danchev


Are you wary of the insider on the outside?

Whenever the risks from the inside threat are discussed, it's usually about the disgruntled/malicious employee within the firewall abusing permissions to steal data or plant malware in sensitive parts of the network.But, there's an insider on the outside that's often forgotten -- the ex-employee with access to user accounts (and default settings) that remain active after he/she has left the company.

May 20, 2008 by Ryan Naraine


The Storm Worm would love to infect you

The Storm Worm malware is back in the game, with its most recent campaign currently active and trying to entice users into executing iloveyou.exe by spamming them with links to already infected hosts acting as web servers, next to SQL injecting malicious domains into legitimate sites for the campaign to scale faster.

May 19, 2008 by Dancho Danchev


I'm stepping aside...

I'm becoming a contributor on Zero Day to let the experts handle our security blog.As you may have noticed, Ryan Naraine has returned to Zero Day creating what I consider a security dream team.

May 19, 2008 by


Fast-Fluxing SQL injection attacks executed from the Asprox botnet

The botnet masters behind the Asprox botnet have recently started SQL injecting fast-fluxed malicious domains in order to enjoy a decent tactical advantage in an attempt to increase the survivability of the malicious campaign. I first assessed the Asprox botnet in January, and again in April when it started scaling and diversifying its campaigns from fake Windows updates, to fake Yahoo ecards, as well as executable news items.

May 18, 2008 by Dancho Danchev


Redmond Magazine Successfully SQL Injected by Chinese Hacktivists

Irony at its best. It appears that Redmond - The Independent Voice of the Microsoft IT Community, formerly known as Microsoft Certified Professional Magazine is currently flagged as a badware site, and third-party exploit detection tools are also detecting internal pages as exploit hosting ones, in this particular case Mal/Badsrc-A.

May 16, 2008 by Dancho Danchev


McAfee's HackerSafe: "Um... we go in like a super hacker"

Updated 05/16/2008 2:00 p.m. CST: I officially have my first customer for the "Nate McFeters Safe" certification and Jeremiah Grossman and I have signed up another member for Scanless PCI, as noted security researcher Russ McRee has purchased our certifications, see http://holisticinfosec.

May 16, 2008 by Nathan McFeters


DIY phishing kits introducing new features

What are some of the main factors for the increase of phishing attacks, and their maturity from passive emails to blended threats attempting to not just steal personal information, but also infect with malware by embedding client-side vulnerabilities at the pages? It's all a matter of perspective, which in this post will emphasize on the continuing efforts on behalf of phishers to innovate, and introduce new features within the most recently obtained do-it-yourself phishing page generators.

May 15, 2008 by Dancho Danchev


Safari "Carpet Bomb" attack information released

Nitesh Dhanjani released information about some of his newest research on the Safari web browser this morning, and interestingly enough, Apple has decided NOT to fix some of the issues he presented.Dhanjani reported three issues, as follows below from his blog:1.

May 15, 2008 by Nathan McFeters