Attention, PHP users - It appears that anyone downloading and installing an updated edition from PEAR (PHP Extension and Application Repository, a framework and distribution system for reusable PHP component) in the last half-year could have been compromised.

The administrators of the PEAR package manager website have taken the site offline, having discovered that hackers breached the site, and apparently planted malicious code into the software.

https://www.grahamcluley.com/poisoned-pear-php-extension-repository-download-infected-for-up-to-six-months/

Travel websites, how secure are they? - Dashlane’s 2018 Travel Website Password Power Rankings™ revealed that nearly 90% of sites examined “leave their users’ accounts perilously exposed to hackers due to unsafe password practices.” In addition, only a handful of these sites (just 4%) support two-factor authentication (2FA)

What can you do about it?
Dashlane offers the following (common sense) tips:

• Use a unique password for every online account
• Generate passwords that exceed eight characters
• Create passwords with a mix of case-sensitive letters, numbers, and special symbols
• Avoid using passwords that contain common phrases, slang, places, or names
• Use a password manager to help generate, store, and manage your passwords
• Never use an unsecured WiFi connection (e.g. public WiFi) while traveling

https://www.wombatsecurity.com/blog/cybersecurity-travel-tips-proactively-protect-data-and-devices

XML Vulnerability that can take down an entire website or server almost instantly.

(From the article)

Impacts the popular website platforms WordPress and Drupal.

The vulnerability uses a well-known XML Quadratic Blowup Attack — and when executed, it can take down an entire website or server almost instantly.

This is a big deal because WordPress and Drupal are used by millions of websites. The latest statistics from the World Wide Web Consortium (WC3) show WordPress alone powers nearly 23% of the web.

The XML vulnerability Goldshlager discovered affects WordPress versions 3.5 to 3.9 (the current version) and works on the default installation. It affects Drupal versions 6.x to 7.x (the latest version) and also works on the default installation.

When the vulnerability is exploited, the results can basically render a website or web server unusable. The vulnerability can cause 100% CPU and RAM usage, cause the server to become unavailable and also create a Denial of Service attack on the MySQL database program

The good news is that both WordPress and Drupal have released patches for their applications. 

The link below has more information:-

http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/

HeartBleed - One line of coding - Entire whole world immersed in misery

Interesting...........

According to the article:-

On New Year's Eve in 2011, at one minute before 11pm, a British computer consultant named Stephen Henson finished testing a new version of a popular piece of free security software. With a few keystrokes he released OpenSSL version 1.0.1 into the public domain. Now, more than two years later, the events of that night have shaken the foundations of the internet.

What Henson didn't realise when he released the new version, is that he missed a tiny bug in a new feature called Heartbeat. This feature, written by a German graduate student named Robin Seggelmann, had the best of intentions

Unfortunately, both Seggelmann and Henson missed the fact that this check can be abused to trick the listening computer into replying with up to 64 000 characters of data directly from its memory. The asking computer simply lies about the length of the word it is sending ("cat is 64 000 letters long"), and the replying computer doesn't bother to check – it just spits the data out of its memory.

And here's where it gets really ugly. That data can contain literally anything loaded into memory including passwords, email addresses and encryption keys. Instead of attacking the armoured car, the hackers now have a secret back door into the warehouse and the codes to the safe.

The link below has more information:-

http://mg.co.za/article/2014-04-14-00-openssl-the-single-line-of-code-that-broke-online-security

HEARTBLEED (bug) - Cloudflare says it is hard to steal private keys and sets up a challenge - Fedor Indutny and Illkka Mattila have succeeded.

Dan Kaminsky has a few  nice thoughts

http://dankaminsky.com/2014/04/12/bloody-cert-certified/

HeartBleed (bug) - Not just websites, extends beyond them?

More bad news 

Also, has a few slides to explain the issue.

According to the article:-

Leaked memory could give attackers hints at how to take the axe to other software, turning known bugs that are currently seen as “hard to exploit” into easy kills.

In the cloud. If you're running VMs in a cloud environment: admins must find their cloud machines and make sure their code base isn't Heartbleed vulnerable.

End-users are going to have to be trained to check certificate issue dates, to make sure that their trusted services (like the bank) have re-issued their certificates.

Thousands of “shoestring budget” VPN concentrators in smaller businesses that will be vulnerable and probably won't be updated

The link below has more information:-

http://www.theregister.co.uk/2014/04/10/many_clientside_vulns_in_heartbleed_says_sans/

Heartbleed (bug) - What is it?

Here is an article has few details

According to the article:-

A scanner was released before anyone had chance to patch it and huge sites like Yahoo! Mail were vulnerable and exposing user passwords to anyone who used Heartbleed against it.

Hashing is irrelevant in this case, as the hash and hash comparison are done on the server side, so the plain text password is stored in memory at some point

The bad part of it is that there’s no way to tell if it’s been exploited as there’s no crash, no damage, it just spits out the data to whoever runs the exploit

The link below has more information:

http://www.darknet.org.uk/2014/04/heartbleed-bug-ssl-vulnerability-everything-need-know/

INTERESTING - New Analysis called “Bag of Gaussians” (BoG) “ - can yield data from HTTPS Traffic

Researchers have found that a traffic analysis of ten HTTPS-secured Web sites yielded “personal data such as medical conditions, legal or financial affairs or sexual orientation”

Don't worry the attack isn't trivial because he attacker 

1. Should be able to visit the same Web pages as the target 
2. Should be able to capture the victim's traffic. 

The researchers used traffic analysis covering the Mayo Clinic, Planned Parenthood, Kaiser Permanente, Wells Fargo, Bank of America, Vanguard, the ACLU ,Legal Zoom, Netflix and YouTube

Good news is this attack can be mitigated,  with a padding technique they refer to as “Burst padding” 

The links below has more details:

http://www.theregister.co.uk/2014/03/06/even_https_can_leak_your_private_browsing/