Adobe Flash patches 17 remote code execution vulnerabilities

Adobe Flash version 19.0.0.245 was released today. This version patches 17 remote code execution vulnerabilities if exploited [see here]. Adobe said that there are no reports of public exploits for any of the patched flaws.

In addition to the desktop version of Flash for Windows and Mac OS X, Adobe also updated Flash for Internet Explorer 11 and Microsoft Edge, both of which are expected to be included in today’s Microsoft Patch Tuesday security bulletins. Adobe also updated Flash Player for Linux and various Adobe Air products for Windows, iOS and Android mobile devices. 

To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page, or right-click on content running in Flash Player and select "About Adobe (or Macromedia) Flash Player" from the menu. To verify the version of Adobe AIR installed on your system, follow the instructions in the Adobe AIR TechNote. 

For those of us using multiple browsers, perform the check for each browser you have installed on your system. The Flash updated packages can be found here.

CVE numbers: CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7659, CVE-2015-7660, CVE-2015-7661, CVE-2015-7662, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, CVE-2015-8046

During last month’s scheduled update, Adobe patched Flash and Acrobat Reader addressing 69 critical vulnerabilities that could lead to code execution and information disclosure. Just three days later, Adobe updated Flash once again with an emergency patch that addressed a zero-day type confusion* vulnerability. The zero-day was being exploited by a Russian-speaking APT group during Operation Pawn Storm.

*Type confusion vulnerabilities occur when the code doesn't verify the type of object that is passed to it, and uses it without type-checking. 

October’s Cyber Aftermath, CyberSecurity Awareness Month

October is known as being the Cyber Security Awareness Month. Many campaigns especially during October are trying to teach and raise the awareness about Cyber Security. Public and private initiatives especially during this month, are trying to raise the awareness further on online security and safety. 

Unfortunately there are still many steps that need to be made towards awareness and Cyber Security. Businesses and individuals are still affected by cyber-attacks and security breaches. The discovery and investigation of a breach can be a very time-consuming process and this is the main reason it takes so long to be reported.

Even though patches and updates are available for most security vulnerabilities as soon as they are discovered, new threats and zero days (0day) are constantly surface and exploited. 

During this month a number of security breaches, cyber-attacks and vulnerabilities were announced. Let's see this month's aftermath...

CyberSecurity Strategy and Essentials

Cybersecurity becomes even more complicated in the context of today’s threat landscape, which is not only constantly changing, but is also expanding at an increasingly fast rate. This is the most problematic element of Cybersecurity; its evolution is so fast and unpredictable while the nature of the risks involved are constantly changing.

Managing security by diverting resources to the most crucial system components in order to reduce the likelihood of a successful breach, is now considered to be an insufficient approach in the current environment of advanced cyber threats. Threats are changing faster than traditional risk management approaches can deal with, and a more proactive, focused and adaptive approach is needed to manage an effective Cybersecurity strategy.

Good security management is a continuous effort with preparation, readiness, and good planning being the best approach. To achieve this, there are some basic best practices that can be considered essential to organisations that need to protect their assets from the most common and opportunistic cyber-attacks.

Security BSides Athens 2016, Greece

I am happy to announce that I am involved in organising Security BSides Athens 2016, in Greece. More information you will find at the BSides Athens website www.bsidesath.gr (currently under construction).

Most of the information about the status of the event can be also found at the official Security BSides wiki page in the following URL: goo.gl/pseoow

The 1st ever BSides Athens conference is scheduled to take place on Saturday, 25 June 2016. The entrance to the event will be free of charge, but attendees will need to book a ticket online in advance, when these are made available (we expect them to become available around March 2016). 

Please follow us on Twitter @BSidesAth and send us a message if you would like to sponsor, support, volunteer or just give us a hand on the day. 

Please use hashtags #BSidesAth #BSidesAthens when talking about BSides Athens on social platforms (i.e. Twitter) and spread the word! Even though Twitter is our main form of communication for reaching out to you, and for you to reach us, there is also an official BSides Athens group on Facebook and one group on Linkedin. 

CFP (Call for Presenters) is scheduled to open on Monday, 30 November 2015 and it will close in March 2016. 

• An Android mobile application is available on Play Store for BSides Athens.
  https://play.google.com/store/apps/details?id=dimism.bsidesathens
• An iOS mobile application is available on App Store.
  https://itunes.apple.com/us/app/bsidesath/id1057022307

The mobile applications allows you to find information about the conference on the spot, have real-time access to the track schedule and directions on how to the get to the venue. So, for this event #goPaperless by downloading the mobile application suitable for your phone and tablet!

In the following links you can find the Security BSides Athens 2016 logo in different dimensions and use it freely to promote the event on your webpage and/or social media. 

• 500 pixels: http://www.bsidesath.gr/logo/BSidesAth_logo01.jpg
• 250 pixels: http://www.bsidesath.gr/logo/BSidesAth_logo01_250x250.jpg
• 200 pixels: http://www.bsidesath.gr/logo/BSidesAth_logo01_200.jpg
• 150 pixels: http://www.bsidesath.gr/logo/BSidesAth_logo01_150x150.jpg
• 50 pixels: http://www.bsidesath.gr/logo/BSidesAth_logo01_50.jpg

Visit www.bsidesath.gr and stay tuned for more to come!

Secure a Sapce ?

This is one of the biggest fails ever! How can you misspell your own URL on the tickets you are issuing and more importantly, in the section where you actually ask people to visit that non-existent misspelled URL and pay a parking fine?! Yes, they did! This is not a hoax!

Lets look at the ticket. The parking fine has instructions on how to pay it online. There is a header which says: HOW TO MAKE A PAYMENT. Below that you will see the name of the company and its postal address. However, you will notice that they have misspelled their own URL!