DHS Daily Open Source Infrastructure Report

Daily Report Friday, November 24, 2006

Daily Highlights

In the first nuclear−related evacuation since the Three Mile Island accident of 1979, a Tennessee school district sent all 1,800 pupils home on Tuesday morning, November 21, because operators at a nearby nuclear reactor believed they might have had a leak of radioactive cooling water inside the plant. (See item 2)
·
The Associated Press reports a chemical plant near Boston exploded early Wednesday, November 22, sparking a massive fire and blowing debris for blocks that damaged nearly 90 homes but caused only minor injuries. (See item 5)
·
The Department of Homeland Security and the Department of State have announced the official requirement for citizens of the United States, Canada, Mexico, and Bermuda to present a passport to enter the United States when arriving by air from any part of the Western Hemisphere beginning January 23, 2007. (See item 16)
·
WHO−TV reports nearly 1,000 Iowans have gotten ill in the last several weeks due to norovirus, which has occurred in a wide variety of settings such as social receptions, long−term care facilities, a gaming facility, business functions, restaurants, and schools (See item 27)

Information Technology and Telecommunications Sector

34. November 22, eWeek — Exploit code published for Apple OS X glitch. Researchers have published exploit code that targets an unpatched kernel vulnerability in Apple's OS X desktop software. An independent vulnerability analyst working as part of the "Month of Kernel Bugs" campaign released the details necessary to attack the hole in OS X on Wednesday, November 22, revealing the manner in which hackers could target the glitch, which affects the way Apple's software handles disk image files. The researcher, identified only by the screen name "LMH," issued the exploit via a post on the Kernel Fun Website. "Mac OS X fails to properly handle corrupted image structures, leading to an exploitable denial−of−service condition," LMH wrote in his latest blog. "Although it hasn't been checked further, memory corruption is present under certain conditions." The researcher said that the demonstration exploit offered on the site would be unlikely to allow arbitrary code execution if applied by attackers, however, the analyst indicated that the flaw could be taken advantage of by malware writers by targeting the manner in which Cupertino, CA−based Apple's Safari browser downloads online image files.
Source: http://www.eweek.com/article2/0,1895,2062806,00.asp

35. November 22, IDG News Service — Thieves steal chips worth millions. A gang of thieves stole computer chips reportedly worth millions of U.S. dollars in a Monday, November 20, raid on the Penang International Airport Free Commercial Zone in Batu Muang, Malaysia. Malaysian police are investigating the theft. The gang of 20 thieves subdued 17 security guards using weapons and chloroform before stealing 585 cartons and 18 pallets of microchips and motherboards manufactured by a multinational company in Bayan Lepas, Malaysia. The stolen goods were estimated to be worth $12.7 million, making the theft the largest ever in Malaysia. Source: http://www.infoworld.com/article/06/11/22/HNchipthieves_1.ht ml

36. November 22, CNET News — Firefox, IE vulnerable to fake login pages. Mozilla's Firefox 2 and Microsoft's Internet Explorer 7 are vulnerable to a flaw that could allow attackers to steal passwords. Dubbed a reverse cross−site request, or RCSR, vulnerability by its discoverer, Robert Chapin, the flaw lets hackers compromise users' passwords and usernames by presenting them with a fake login form. Firefox Password Manager will automatically enter any saved passwords and usernames into the form. The data is then automatically sent to an attacker's computer without the user's knowledge, according to the Chapin Information Services site. An exploit for this flaw has already been seen on social−networking site MySpace.com, and it could affect anyone using a blog or forum that allows user−generated HTML code to be added, according to Chapin. According to Chapin, an RCSR attack is much more likely to succeed than a cross−site scripting attack because neither Internet Explorer nor Firefox is designed to check the destination of form data before the user submits them. The browser doesn't sound an alarm because the exploit is conducted at the trusted Website.
Source: http://news.com.com/Firefox%2C+IE+vulnerable+to+fake+login+pages/2100−1002_3−6137844.html?tag=nefd.top