Snort 2.4 was officially released today. You can read about additions, improvements and related stuff in the release notes.

I'll surely get back to this in the future..

There has been an absence of posts lately, mainly due to the extremely cloud-free sky, extra chilled beers and just plain lazyness. This is however over now, as the past week here in Stockholm has been terribly rainy and cold, which however doesn't surprise me at all.. This will hopefully give me some more time, and motivation, to keep on posting my thoughts about various security-related issues.

You might know that this year's Black Hat Briefings conference is taking place in Las Vegas. There is actually a bunch of drama going on there, after a supposed vulnerability in Cisco Systems operatingsystem IOS was presented at a speach. Cisco were informed about the vulnerability some weeks ago, and demanded that the flaws weren't presented at BlackHat. Cisco and ISS, the employer of researcher who found and yesterday actually presented the flaw, agreed ot cancel the speach. The researcher made a last minute turn, resigned his job at ISS, and presented the flaws. Drama, to say the least. There are lawers and stuff involved in this now.. :)

Some information on the actuall flaw:

According to Lynn, flaws in IOS could allow attackers to use "heap overflows" to crash Cisco routers running IOS by sending chunks of data to Cisco devices running IOS that overwrite memory.

In order to get the overflows to work, Lynn manipulated IOS to disable a process called "check heap," which is designed to detect such irregularities, and used an older exploit, known as an "uncontrolled pointer exchange," to trick vulnerable Cisco devices into running attack code.

The technique developed by Lynn would give remote attackers access to the IOS "shell," from which the attacker could control the device.

Here is an great article about the events in the "BlackHat soap opera". I guess we haven't heard the last of this..

update: Both Slashdot and SecurityFocus has coverage of this now.. haven't read their articles yet, so I don't know if they have anything new to report.