So it seems that SquirrelMail 1.4.11 and 1.4.12 were recently backdoored. Similar to some high-profile backdoors in the past, this was done by modifying the distribution tarball on rather than infiltrating the source code repository [1]. In this case, the backdoor was detected when a user noticed that the MD5 published on SquirrelMail’s website didn’t match the calculated MD5 from the SourceForge distribution.

Since the SVN repository remained intact, we can’t go back and examine the backdoor in detail. However, we do have a newsgroup posting that sheds a little light on the …

Software Security Weaknesses – Avoiding and Testing
Bob Martin is giving a talk tonight at the Boston Software Process Improvement Network (SPIN) meeting on “Software Security Weaknesses – Avoiding and Testing”. The meeting is at MITRE in Bedford in the basement conference center of M-Building (the one next to the parking garage). Pizza and discussions at 6pm, talk at 7:10pm.

Its open to anyone.

BeanSec
BeanSec, an informal gathering of security professionals, is held the 3rd Wednesday of every month in Cambridge. It will be held tomorrow night from 6pm-9pm at the Middlesex Lounge, 315 Mass. Ave, Cambridge, MA. …

George Ou has an interesting analysis of Microsoft OS vs Apple OS vulnerability counts. Anything comparing the security of these two companies becomes controversial. I think that any analysis of vulnerability counts should include a paragraph on risk vs. vulnerabilities to diffuse the Mac fanboys. I might be able to leave my backdoor safely unlocked (a vulnerability) in the suburbs of Boston in Concord, MA. I wouldn’t do the same thing in Brooklyn, NY. Same vulnerability, different threat environment. Everyone readily admits that Macs have less risk on average due to their population and user base. This …