Greetings everyone,

Life in the Information Security world is rarely dull, not even at the end the week.

The fun this week has among other things, graced us with a zero day vulnerability having it's way with the Windows kernel on behalf of malware called Duqu. The Windows zero day is a flaw in the processing of embedded True Type Fonts, with Microsoft quickly providing some Workarounds, with a patch on it's way.

What's even more interesting is the spiffy malware using this zero day; Duqu. It shares code with the now famous and infamous stuxnet.

So who brought Duqu into being, and what is their intent?

This week has also provided a public exploit for a serious flaw in a collection of NJStar products. NJStar Communicator being one of these products, is a popular Asian language translation application for Windows, frequently used in Academia and on the laptops of visiting Staff and Students. The MiniSmtp server included with some NJStar products is the source of a vulnerability that allows 'friendly' people you've never met to provide un-requested system administration services on your host without so much as a 'by your leave'.

Have a peaceful weekend,

Marco