David Kierznowski, a penetration testing expert specializing in Web application testing, has released proof-of-concept code and rigged PDF files to demonstrate how the Adobe Reader program could be used to launch attacks without any user action. "I do not really consider these attacks as vulnerabilities within Adobe. It is more exploiting features supported by the product that were never designed for this," Kierznowski said in an e-mail interview with eWEEK.

When a security researcher late last year discovered Sony was using hidden software-cloaking and monitoring techniques to protect copyrights on its music compact discs, public backlash prompted lawsuits against the company and a debate ensued about using such rootkits in commercial software.

China is stepping up its information warfare and computer network attack capabilities, according to a Defense Department report released this week.

The Chinese People’s Liberation Army (PLA) is developing information warfare reserve and militia units and has begun incorporating them into broader exercises and training. Also, China is developing the ability to launch pre-emptive attacks against enemy computer networks in a crisis, according to the document, “Annual Report to Congress: Military Power of the People’s Republic of China 2006.”

Sun has reported a vulnerability in Sun Java System Directory Server, which could give remote users administrative access to the console.

When the Directory Server is installed, the administration password is stored in "/admin-serv/config/admpw". This could allow any local or remote user to access the Directory Server console to gain access to the Directory Server with administrator rights.