1449 matches found
China's Hacking Spree Will Have a Decades-Long Fallout
Equifax. Anthem. Marriott. OPM. The data that China has amassed about US citizens will power its intelligence activities for a generation...
Docker Registries Expose Hundreds of Orgs to Malware, Data Theft
A slew of misconfigured Docker container registries has inadvertently exposed source code for 15,887 unique versions of applications owned by research institutes, retailers, news media organizations and technology companies. According to Palo Alto Networks’ Unit 42 division, the registries lacked...
[SECURITY] Fedora 31 Update: sysstat-12.3.1-1.fc31
The sysstat package contains the sar, sadf, mpstat, iostat, tapestat, pidstat, cifsiostat and sa tools for Linux. The sar command collects and reports system activity information. The information collected by sar can be saved in a file in a binary format for future inspection. The statistics...
What the continued escalation of tensions in the Middle East means for security
Cisco Talos works with many organizations around the world, monitoring and protecting against sophisticated threats every day. As such, we are watching the current state of events in the Middle East very closely for our customers and partners who may be impacted by the ongoing situation. We are...
Threat hunting in Azure Advanced Threat Protection (ATP)
As members of Microsoft’s Detection and Response Team DART, we’ve seen a significant increase in adversaries “living off the land” and using compromised account credentials for malicious purposes. From an investigation standpoint, tracking adversaries using this method is quite difficult as you...
CVE-2019-2221
In hasActivityInVisibleTask of WindowProcessController.java there’s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti...
outdoor-activities.focus.tv Cross Site Scripting vulnerability
Security Researcher devl00p Helped patch 2581 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting outdoor-activities.focus.tv website and its users...
Mail.ru: [fleet.city-mobil.ru] Driver balance increasing
Partner's account with manager role could perform fraudulent funds withdrawal via driver's account...
OPF OpenProject Activities API SQL Injection (CVE-2019-11600)
A SQL injection vulnerability has been reported in OpenProject. This vulnerability can be exploited by sending crafted HTTP requests to a vulnerable application. Successful exploitation could lead to arbitrary SQL statement execution in the security context of database service...
Threat Analysis Unit (TAU) Threat Intelligence Notification: Ramnit Banking Trojan
Ramnit Banking Trojan was first discovered in 2010 and is still evolving and staying actively as the second rank on the top banking trojan list in October 2019 as from the source post. It may be distributing via malvertising, exploit kit, spear-phishing campaign or others method to infect on the...
APT33 Mounts Focused, Highly Targeted Botnet Attacks Against U.S. Victims
The Iran-linked, espionage-focused advanced threat group known as APT33 has been spotted using more than a dozen obfuscated botnets to carry out narrowly targeted attacks against government and academic targets in the Middle East, the U.S. and Asia. Each botnet, linked to its own...
Hunting for LoLBins
By Vanja Svajcer. Introduction Attackers' trends tend to come and go. But one popular technique we're seeing at this time is the use of living-off-the-land binaries — or "LoLBins". LoLBins are used by different actors combined with fileless malware and legitimate cloud services to improve chances...
C2 With It All: From Ransomware To Carding
By Warren Mercer, Paul Rascagneres and Vitor Ventura. Summary Cisco Talos recently discovered a new server hosting a large stockpile of malicious files. Our analysis of these files shows that these attackers were able to obtain a deep level of access to victims' infrastructure — all of which...
HackerOne: latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users
Mini information disclosure related with team's internal comments/assign group activity id and datetime are exposed Steps: 1 As victim, Create a sandbox team and create report 2 Add attacker as a participant for the report 3 As victim, create some internal comments team -only comments /assign gro...
Joker's Stash Drops Largest-Ever Credit Card Cache on Dark Web
Joker’s Stash, a Dark Web destination that specializes in trading in payment-card data, has added 1.3 million credit and debit cards to its inventory, belonging to Indian banking customers. Researchers said it’s the largest stolen payment card cache ever put up for sale. According to Group-IB, th...
campusactivities.appstate.edu Open Redirect vulnerability
Open Bug Bounty ID: OBB-1000272 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Using Machine Learning to Detect IP Hijacking
This is interesting research: In a BGP hijack, a malicious actor convinces nearby networks that the best path to reach a specific IP address is through their network. That's unfortunately not very hard to do, since BGP itself doesn't have any security procedures for validating that a message is...
Quickly Extend Live Streams with VOD Clipping
Time is always of the essence to extend compelling video content such as sporting events and concerts and make the most of media rights windows. This is especially true for catch-up TV, highlight creation, time-shifting 24/7 simulcast streams, and social sharing. At Akamai, we are continually...
Astaroth Spy Trojan Uses Facebook, YouTube Profiles to Cover Tracks
Facebook and YouTube profiles are at the heart of an ongoing phishing campaign spreading the Astaroth trojan, bent on the eventual exfiltration of sensitive information. The attack is sophisticated in that it uses normally trusted sources as cover for malicious activities – thus evading usually...
In-depth exploration found in the wild iOS exploit chain a-vulnerability warning-the black bar safety net
Series Foreword Project Zero One of the tasks is the analysis of the 0-day vulnerability, we often partner with other companies to find security vulnerabilities and submit, the final goal is to promote the popular system architecture of the security improvements to help protect throughout end...