ShellBot DDoS Malware Targets Linux SSH Servers

By Deeba Ahmed As per a report from AhnLab Security Emergency Response Center ASEC, poorly managed Linux SSH servers are becoming… This is a post from HackRead.com Read the original post: ShellBot DDoS Malware Targets Linux SSH Servers...

DDoS IRC Bot Malware Spreading Through Korean WebHard Platforms

An IRC Internet Relay Chat bot strain programmed in GoLang is being used to launch distributed denial-of-service DDoS attacks targeting users in Korea. "The malware is being distributed under the guise of adult games," researchers from AhnLab's Security Emergency-response Center ASEC said in a ne...

GoBotKR Targets Pirate Torrents to Build a DDoS Botnet

A botnet dubbed GoBotKR is targeting fans of Korean TV, compromising computers via pirated copies of South Korean movies, games and TV shows available via Korean and Chinese torrent sites. Ultimately, the cybercriminals are building a network that can then be used to perform DDoS attacks of vario...

Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox

This blog post was authored by Edmund Brumaghin and Holger Unterbrink with contributions from Emmanuel Tacheau. Executive Summary Cisco Talos has discovered a new malware campaign that drops the sophisticated information-stealing trojan called "Agent Tesla," and other malware such as the Loki...

CVE-2013-3947

Buffer overflow in MedCoreD.sys in AhnLab V3 Internet Security 8.0.7.5 Build 1373 allows local users to gain privileges via a crafted 0xA3350014 IOCTL call...

CVE-2013-3947

CVE-2013-3947 describes a buffer overflow in MedCoreD.sys within AhnLab V3 Internet Security 8.0.7.5 (Build 1373) that enables local privilege escalation via a crafted IOCTL call 0xA3350014. The vulnerability is triggered in the kernel-mode driver, with exploitation allowing an unprivileged user ...

AhnLab V3 Internet Security 8.0 <= 1.2.0.4 - Privilege Escalation Vulnerability

No description provided by source. AhnLab V3 Internet Security 8.0 with AhnRec2k.sys = 1.2.0.4 Local Kernel Mode Privilege Escalation Vulnerability AUTHOR MJ0011 EMAIL thdecoder $ 126.com VULNERABLE PRODUCTS AhnLab V3 Internet Security = 8.0.3.28?build 746 DETAILS: AhnRec2k.sys create a device...

Threat Outbreak Alert: Fake Software Offer Email Messages on March 3, 2014

Medium Alert ID: 33167 First Published: 2014 March 4 21:09 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an attachment for the recipient. The text in the email message attempts to convince the recipient to open the...

CVE-2 0 1 3-3 8 9 7 sample analysis study notes-vulnerability warning-the black bar safety net

Before, see FireEye on the CVE-2 0 1 3-3 8 9 3 analysis, see Use way relatively similar, the thought is the same, the analysis of learning, discovery led to the question of object is inconsistent, it does not use the ms-help load the office of hxdl structure of the ROP, and later in the BinVul on...

Kaspersky revealed "Kimsuky" Cyber Espionage campaign targeting South Korea

Russian Security Firm Kaspersky Lab has revealed that it has been following a sustained attack on South Korea by hackers seemingly based in North Korea., This new Cyber Espionage campaign dubbed "Kimsuky" has targeted several South Korean think tanks. Researchers believe the Kimsuky malware is mo...

CVE-2012-1463

The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal aka Cat QuickHeal 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158,...

CVE-2012-1443

The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal aka Cat QuickHeal 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft Anti-Malware 5.1.0....

CVE-2012-1434

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \19\04\00\10 character sequen...

CVE-2012-1436

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \2D\6C\68...

PYSEC-2012-28

The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal aka Cat QuickHeal 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158,...

Design/Logic Flaw

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \19\04\00\10 character sequen...

CVE-2012-1436

The CVE-2012-1436 entry concerns the Microsoft EXE file parser used by multiple anti-malware products: AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7. The flaw allows r...

CVE-2012-1459

CVE-2012-1459 affects multiple antivirus products including ClamAV. The issue is a vulnerability in the TAR file parser where a TAR archive entry length field could correspond to the entire entry plus part of the header of the next entry, allowing remote attackers to bypass malware detection. The...

CVE-2012-1463

The CVE-2012-1463 entry describes a vulnerability in the ELF file parsers used by multiple antivirus products (e.g., AhnLab V3 Internet Security, Bitdefender, Quick Heal, Command Antivirus, Comodo, eSafe, F-Prot, F-Secure, McAfee, Norman, nProtect, Panda). The issue is a flaw in the ELF parser re...

CVE-2012-1434

The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \19\04\00\10 character sequen...