More Answers, Less Query Language: Bringing Visual Search to InsightIDR

Sitting down with your data lake and asking it questions has never been easy. In the infosec world, there are additional layers of complexity. Users are bouncing between assets, services, and geographical locations, with each monitoring silo producing its own log files and slivers of the complete...

“The 101” – Episode 6 – Why is Malware Still Successful?

We’re back with another episode of The 101! This weekly security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. In the past few episodes we’ve spoken about the...

strongswan: Index-out-of-bounds in traffic_selector_create_from_rfcNUMBER_format

Project: https://github.com/strongswan/strongswan.git Detailed report: https://oss-fuzz.com/testcase?key=6094496901103616 Project: strongswan Fuzzer: libFuzzerstrongswanfuzzcerts Fuzz target binary: fuzzcerts Job Type: libfuzzerubsanstrongswan Platform Id: linux Crash Type: Index-out-of-bounds...

Behavior of VM.xenstore_data

Summary This article describes the behavior ofVM.xenstoredata. This behavior might affect customers who use thexenstore-data parameter of a Virtual Machine VM, especially those customers who are writing software that interacts with XenServer and uses this parameter. Behavior of VM.xenstoredata If...

SMBLoris Denial Of Service

There's a lot of talk about SMBLoris but nobody seems to have written a public efficient PoC yet, so I gave it a shot. A single instance takes down a fully patched Windows 10 Pro box with 8GiB of RAM in less than 10 seconds. I tried using Scapy initially, but it's dog slow, so I went with C. The...

CVE-2016-9717

HTTP Parameter Override is identified in the IBM Infosphere Master Data Management MDM 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploite...

CVE-2016-9717

HTTP Parameter Override is identified in the IBM Infosphere Master Data Management MDM 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploite...

CVE-2016-9717: Improper Input Validation

HTTP Parameter Override is identified in the IBM Infosphere Master Data Management MDM 10.1. 11.0. 11.3, 11.4, 11.5, and 11.6 product. It enables attackers by exposing the presence of duplicated parameters which may produce an anomalous behavior in the application that can be potentially exploite...

ShadowBrokers Remain an Enigma

LAS VEGAS—Clarity and the ShadowBrokers are strange bedfellows. We’re closing in on the first anniversary of the mysterious group’s initial dump of NSA hacking tools and we’re still no closer to understanding who they are, where they got their stuff, and what their true motivations are. Instead a...

Amazon Linux AMI : java-1.8.0-openjdk (ALAS-2017-860)

Incorrect enforcement of certificate path restrictions : It was discovered that the Security component of OpenJDK could fail to properly enforce restrictions defined for processing of X.509 certificate chains. A remote attacker could possibly use this flaw to make Java accept certificate using on...

MGASA-2017-0216 Updated irssi packages fix security vulnerabilities

A malicious server could cause irssi to crash by providing an invalid timestamp CVE-2017-10965. Undefined behavior may be triggered when irssi updates the internal nick list CVE-2017-10966...

Updated irssi packages fix security vulnerabilities

A malicious server could cause irssi to crash by providing an invalid timestamp CVE-2017-10965. Undefined behavior may be triggered when irssi updates the internal nick list CVE-2017-10966...

CVE-2017-2605

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000362. Reason: This candidate is a duplicate of CVE-2017-1000362. A vendor reference identifier was mistakenly treated as a CVE ID. Notes: All CVE users should reference CVE-2017-1000362 instead of this candidate. All...

Frans Visits Vegas: Frans Visits Vegas Announcement

Hey hackers and soon to be hackers! F204937 I will be doing a webinar for 1 hour at 21:00pm PDT Wednesday the 26th, the night before DEFCON and h1-702 2017. The idea is to share knowledge on how to win over security teams and gain influence as a hacker. I will cover the following topics: How I go...

Application launch using Anonymous user account resets the Session Limit Timer to 10

While launching an application for unauthenticated/Anonymous user, the idle tab for the Anon account might default back to 10 minutes even after manually setting it to some other value. The following steps can be followed to test the behavior: From a VDA running 7.9 or higher, run the below .exe ...

Windows Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware

For cybercriminals, speed is the name of the game. It takes newly released malware an average of just four hours to achieve its goal—steal financial information, extort money, or cause widespread damage. In a recent report, the Federal Trade Commission FTC said that cybercriminals will use hacked...

Fedora 26 : mingw-libtasn1 (2017-d5cf1a55ce)

Noteworthy changes in release 4.11 released 2017-05-27 stable - Introduced the ASN1TIMEENCODINGERROR error code to indicate an invalid encoding in the DER time fields. - Introduced flag ASN1DECODEFLAGALLOWINCORRECTTIME. This flag allows decoding errors in time fields even when in strict DER mode...

krb5 -- Multiple vulnerabilities

MIT reports: CVE-2017-11368: In MIT krb5 1.7 and later, an authenticated attacker can cause an assertion failure in krb5kdc by sending an invalid S4U2Self or S4U2Proxy request. CVE-2017-11462: RFC 2744 permits a GSS-API implementation to delete an existing security context on a second or subseque...

Tomato-Plant Security

I have a soft spot for interesting biological security measures, especially by plants. I've used them as examples in several of my books. Here's a new one: when tomato plants are attacked by caterpillars, they release a chemical that turns the caterpillars on each other: It's common for...

Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation Dynamic Network Analysis Tool

Introduction In 2016, FLARE introduced FakeNet-NG, an open-source network analysis tool written in Python. FakeNet-NG allows security analysts to observe and interact with network applications using standard or custom protocols on a single Windows host, which is especially useful for malware...