Yahoo Transparency Report Reveals More Than 12K U.S. Government Data Requests

Following the lead of Google, Twitter and other major Internet companies, Yahoo has issued its first transparency report, revealing that it received more than 12,000 requests for user data from the U.S. government in the first half of 2013. The company disclosed user content in nearly a third of...

Modsecurity Cross Site Scripting Bypass Vulnerability

Modsecurity suffers from a cross site scripting bypass vulnerability. Product: Modsecurity Author: Rafay Baloch Company: RHAINFOSEC Website: http://services.rafayhackingarticles.net Reported: 8/8/2013 Fixed: 25/8/2013 Status: Fixed ============ Introduction ============ The ModSecurity firewall i...

Try something new – Beat the BlueHat Challenge!

August 2014 Update: The BlueHat Challenge is on hold. We will make an announcement on this blog when we re-start the BlueHat Challenge. Thanks for your interest! --- We were inspired by the Matasano Crypto Challenges. So we built a similar series of fun challenges to exercise reverse engineering,...

Are you prepared for the BlueHat Challenge?

Today we are kicking off a new challenge so you can showcase your security prowess and, if we can, help you build some more. Our BlueHat Challenge is a series of computer security questions, which increase in difficulty as you progress. Only the rare and talented engineer will be able to finish t...

Design/Logic Flaw

LeftHand OS aka SAN iQ 10.5 and earlier on HP StoreVirtual Storage devices does not provide a mechanism for disabling the HP Support challenge-response root-login feature, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of an unused one-time...

Microsoft is sponsoring the Cyber Security Challenge UK

The global adoption of computing continues to draw attackers toward ever-richer targets. The latest data from the Microsoft Security Intelligence Report shows that although industry-wide vulnerability disclosures are down and computer defenses are improved, exploit activity has actually increased...

World's most secure messaging service offers £10,000 if you crack it

Privacy conscious phone users are being offered a new app that claims to be the world's first totally secure messaging service. A London-based iPhone messaging app claims to be unhackable and is offering reward to anyone who can intercept a message sent by it. Redact believes that messages sent v...

Google Patches 10 Chrome Flaws Ahead of Pwn2Own, Pwnium

Google raised the degree of difficulty for Pwn2Own and Pwnium hacking contestants by patching 10 vulnerabilities in its Web browser last night. The popular contests, which kick off tomorrow in Vancouver at the CanSecWest Conference, feature millions in prize money for researchers who can crack no...

Nmap NSE 6.01: smb-security-mode

Returns information about the SMB security level determined by SMB. Here is how to interpret the output: User-level authentication: Each user has a separate username/password that is used to log into the system. This is the default setup of pretty much everything these days. Share-level...

Windows NetLM Downgrade Attack

This module changes the system LmCompatibilityLevel registry value to enable sending LM challenge hashes and initiates a SMB connection to the host specified in the SMBHOST module option. If an SMB server is listening, it will receive the NetLM hashes for the session user. This module requires...

SCADA DNP3 server unsolicited auth challenge response function code

...

Facebook Privacy Flaw exposed two College Gay Students Accidentally

Facebook is continually changing its privacy settings, trying to give users more control over what they want to share and with whom. Two gay college students were outed on Facebook because of a privacy flaw in Facebook Groups. Users can be added to Facebook Groups by friends without the user's...

Authentication Capture: MySQL

This module provides a fake MySQL service that is designed to capture authentication credentials. It captures challenge and response pairs that can be supplied to Cain or JtR for cracking. This module requires Metasploit: https://metasploit.com/download Current source:...

Yahoo Patches Vulnerability that Led to 450,000-Password Breach

Yahoo announced today it’s fixed the security hole that allowed a hacker group this week to post some 450,000 email addresses and passwords belonging to freelance writers. “We have taken swift action and have now fixed this vulnerability, deployed additional security measures for affected Yahoo!...

SA-CONTRIB-2012-111 - Security Questions - Access Bypass

This module provides administrator configurable challenge questions for use during the log in and password reset processes. The module doesn't perform a proper access check, allowing a users' questions and answers to be edited by other users including anonymous users. CVE: CVE-2012-4475 Versions...

Australia's first national cyber security competition Announced

Australia's first national cyber security competition Announced Australia's first national cyber security competition, the 2012 Cyber Defence University Challenge, was launched today by broadband minister Senator Stephen Conroy. If you are an undergraduate with top cyber problem-solving skills th...

VNC Authentication Scanner

This module will test a VNC server on a range of machines and report successful logins. Currently it supports RFB protocol version 3.3, 3.7, 3.8 and 4.001 using the VNC challenge response authentication method. This module requires Metasploit: https://metasploit.com/download Current source:...

Combination of Eyes and Algorithms Wins $50K Prize In DARPA's Shredder Challenge

Scientists for the Pentagon’s far-out research branch, DARPA, weren’t sure that anyone would be able to collect the $50,000 prize when they announced their Shredder Challenge to find ways to reassemble shredded documents just over a month ago. This week – just 33 days later – they had a winner...

OpenSSH 'sshd' Challenge Response Authentication Buffer Overflow Vulnerability

The host is running OpenSSH sshd with ChallengeResponseAuthentication enabled and is prone to buffer overflow vulnerability. OpenVAS Vulnerability Test $Id: gbsshdchallengerespauthenticationbofvuln.nasl 7015 2017-08-28 11:51:24Z teissa $ OpenSSH 'sshd' Challenge Response Authentication Buffer...

OpenSSH 'sshd' Challenge Response Authentication Buffer Overflow Vulnerability

OpenSSH sshd with ChallengeResponseAuthentication enabled is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...