XcodeGhost iOS App Malware Contained

Concern over the so-called XcodeGhost malware has put the security of Apple’s App Store on the front page. While the App Store was not hacked, attackers did manage to append malicious code to a number of popular apps—most of those developed in China—and find a loophole in Apple’s code-scanning to...

Apple iOS Webkit Memory Corruption Vulnerability (CNVD-2015-06181)

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A memory corruption vulnerability exists in Webkit used by Apple iOS, which allows attackers to construct a malicious web page and trick users into parsing it, which could crash the application or execute...

Threat Outbreak Alert RuleID17973: Email Messages Distributing Malicious Software on September 14, 2015

Medium Alert ID: 40992 First Published: 2015 September 15 13:40 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID17973 may contain the following files: Name ...

SQL Injection Vulnerability in China Haida's WEB Management System

Guangzhou Zhonghaida Satellite Navigation Technology Co., Ltd. is the first listed company in the field of domestic mapping and geographic information equipment. A SQL injection vulnerability exists in China Haida's WEB management system. An attacker can utilize the vulnerability to obtain...

ASERT Threat Intelligence Report 2015-05 PlugX Threat Activity in Myanmar-vulnerability warning-the black bar safety net

0x01 summary Myanmar is currently one engaged in important political activity of the country. 2 0 1 1 years of democratic reform is to help the government create a conducive to attract investors to the atmosphere. The country is rich in resources, has a variety of Natural Resources and stable...

After 5 Years, Now Google Ready to Comply with China's Censorship Laws for Business

Google is planning to introduce a trimmed down special version of Google Play Store and Android Wear to The Mainland China. But wait, if I’m not wrong… Google had ended ties with China five years ago. Then what made Google to re-establish itself in China once again? Business?? Recent reports by...

China Police Arrest 15,000 Suspects for Alleged Cyber Crimes

China Police has arrested nearly 15,000 people on suspicion of cyber crimes as part of an operation dubbed "Cleaning the Internet," according to reports. According to the Chinese Ministry of Public Security MPS, the suspects have been arrested for their involvement in cyber crimes that "jeopardiz...

made-in-china.com XSS vulnerability

Vulnerable URL: http://www.made-in-china.com/aboutus/contact/ Details: Description| Value ---|--- Patched:| Yes, at 25.09.2015 Latest check for patch:| 25.09.2015 12:13 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2339 Google Pagerank| 6 VIP website status:|...

Dennis Fisher and Mike Mimoso Discuss the Week in News: Chinese Sanctions, Doing Away with RC4, and Mobile Pwn2Own

Dennis Fisher and Mike Mimoso talk about the potential US sanctions against China over cyberespionage, the browser vendors dumping RC4, the trouble at Mobile Pwn2Own and more security news of the week. Download: digitalunderground218.mp3 Music by Chris Gonsalves...

Generalized SQL Injection Vulnerability in CMS System of China's Government and Enterprise Network (GEN)

China government and enterprise network is a network platform for enterprises and institutions to provide Internet marketing consultants. A generic SQL injection vulnerability exists in the CMS system of China Government and Enterprise Network. The vulnerability parameter is key, the attacker can...

U.S. Prepping Sanctions Against China Over Cyberattacks

The U.S. government is purportedly readying economic sanctions against China and is prepared to call out several Chinese companies and individuals for committing cyber espionage. It’s not exactly clear when the Obama administration will levy the sanctions, but according to an article from Sunday’...

泛微某系统存在通用型注入（以官网和中国移动为例）

简要描述： 唉，据说都不关注它了？ 详细说明： 以官网系统为例 首先我们看看登陆的时候的返回值 http://.../login.do?message=102&verify= http://.../login.do?message=103&verify= 那么现在我们可以抓包开始注入了 构造好万能登陆句子，成功登陆后台。。 MD5密码解出来为1 https://images.seebug.org/upload/201508/251408519374f80cad29bf6f64db873598ae86e0.png img src="https://images.seebug.or...

GitHub Again Hit by DDoS Cyberattack

Github – the popular code sharing website used by programmers to collaborate on software development – again became a victim of a distributed-denial-of-service DDoS attack on Tuesday morning. The attack came just a few months after the popular code repository website GitHub suffered a massive DDo...

Github Mitigates DDoS Attack

Code repository Github mitigated a distributed denial-of-service attack, restoring services this morning around 9 a.m. Eastern time. According to a Github status log, connectivity problems began today around 5:30 a.m. with Github declaring it was under a DDoS attack an hour later. A request for...

Elasticsearch Logstash Security Bypass Vulnerability (CNVD-2015-05626)

Elasticsearch Logstash is a set of log analysis and monitoring tools from Elasticsearch Netherlands. The tool provides functions such as search, processing and management of logs or events. A security bypass vulnerability exists in Elasticsearch Logstash. An attacker can exploit this vulnerabilit...

China Telecom's Wing Pay App Has Multiple Vulnerabilities

Wing Pay is the business brand of China Telecom that operates payment and internet finance. Wing Pay APP 3.9.6 has multiple security vulnerabilities, including: global file read/write vulnerability; configuration file read/write vulnerability; trust arbitrary security certificate vulnerability;...

United Airlines Hacked by Sophisticated Hacking Group

A group of China-backed hackers believed to be responsible for high-profile data breaches, including the U.S. Office of Personnel Management and the insurance giant Anthem, has now hit another high-profile target – United Airlines. United detected a cyber attack into its computer systems in May o...

TotoLink Routers Plagued By Serious RCE, XSS, CSRF Vulnerabilities

A slew of routers manufactured in China are fraught with vulnerabilities, some which have existed in products for as long as six years. Nearly 20 different routers made by the electronics company TotoLink contain multiple remote code execution bugs, suffer from XSS and CSRF vulnerabilities, and...

ZTE SOHO ROUTER WEB_SHELL_CMD.GCH 远程命令执行

1、漏洞概要2014 年 3 月 3 日，Rapid7 团队发布了中兴 F460 / F660 后门信息1，任何可以访问设备的用户都可以直接访问一个命令执行的 Web 界面，以 root 权限执行任意命令。上述设备在中国境内被广泛应用，俗称“电信光猫”。2.1漏洞描述ZTE 生产的 SOHO Router 的一些型号中，Web 根目录（/home/httpd ）下存在 /webshellcmd.gch 文件，没有任何访问控制，可以直接执行任意系统命令。以下几点值得注意：Rapid7 于 2014 年 3 月 3 日公布此漏洞，但是根据搜索结果，此问题早在 2012...

SQL Injection Vulnerability in the Key Parameters of Investment Project Filing System of Zhongshan Netizen Software Co.

Zhongshan City, the net government software limited company investment project filing system is based on modern network technology and database technology to achieve an online e-government system. There is a SQL injection vulnerability in the key parameter of the Investment Project Filing...