Distributed Denial Of Service (DDoS)

botkit is vulnerable to distributed denial of service DDoS attacks. These attacks are possible because it does not validate the X-HUB signature sent in the headers against the facebook app secret. This allows attackers to send arrays with a large amount of data in them to botkit and lock the...

Four New Normals for 2017

Let’s not talk about cybersecurity predictions for 2017. Let’s talk instead about new normals, things that have ceased to be novel because, well, they happen all the time and everywhere. Let’s concede that things such as greedy ransomware, imposing IOT botnets, high-profile bug bounties and...

Hackers threaten to take down Xbox Live and PSN on Christmas Day

Bad news for gamers! It's once again the time when most of you will get new PlayStations and XBoxes that continue to be among the most popular gifts for Christmas, but possibilities are you'll not be able to log into the online gaming console, just like what happens on every Christmas holidays. O...

FreeBSD -- Multiple vulnerabilities of ntp

Problem Description: Multiple vulnerabilities have been discovered in the NTP suite: CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-742...

SUSE-SU-2016:3195-1 Security update for ntp

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed: - CVE-2016-9311, CVE-2016-9310, bsc1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428,...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

On Yahoo's One Billion Breach, a DDoS-For-Hire Crackdown and More

Mike Mimoso and Chris Brook discuss the news of the week including Yahoo’s latest breach announcement, a DDoS-for-hire crackdown, hackers seeking help with Mirai, and some new Adobe patches. Show notes: Yahoo Discloses Data From 1 Billion Accounts Stolen in 2013 Beta Firmware Updates Available fo...

Mirai Giving DDoS-as-a-Service Industry a Boost

The availability of the Mirai malware source code online isn’t a guarantee that just anyone can quickly convert it into a money-making IoT-based DDoS botnet. Researchers at Digital Shadows have been combing dark web sites such as the Hackforums where black hat Anna-Senpai dropped the Mirai code i...

Law Enforcement Targets Users of DDoS-For-Hire Services

Law enforcement authorities from more than a dozen countries last week carried out a series of operations designed to crack down on DDoS-for-hire services. Thirty four individuals who are alleged to have purchased stressers and booter services were arrested as part of the operation. Stressers and...

Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Vulnerabilities

Exploit for macOS platform in category dos / poc Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Credit: Maksymilian Arciemowicz https://cxsecurity.com/ --- 0. Description ---- The latest macOS and iOS have weak OCSP validation process which allow attacker to send OCSP...

Europol arrests 34 Teenagers for using DDoS Attack Tools

Europol has announced that the law enforcement agencies from 13 countries around the globe have arrested 34 users of Netspoof DDoS attack tool and interviewed and warned 101 suspects in a global crackdown. According to the report published on the official website of Europol, law enforcement...

On Backdoors in Sony's IP Cameras, a Linux Bug, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest Linux bug, Sony closing backdoors in cameras, and Google’s new open source fuzzer. Show notes: Sony Closes Backdoors in IP-Enabled Cameras Old Linux Kernel Code Execution Bug Patched Google Debuts Continuous Fuzzer for...

New Call to Regulate IoT Security By Design

A Washington, D.C. think tank whose mission is critical infrastructure security has joined the call for lawmakers to consider regulating the security of connected devices. In a report published this week, the Institute for Critical Infrastructure Technology pinned the blame for a rash of Mirai...

Updated ntp packages fix security vulnerabilities

When ntpd is configured with rate limiting for all associations restrict default limited in ntp.conf, the limits are applied also to responses received from its configured sources. An attacker who knows the sources e.g., from an IPv4 refid in server response and knows the system is misconfigured ...

Turkish Hackers Are Giving Away Prizes For Participating In DDoS Attacks

DDoS has become a game now that could knock any service offline. A Turkish hacking group is encouraging individuals to join its DDoS-for-Points platform that features points and prizes for carrying out distributed denial-of-service DDoS attacks against a list of predetermined targets. The points...

Hackers Gamifies DDoS Attacks With Collaborative Platform

A Turkish hacking crew is luring participants to join its DDoS platform to compete with peers to earn redeemable points that are exchangeable for hacking tools and click-fraud software. The goal, security researchers say, is to “gamify” DDoS attacks in order to attract a critical mass of hackers...

New Large-Scale DDoS Attacks Follow Schedule

A powerful new botnet is being blamed for massive and sustained DDoS attacks that security researchers at CloudFlare compare to Mirai when it comes to intensity and scope. The attacks began Nov. 23 and ran for eight hours daily, similar to an average workday. The consistent attacks occurred for...

New Mirai Variant Targets Routers, Knocks 900,000 Offline

Attackers are targeting DSL routers this week with what’s being called a potent new variant of the Mirai malware that knocked offline major Internet companies like Twitter and Spotify last month. According to Germany’s Deutsche Telekom 900,000 of its DSL router customers have already been targete...

Antivirus Firm Kaspersky launches Its Own Secure Operating System

The popular cyber security and antivirus company Kaspersky has unveiled its new hack-proof operating system: Kaspersky OS. The new operating system has been in development for last 14 years and has chosen to design from scratch rather than relying on Linux. Kaspersky OS makes its debut on a...

NTP DoS Exploit Released — Update Your Servers to Patch 10 Flaws

A proof-of-concept PoC exploit for a critical vulnerability in the Network Time Protocol daemon ntpd has been publically released that could allow anyone to crash a server with just a single maliciously crafted packet. The vulnerability has been patched by the Network Time Foundation with the...