Scan your exposure to domain and subdomain hijacking over 10's of cloud providers

Domain Hijacking is a well-known security issue that can be carried in many different ways. In addition to social engineering or unauthorized access to the domain owner’s account, the exploitation of neglected DNS records configured for cloud services is increasingly common. In the latter case, a...

Identify Misconfigured CloudFront Domains: CloudFrunt

CloudFrunt is a tool for identifying misconfigured CloudFront domains. CloudFront is a Content Delivery Network CDN provided by Amazon Web Services AWS. CloudFront users create “distributions” that serve content from specific sources an S3 bucket, for example. Each CloudFront distribution has a...

rubygems: DNS hijacking vulnerability

A vulnerability was found where rubygems did not sanitize DNS responses when requesting the hostname of the rubygems server for a domain, via a rubygems.tcp DNS SRV query. An attacker with the ability to manipulate DNS responses could direct the gem command towards a different domain...

The vulnerability of the Omnibox implementation in Google Chrome, related to insufficient validation of input data, allows a hacker to perform domain hijacking.

The vulnerability of the Omnibox browser implementation by Google Chrome is related to insufficient validation of entered data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to replace a domain name using a specially crafted domain name...

Dell Lost Control of Key Customer Support Domain for a Month in 2017

A Web site set up by PC maker Dell Inc. to help customers recover from malicious software and other computer maladies may have been hijacked for a few weeks this summer by people who specialize in deploying said malware, KrebsOnSecurity has learned. There is a program installed on virtually all...

SSL Certificate Not Validated Vulnerability in OnStar IOS Client

OnStar iOS client is a smart driving system. An SSL certificate not verified vulnerability exists in AnjiStar IOS client. Since the AngelStar IOS client uses SSL HTTPS communication with the server, the security processing method is to do the verification of the server certificate before the...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2017:2589-1)

This update for MozillaFirefox to ESR 52.3 fixes several issues. These security issues were fixed : - CVE-2017-7807 Domain hijacking through AppCache fallback bsc1052829 - CVE-2017-7791 Spoofing following page navigation with data: protocol and modal alerts bsc1052829 - CVE-2017-7792 Buffer...

SUSE-SU-2017:2589-1 Security update for MozillaFirefox

This update for MozillaFirefox to ESR 52.3 fixes several issues. These security issues were fixed: - CVE-2017-7807 Domain hijacking through AppCache fallback bsc1052829 - CVE-2017-7791 Spoofing following page navigation with data: protocol and modal alerts bsc1052829 - CVE-2017-7792 Buffer overfl...

eNom Inter-Account Transfer Issue

the m group security advisory 2017090100: Zero-confirmation inter-account transfers of .uk domains with eNom Discovery date: 2017-05-02 Publish date: 2017-09-01 +122 days Product: https://www.enom.com/, the website for eNom Inc. and their APIs, all eNom resellers Vulnerable: yes, as of publicatio...

SUSE-SU-2017:2302-1 Security update for MozillaFirefox

Mozilla Firefox was updated to the ESR 52.3 release bsc1052829 Following security issues were fixed: MFSA 2017-19/CVE-2017-7807: Domain hijacking through AppCache fallback MFSA 2017-19/CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts MFSA 2017-19/CVE-2017-779...

Mozilla: Domain hijacking through appcache fallback (MFSA 2017-19)

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

openSUSE Security Update : MozillaThunderbird (openSUSE-2017-955)

This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed : - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with...

Security update for MozillaThunderbird (important)

This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with marqu...

Security update for MozillaFirefox (important)

This update to Mozilla Firefox 52.3esr fixes a number of security issues. The following vulnerabilities were advised upstream under MFSA 2017-19 boo1052829: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection -...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2017:2151-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Mozilla Firefox and Firefox ESR Domain Hijacking Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A domain hijacking vulnerability exists in Mozilla Firefox versions prior to 55 and Firefox ESR...

Security fix for the ALT Linux 10 package firefox-esr version 52.3.0-alt1

Aug. 8, 2017 Andrey Cherepanov 52.3.0-alt1 - New ESR version 52.3.0 - Security fixes: + CVE-2017-7798: XUL injection in the style editor in devtools + CVE-2017-7800: Use-after-free in WebSockets during disconnection + CVE-2017-7801: Use-after-free with marquee during window resizing +...

A week in security (July 10 – July 16)

Last week, we took a look at some of your malware infection stories, took a stroll through the basics of PowerShell, explored a piece of .NET malware, and shone the spotlight on the Petya ransomware family. Elsewhere, the following stories were taking place: Latest updates for Consumers...

The vulnerability of Google Chrome allows a violator to perform domain substitution.

The vulnerability of Google Chrome relates to the improper processing of Unicode characters. Exploiting this vulnerability allows a malicious actor to perform domain hijacking using IDN homographs in a specially created domain name...

Respect My Authority – Hijacking Broken Nameservers to Compromise Your Target

In a past piece of research, we explored the issue of nameserver domains expiring allowing us to take over full control of a target domain. In that example we took over the domain name maris.int by buying an expired domain name which was authoritative for the domain. This previous example happene...