A week in security (July 2 – July 8)

Last week, we tracked back a large mining operation from their Coinhive shortlink, we took a look at online project management tools, we described a new macro-less technique to distribute malware, and talked about a Mac malware that targets crypto-mining users. Other news: Huawei enterprise comms...

To crypt, or to mine – that is the question

Way back in 2013 our malware analysts spotted the first malicious samples related to the Trojan-Ransom.Win32.Rakhni family. That was the starting point for this long-lived Trojan family, which is still functioning to this day. During that time the malware writers have changed: the way their Troja...

Suspicious Powershell Downloader

Many campaigns are known to use Powershell downloaders. A remote attacker could convince users to manually trigger their execution. This would allow the malicious code to run and infect the target system...

FileDownloader Directory Traversal Vulnerability

FileDownloader is an Android-based multitasking download engine. A directory traversal vulnerability exists in the util/FileDownloadUtils.java file in FileDownloader version 1.7.3, which stems from the program failing to detect the name of an attachment. A remote attacker could exploit the...

Threat Roundup for April 20-27

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between April 20 and 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Video Downloader professional extension for Chrome cross-site scripting vulnerability

Video Downloader professional extension for Chrome is a video download extension for Google Chrome. A cross-site scripting vulnerability exists in versions prior to 2018-04-05 of Video Downloader professional extension for Chrome. A remote attacker can exploit the vulnerability to execute arbitra...

The vulnerability of the fileUploader.php and fileDownloader.php scripts of the ClipBucket video content management system allows a hacker to execute arbitrary operating system commands.

The vulnerability of the fileuploader.php /api/fileuploader.php and filedownloadler.php /actions/filedownloadler.php scripts of the ClipBucket video content management system is related to the lack of measures to neutralize special elements used in operating systems. Exploiting this vulnerability...

CVE-2018-10000

The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS UXSS via vectors related to a link64msgAddLinks event...

CVE-2018-10000

The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS UXSS via vectors related to a link64msgAddLinks event...

Design/Logic Flaw

The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS UXSS via vectors related to a link64msgAddLinks event...

CVE-2018-10000

CVE-2018-10000 describes a universal XSS (UXSS) in the Video Downloader professional extension for Chrome, prior to 2018-04-05. The issue arises via vectors related to a link64_msgAddLinks event, allowing an attacker to trigger cross-site scripting within the extension context. The NVD entry list...

CVE-2018-10000

The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS UXSS via vectors related to a link64msgAddLinks event...

Video Downloader Universal Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Video Downloader Extension: Universal XSS Browsing through the list of most popular Chrome extensions, I noticed this extension with 4M users:...

Hunting down Dofoil with Windows Defender ATP

Dofoil is a sophisticated threat that attempted to install coin miner malware on hundreds of thousands of computers in March, 2018. In previous blog posts we detailed how behavior monitoring and machine learning in Windows Defender AV protected customers from a massive Dofoil outbreak that we...

An in-depth malware analysis of QuantLoader

This guest post is written by Vishal Thakur, CSIRT/Salesforce. For more on Vishal, read his bio at the end of the blog. QuantLoader is a Trojan downloader that has been available for sale on underground forums for quite some time now. It has been used in campaigns serving a range of malware,...

RedisWannaMine Unveiled: New Cryptojacking Attack Powered by Redis and NSA Exploits

Recently cryptojacking attacks have been spreading like wildfire. At Imperva we have witnessed it firsthand and even concluded that these attacks hold roughly 90% of all remote code execution attacks in web applications. Having said that, all of the attacks we have seen so far, were somewhat...

Input validation

An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the filename parameter to /api/fileuploader.php or /actions/filedownloader.php...

CVE-2018-7664

An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the filename parameter to /api/fileuploader.php or /actions/filedownloader.php...

ClipBucket OS Command Injection Vulnerability

ClipBucket is an open source video sharing software developed by Arslan team. The software allows you to share videos to video sites and supports the lights off effect when watching a movie. A security vulnerability exists in versions prior to ClipBucket 4.0.0 Release 4902. The vulnerability can ...

Threat Round Up for Feb 2 - Feb 9

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between February 2 and February 9. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...