Tech support scammers make browser lockers more resilient

Tech support scammers have been relying on fraudulent pop-ups for many years in order to scare potential victims into calling for remote assistance. These so-called browser lockers or browlocks typically originate from malicious ads malvertising that can appear on any website, including trusted...

EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution

Summary With the EnGenius IoT Gigabit Routers and free EnShare app, use your iPhone, iPad or Android-based tablet or smartphone to transfer video, music and other files to and from a router-attached USB hard drive. Enshare is a USB media storage sharing application that enables access to files...

RAT Distributed Via Google Drive Targets East Asia

Researchers said that they are tracking a new remote access Trojan dubbed UBoatRAT that is targeting individuals or organizations linked to South Korea or the video game industry. While targets aren’t 100 percent clear, researchers at Palo Alto Networks Unit 42 said UBoatRAT threats are evolving...

Multiple Devices Samsung 850 Pro, PM851 SSD, Seagate ST500LT015 and ST500LT025 Hard Disk Force Reboot Attack Vulnerability

Lenovo ThinkPad T440s laptop is a laptop from Lenovo in China.Dell Latitude E6410 laptop is a laptop from Dell in the U.S.A. Samsung 850 Pro and others are hard disks used in laptops.Samsung 850 Pro is a hard disk manufactured by Samsung in Korea. The Samsung 850 Pro is a hard drive manufactured ...

Multiple Device Samsung 850 Pro, PM851 SSD, Seagate ST500LT015 and ST500LT025 Hard Disk Hot Swap Attack Vulnerability

Lenovo ThinkPad T440s laptop is a laptop from Lenovo in China.Dell Latitude E6410 laptop is a laptop from Dell in the U.S.A. Samsung 850 Pro and others are hard disks used in laptops.Samsung 850 Pro is a hard disk manufactured by Samsung in Korea. The Samsung 850 Pro is a hard drive manufactured ...

Lenovo ThinkPad W541 laptop Seagate ST500LT015 hard disk drive bypass vulnerability

The Lenovo ThinkPad W541 laptops with BIOS 2.21 is a laptop computer from the Chinese company Lenovo that uses BIOS version 2.21.The Seagate ST500LT015 hard disk drive is a hard disk drive used in computers made by the American company Seagate. Seagate ST500LT015 hard disk drive is a hard disk...

Hardcoded credentials

Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when in sleep mode and operating in Opal or eDrive mode on Lenovo ThinkPad T440s laptops with BIOS 2.32; ThinkPad W541 laptops with BIOS 2.21; Dell Latitude E6410 laptops with BIOS A16; or Latitud...

CVE-2015-7267

The CVE-2015-7267 entry applies to Samsung 850 Pro/PM851 SSDs and Seagate ST500LT015/ST500LT025 HDDs used in Lenovo ThinkPad T440s (BIOS 2.32) and W541 (BIOS 2.21), Dell Latitude E6410 (BIOS A16), and Latitude E6430 (BIOS A16). It describes a physical-access risk where, when the drives operate in...

CVE-2015-7268

The CVE-2015-7268 entry describes a hardware-level vulnerability affecting Samsung 850 Pro/PM851 SSDs and Seagate ST500LT015/ST500LT025 HDDs when used with Windows and specific Opal/eDrive configurations on certain Lenovo/Dell laptops. The issue allows physically proximate attackers to bypass sel...

Citrix *Client Folder Redirection* (CFR) is not *Folder Redirection*

Client Folder Redirection, Folder Redirection and Special Folder Redirection are not the same. Client Folder Redirection CFR provides access to client-side folders in an ICA session while not having to redirect complete client-side drives. Support throughClient Drive Mapping CDM has enabled...

Microsoft Windows NTFS File System Metadata Disclosures Exploit

The Microsoft Windows Kernel suffers from multiple stack and pool memory disclosures into NTFS file system metadata. Windows Kernel multiple stack and pool memory disclosures into NTFS file system metadata CVE-2017-11880 We have discovered that the NTFS.sys driver writes uninitialized kernel stac...

Adobe Reader Security Updates (APSB17-36) - Mac OS X

Adobe Reader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:acrobatreader";...

Disdain exploit kit and a side of social engineering deliver Neutrino Bot

Today we picked up new activity from an exploit kit that was first discovered back in August of this year. The Disdain exploit kit, simply identified by a string of the same name found in its source code, is being distributed again after a short interruption via malvertising chains. Disdain EK...

Fedora 26 : 2:qemu (2017-9149114fba)

Fix usb3 drive issues with windows guests bz 1493196 - CVE-2017-15038: 9p: information disclosure when reading extended attributes bz 1499111 - CVE-2017-15268: potential memory exhaustion via websock connection to VNC bz 1496882 - CVE-2017-14167: multiboot OOB access while loading kernel image bz...

A look into the global drive-by cryptocurrency mining phenomenon

An important milestone in the history of cryptomining happened around mid-September when a company called Coinhive launched a service that could mine for a digital currency known as Monero directly within a web browser. JavaScript-based mining is cross-platform compatible and works on all modern...

CVE-2017-13681

Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the...

Bad Rabbit Linked to ExPetr/Not Petya Attacks

A link has been confirmed between the Bad Rabbit ransomware outbreak detected yesterday in major organizations in Russia and Ukraine and this summer’s ExPetr/Not Petya attacks. Researchers at Kaspersky Lab said there are “clear ties” between the two attacks though one major piece of the puzzle is...

WEM Drive Restriction policy will not apply to End User session on WEM Agent

WEM Drive Restriction policy will not apply to End User session on WEM Agent machines...

Bad Rabbit ransomware

UPDATE 27.10.2017. Decryption opportunity assessment. File recovery possibility. Verdicts What happened? On October 24th we observed notifications of mass attacks with ransomware called Bad Rabbit. It has been targeting organizations and consumers, mostly in Russia but there have also been report...

Digital forensics: How to recover deleted files

Where I personally have a problem remembering names and birthdays, computers have a hard time “forgetting” things. Even when we tell them to do so. If you ever unintentionally deleted a file, you may have been able to retrieve it from the Recycle Bin. Or, if it was past that stage and the file wa...