Duo Mobile - Customized SSL, External URLs, KeyStore usage vulnerabilities

HackApp vulnerability scanner discovered that application Duo Mobile published at the 'play' market has multiple vulnerabilities...

FreeBSD : duo -- Two-factor authentication bypass (738e8ae1-46dd-11e7-a539-0050569f7e80)

The duo security team reports : An untrusted user may be able to set the httpproxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success. %NASLMINLEVEL 70300 C Tenable...

duo -- Two-factor authentication bypass

The duo security team reports: An untrusted user may be able to set the httpproxy variable to an invalid address. If this happens, this will trigger the configured 'failmode' behavior, which defaults to safe. Safe mode causes the authentication to report a success...

Securitybot - Distributed alerting for the masses!

Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster and more...

Distributed Security Alerting: Securitybot

Distributed Security Alerting Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber’s blog post . Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster and more...

Acoem 01dB DUO Smart Noise Monitor Remote Password Change Vulnerability

Exploit for hardware platform in category remote exploits !/bin/sh Acoem 01dB DUO Smart Noise Monitor Remote Password Change HW version: LIS1005G Application FW: 2.34 Metrology FW: 2.10 Modem FW: 08.01.108 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/...

Acoem 01dB DUO Smart Noise Monitor Remote Password Change

!/bin/sh Acoem 01dB DUO Smart Noise Monitor Remote Password Change HW version: LIS1005G Application FW: 2.34 Metrology FW: 2.10 Modem FW: 08.01.108 Copyright 2016 c Todor Donev https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous programs is for...

OWA and Offic365 two-factor authentication bypass-vulnerability warning-the black bar safety net

Foreword Full disclosure: the BLACK HILLS information security very much in favor of responsible disclosure of vulnerabilities. 2 0 1 6 9 2 8, I to Microsoft reported this vulnerability, may have been to this article publishing 2016.11.2, Microsoft for this vulnerability is always without any...

Vendetta Brothers, Inc. – A Window Into the Business of the Cybercriminal Underground

FireEye iSIGHT Intelligence has been tracking a pair of cybercriminals that we refer to as the “Vendetta Brothers.” This enterprising duo uses various strategies to compromise point-of-sale systems, steal payment card information and sell it on their underground marketplace “Vendetta World.” The...

NIST Recommends SMS Two-Factor Authentication Deprecation

A U.S. government agency said the end is nigh for SMS-based two-factor authentication, citing a lack of security around the feature. The latest draft version of the Digital Authentication Guideline issued this week by the U.S. National Institute for Standards and Technology NIST said the practice...

Lenovo company to inform the user as soon as the uninstall containing the vulnerability the software update program-vulnerability warning-the black bar safety net

! Recently,LenovoLenovo, said in a statement,they found that:before the launch of the software update program in the presence of security vulnerabilities. Due to the vulnerability within a short time can not be timely repair,so the requirements of the user as soon as possible in their use,install...

OEM Bloatware Security Vulnerabilities Found

Last year’s Superfish and eDellRoot bloatware mishaps exposed the security nightmare that pre-installed software updaters can create on new laptops. And while these two high-profile incidents made the issue public, they’re hardly isolated cases. Many popular consumer and business laptops from...

Hey Allo! Meet Google's AI-powered Smart Messaging App

Get Ready for a whole new Artificial Intelligence-based Messaging experience. At I/O event Wednesday, Google unveiled its new messaging app named Allo: A smart messaging app powered with machine learning programming and the company’s newly announced AI bot Google Assistant. You just have to sign ...

Android Devices Linux Zero Day Kernel Vulnerability

Google is downplaying the scope of the critical Linux vulnerability patched this week, suggesting that the number of affected Android devices has been exaggerated. The Android OS is built upon the Linux kernel, but minus many of the libraries that are included in standard Linux builds. Initially,...

Dell aeration eDellRoot root certificate Backdoor-vulnerability warning-the black bar safety net

Earlier this year, Lenovo computer was found loaded with the Superfish adware program, this software will increase the user vulnerable to hackers attack risk, the moment sparked a lot of discussion, and recently, the Duo lab security researcher in Dell Inspiron 1 4 Notebook found some strange...

Two More Self-Signed Certs, Private Keys Found on Dell Machines

eDellroot is not the only self-signed trusted root certificate on Dell computers. Researchers at Duo Security found two more on a Dell Inspiron 14-inch laptop purchased by Darren Kemp, one of its researchers who is based in Calgary, Canada, including one cert related to eDellroot that also ships...

Latest EMET Bypass Targets WoW64 Windows Subsystem

Backwards compatibility, a necessary evil for Microsoft in its need to support so many legacy applications on Windows, may be its undoing as researchers have found a way to exploit this layer in the operating system to bypass existing mitigations against memory-based exploits. Specifically in thi...

FreeBSD : mysql -- SSL Downgrade (36bd352d-299b-11e5-86ff-14dae9d210b8) (BACKRONYM)

Duo Security reports : Researchers have identified a serious vulnerability in some versions of Oracle's MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

New MySQL Bug Can Strip SSL Protection From Connections

Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently. The vulnerability is the result of the way that an option in MySQL handles requests for secure...

DUO-PSA-2014-007: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-007 Publication Date: 2014-10-15 Status: Confirmed, Fixed Document Revision: 1 Overview Duo Security has identified an issue that may allow local users to bypass second factor authentication when using the pamduo component of duounix in...