A zero-day guide for 2020: Recent attacks and advanced preventive techniques

Zero-day vulnerabilities enable threat actors to take advantage of security blindspots. Typically, a zero-day attack involves the identification of zero-day vulnerabilities, creating relevant exploits, identifying vulnerable systems, and planning the attack. The next steps are infiltration and...

PT-2020-3067

Name of the Vulnerable Software and Affected Versions Moxa EDR-G902 and EDR-G903 affected versions not specified Description The issue is related to a buffer overflow in the stack of the firmware of Moxa EDR-G902 and EDR-G903 switches. Exploitation of this issue could allow a remote attacker to...

A week in security (May 25 – 31)

Last week on Malwarebytes Labs, we published our most recent episode of our podcast Lock and Code, providing an in-depth discussion on web browser privacy, looked at the membership bump for the Coalition against Stalkerware, and dug into EDR solutions. We also looked at twists added to the threat...

The best test for an EDR solution is one that works for you

Since its inception, the endpoint detection and response EDR market has evolved rapidly with new innovations to better address the cyber landscape and meet customers’ needs for an effective and simple solution that just works. But finding something that just works means something quite different...

Third-Party Tests Rate VMware Carbon Black Cloud as a Leader in Protection, Detection; Platform Delivers 379% ROI for Customers

The biggest endpoint protection question for organizations right now is whether or not to upgrade from legacy approaches to cloud-native platforms with built-in EDR. If you boil this decision down to three key factors stronger protection, clearer visibility, and faster resolution, the choice...

CVE-2020-10135

The CVE-2020-10135 entry describes a vulnerability in Bluetooth BR/EDR authentication where legacy pairing and secure-connections pairing for Core Specification v5.2 and earlier may allow an unauthenticated, adjacent attacker to complete the authentication procedure without requiring pairing cred...

CVE-2020-10135: Selection of Less-Secure Algorithm During Negotiation

Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent attacker could impersonate a Bluetooth...

PT-2020-5393

Name of the Vulnerable Software and Affected Versions Bluetooth BR/EDR Core Specification versions prior to v5.2 Description The issue concerns a flaw in the authentication procedure of the Bluetooth BR/EDR protocol, allowing an unauthenticated, adjacent attacker to impersonate a Bluetooth BR/EDR...

Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks

Overview Bluetooth Low Energy BLE and Basic Rate / Enhanced Data Rate BR/EDR Core Configurations are used for low-power short-range communications. To establish an encrypted connection, two Bluetooth devices must pair with each other using an agreed upon Association Model. It is possible for an...

Using Real-Time Events in Investigations

To understand what a threat actor did on a Windows system, analysts often turn to the tried and true sources of historical endpoint artifacts such as the Master File Table MFT, registry hives, and Application Compatibility Cache AppCompat. However, these evidence sources were not designed with...

CVE-2020-7286

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

Privilege escalation

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

Privilege escalation

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

Privilege escalation

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Linux prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

CVE-2020-7287 Privilege Escalation vulnerability in EDR for Linux

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Linux prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

CVE-2020-7287

McAfee Exploit Detection and Response (EDR) for Linux prior to 3.1.0 Hotfix 1 is affected by a privilege-escalation issue. A local attacker can run a malicious script or program to execute functions not granted to the local user. The reported fixed version is 3.1.0 Hotfix 1. No exploits or exact ...

CVE-2020-7288 Privilege Escalation vulnerability in EDR for Mac

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...

CVE-2020-7288

The CVE-2020-7288 entry concerns McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1. A privilege-escalation flaw allows a malicious script or program to perform actions the local user isn’t authorized to execute, affecting confidentiality, integrity, and availability (hig...

CVE-2020-7286

Summary of CVE-2020-7286 : A privilege-escalation vulnerability exists in McAfee Exploit Detection and Response (EDR) for Windows prior to 3.1.0 Hotfix 1 . The issue allows a malicious script or program to execute functions that the local user is not authorized to access, resulting in local privi...

CVE-2020-7286 Privilege Escalation vulnerability in EDR for Windows

Privilege Escalation vulnerability in McAfee Exploit Detection and Response EDR for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to...