Adobe PDF - Embedded EXE Social Engineering (Metasploit)

$Id: adobepdfembeddedexe.rb 11353 2010-12-16 20:11:01Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Mozilla Disables WebSockets in Firefox 4 Over Security Concerns

Officials at Mozilla have decided to disable support for Web Sockets in future versions of Firefox because of concerns over the security of the the current version of the protocol.The group said that demonstrations of serious attacks against WebSockets have spurred the move. Mozilla said that the...

Fake Amazon Receipt Generator Dupes Merchants

A new scam has been circulating the internet lately that aims to swindle Amazon sellers by generating fake receipts. Amazon Receipt Generator, an executable file, has been making the rounds on hacking forums for the last few months. The program allows scammers to input an array of fake informatio...

Researcher Releases JavaSnoop Java-Analysis Tool

Java has long been one of the more widely used–and widely criticized–technologies on the Web. It’s used virtually everywhere and roundly panned by security researchers for its security shortcomings. Now, a researcher has released a new tool, called JavaSnoop, that’s designed to help people better...

Social Engineering Ninja v0.4 - Latest Release Download

"S-E Ninja is a Social Engineering tool, with 20-25 popular sites fake pages and anonymous mailer via mail function in PHP. It is a Phishing Web Application Written in PHP,XHTML,CSS,JS." This is the official change log: Edited tables names Added XSS stealer module Now you got control of ipcapture...

U.S. Adopts Military Tactics for Rising Cyberwar Threats

The increasing threats of cyberwar are keeping U.S. officials busy alongside ongoing wars on terror and drugs. Recent incidents highlight the rising cyberwarfare concerns: Google reported espionage attacks originating from China, mysterious Internet traffic activities related to China, the Stuxne...

Potential WikiLeaks Phishing Scams

In the past, US-CERT has received reports of phishing scams and malware campaigns related to topics that are of high-interest to the U.S. Government or news media, such as the WikiLeaks website. Users' systems have been compromised by receiving and accessing phishing emails with subject lines tha...

6) (Anti) social networking

Social networks like Facebook and Twitter are fabulous platforms for sharing information and news. Retailers of all stripes have tapped into this and are using them to get the word out – virally – about discounts, sales and in-store events. Unfortunately, mechanisms for vetting online reputation...

Holiday Season Phishing Scams and Malware Campaigns

As the winter holidays are quickly approaching, US-CERT is republishing this entry to increase awareness. In the past, US-CERT has received reports of an increased number of phishing scams and malware campaigns that take advantage of the winter holiday and holiday shopping season. US-CERT reminds...

Social Engineering Ninja v0.3 - News release download

Now, the author has made an updated version available for us – Social Engineering Ninja version 0.3. "S-E Ninja is a Social Engineering tool, with 20-25 popular sites fake pages and anonymous mailer via mail function in PHP. It is a Phishing Web Application Written in PHP,XHTML,CSS,JS." This is t...

Social-Engineer Toolkit v1.0 - Latest Version Download

The Social Engineer Toolkit SET has been updated to version 1.0! We wrote about the Social Engineer's Toolkit in our old post here. This release is called the Devolution Release. "The Social Engineering Toolkit SET is a python-driven suite of custom tools which solely focuses on attacking the hum...

Fraud Advisory for Businesses Released: Corporate Account Take Over

As part of a joint effort, the United States Secret Service, the Federal Bureau of Investigation, the Internet Crime Complaint Center IC3 and the Financial Services Information Sharing and Analysis Center FS-ISAC have released Fraud Advisory for Businesses: Corporate Account Take Over PDF. The...

Security Firms Scramble For SCADA Talent After Stuxnet

Three months after the world first learned of the sophisticated Stuxnet worm, insiders say that there’s a scramble to find and hire engineers with knowledge of both security and the industrial control systems that were Stuxnet’s intended target. Anti virus companies admit their research teams wer...

Hackid

One of the more interesting trends is the way hacking culture is starting to trickle down from the technology cognoscenti to a far broader and equally receptive audience. Hackid is a great example of that. In its first year ever, Hackid is a conference specifically targeted at kids aged 5 to 17...

Zeus Variant Targets Mobile Online Banking Apps

Researchers have discovered a variant of the Zeus bot malware that specifically targets users who perform online-banking operations from the mobile phones, playing on the increasingly common use of SMS-based one-time passwords in order to dupe users into loading the malware. The attack begins wit...

Researchers: Google Aurora Attackers Back in Business?

Just when you thought it was safe to go back in your e-mail…Researchers say a new round of targeted attacks appear to come from the same group responsible for attacks against Google and other top U.S. firms. Writing on the Symantec Security blog...

Malicious Email Campaign Circulating

US-CERT is aware of public reports of malware spreading via email. These reports indicate that the malicious email messages contain the subject line "Here you have" or "Just For You" and contain a link to a seemingly legitimate PDF file. If users click on this link, they will be redirected to a...

Former Employees a Rich Target in Social Engineering Contest

The results of a hacking contest at the DEFCON conference shows that the largest U.S. corporations have a lot to learn. “If any of these targets had hired us to do a social engineering audit, we would have failed them,” an organizer said. HED:DEFCON tournament suggests ex-employees pose big risk...

Microsoft Publishes New FixIt Tool For DLL Bug

Microsoft has released some updated guidance on the recent DLL-hijacking bug, including a new FixIt tool that enables the workaround for the vulnerability that Microsoft shipped late last month. The new guidance includes a detailed explanation of the bug itself as well as how potential attacks...

Mod-X Cross Site Request Forgery / Cross Site Scripting

Got bored and decided to break the new website of the company I work for. Throughout I'll be dropping two new exploits that were chained to allow the changing of the administrative password of a default mod-x install. This is not a full review of mod-x, my main goal was just to break something, s...