SOCA Access Control System 180612 - CSRF (Add Admin) Vulnerability

Exploit for php platform in category web applications SOCA Access Control System 180612 CSRF Add Admin Exploit Vendor: SOCA Technology Co., Ltd Product web page: http://www.socatech.com Affected version: 180612, 170000 and 141007 Summary: The company's products include Proximity and Fingerprint...

Scanners-Box

This is a collection of open-source scanning tools and wordlists for web application security testing. The repository, Scanners-Box, is a collection of tools from various contributors, including lijiejie, ringzero, and others. The tools are categorized into subdomains, database vulnerability...

Samsung Galaxy S10 Fingerprint Sensor Duped With 3D Print

A Samsung Galaxy S10 user said he was able to successfully bypass the phone’s fingerprint sensors using a 3D print of his own fingerprint. The Samsung user posted on Imgur this weekend under the alias, “darkshark” saying he was able to fool the Galaxy S10’s fingerprint using a simple technique – ...

Digital Doppelgangers

Carding exists for over 20 years. And it is not dead yet. It is alive, and even more – it is being actively developed by cybercriminals. The "good" old method of entering stolen credit card information into online store forms to buy goods and services or using online payment system accounts for t...

SAS 2019: Genesis Marketplace Peddles 60K Stolen Digital Identities

SINGAPORE – A newly-discovered underground marketplace, dubbed Genesis, is peddling tens of thousands of stolen digital “masks” — i.e., identities — which equip cybercriminals with the tools they need to get away with online fraud. Researchers at Kaspersky Lab’s Security Analyst Summit 2019, whic...

Samsung Galaxy S10’ biometric sensor hackable with copy of owner’s fingerprint

By Waqas The fingerprint security feature of Samsung Galaxy S10 and S10+ has been hacked using only a 3D printer and printed fingerprint of the owner. The hack can be carried out without the presence of the actual owner since a printed copy of the fingerprints is used. When evaluated by security...

A week in security (April 1 – 7)

Last week, Malwarebytes Labs took readers on a brief tour of some of the world's most notable data privacy laws, explored how gamers can protect themselves against cyberthreats, and offered thoughts about the reports that a 23-year-old Chinese woman gained access to President Donald Trump’s...

PT-2019-5808

Name of the Vulnerable Software and Affected Versions HID Global DigitalPersona U.are.U 4500 Fingerprint Reader Windows Biometric Framework driver version 5.0.0.5 Description The issue is related to errors in cryptographic transformations in the driver, which results in weak encryption of a user'...

CVE-2018-6517: Improper Certificate Validation

Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's knownhosts file without confirmation. In version 0.3.0 this is updated so that the user's knownhosts file is not updated by chloride...

IoT-Home-Guard - A Tool For Malicious Behavior Detection In IoT Devices

IoT-Home-Guard is a project to help people discover malware in smart home devices. For users the project can help to detect compromised smart home devices. For security researchers it is also useful in network analysis and malicious hehaviors detection. In July 2018 we had completed the first...

Nextcloud: Able to bypass "Device credentials" Lock

Prepare 1. Enable "Device credentials" lock via the settings. I'm using fingerprint in my case 2. Test if this works by closing the app and open it again. 3. If this works close the app again, do a force close to make sure the application is closed. The next steps need to be done quickly right...

Microsoft Windows Server 2008 Unsupported Version Detection

Microsoft Windows Server 2008 is running on the remote host. Microsoft ended support for Windows Server 2008 versions lower than Service Pack 2 on 4/9/2011 and all other versions on 1/14/2020. Lack of support implies that no new security patches for the product will be released by the vendor. As ...

Android Gets FIDO2 Certification—Now Supports Secure Passwordless Logins

Great news. If you have already installed the latest update of Google Play Services released earlier today, and your Android device is running Android version 7.0 Nougat or above—Congratulations! Your device is now FIDO2 Certified. Are you thinking… what the heck that actually means? It means,...

Android Gets FIDO2 Certification—Now Supports Secure Passwordless Logins

Great news. If you have already installed the latest update of Google Play Services released earlier today, and your Android device is running Android version 7.0 Nougat or above—Congratulations! Your device is now FIDO2 Certified. Are you thinking… what the heck that actually means? It means,...

Google Ditches Passwords in Latest Android Devices

Half of all Android users can now log into apps and websites on their devices – without having to remember a cumbersome password. On Monday, Google and the Fast IDentity Online FIDO Alliance announced that devices running Android 7 or later are certified by the FIDO2 standard, meaning that users...

Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM has addressed the applicable CVEs...

Researchers Release Tool That Finds Vulnerable Robots on the Internet

A team at a robot cybersecurity startup has released a free, open-source tool for information security professionals to help them easily 'footprint' and detect unprotected robots, not only connected to the Internet, but also to the industrial environments where they operate. Dubbed "Aztarna ," th...

A Six Flags Fingerprints Ruling, Supply Chain Hacks, and More Security News This Week

Google's elite security team, police scanner encryption, and more of the week's top security news...

Protection Mechanism Bypass

OpenSSL is vulnerable to protection mechanism bypass. This is because OpenSSL accepts several variations of certificate signature algorithms and signature encodings. It doesn't then enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. This...

CVE-2018-9567

On Pixel devices there is a bug causing verified boot to show the same certificate fingerprint despite using different signing keys. This may lead to local escalation of privilege if people are relying on those fingerprints to determine what version of the OS the device is running, with System...