More on Kaspersky and the Stolen NSA Attack Tools

Both the New York Times and the Washington Post are reporting that Israel has penetrated Kaspersky's network and detected the Russian operation. From the New York Times: Israeli intelligence officers informed the NSA that, in the course of their Kaspersky hack, they uncovered evidence that Russia...

old.nimasa.gov.ng XSS vulnerability

Vulnerable URL: http://old.nimasa.gov.ng/about.php?id=...

North Korean Actors Spear Phish U.S. Electric Companies

We can confirm that FireEye devices detected and stopped spear phishing emails sent on Sept. 22, 2017, to U.S. electric companies by known cyber threat actors likely affiliated with the North Korean government. This activity was early-stage reconnaissance, and not necessarily indicative of an...

North Korean Actors Spear Phish U.S. Electric Companies

We can confirm that FireEye devices detected and stopped spear phishing emails sent on Sept. 22, 2017, to U.S. electric companies by known cyber threat actors likely affiliated with the North Korean government. This activity was early-stage reconnaissance, and not necessarily indicative of an...

governmentservice.co.za XSS vulnerability

Vulnerable URL: http://governmentservice.co.za/search.php?search=Government Services&search2;==Search+source+code=13'"28 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15768836 VIP website status:| No Coordinate...

businessportal.ca.gov XSS vulnerability

Open Bug Bounty ID: OBB-330908 Description| Value ---|--- Affected Website:| businessportal.ca.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

White House Chief of Staff John Kelly's Cell Phone was Tapped

Politico reports that White House Chief of Staff John Kelly's cell phone was compromised back in December. I know this is news because of who he is, but I hope every major government official of any country assumes that their commercial off-the-shelf cell phone is compromised. Even allies spy on...

Chengdu Municipal People's Government Network Governance Platform Android APP has overstepping loopholes

Chengdu Municipal People's Government Network Governance Platform Android APP is a people's service software. There is an overstepping vulnerability in Chengdu Municipal People's Government Network Governance Platform Android APP. After registering and logging into the client, an attacker can...

Data Breaches and Credential Stuffing: Don't Get TKOd

It has been a very rough month for the information security community. It feels like we've been on the losing end of a championship fight against Floyd Mayweather. The body shots started with Equifax https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 and continued with...

October 4, 2017 – Morning Cyber Coffee Headlines – “Nobel Prize” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 4, 2017 - Headlines Carbon Black in the News: Kangaroo Ransomware uses...

September 29, 2017 – Morning Cyber Coffee Headlines – “Autumn” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 29, 2017 - Headlines NY Regulator Says Equifax Making Progress on...

Elaborate scripting-fu used in espionage attack against Saudi Arabia Government entity

This post was co-authored by David Sánchez and Jérôme Segura We recently came across a campaign targeting a Saudi Arabia Government entity via a malicious Word document which at first reminded us of an attack we had previously described on this blog. In our previous research, we detailed how an...

alriyadh.gov.sa XSS vulnerability

Open Bug Bounty ID: OBB-310803 Description| Value ---|--- Affected Website:| alriyadh.gov.sa Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

September 22, 2017 – Morning Cyber Coffee Headlines – “Abraham Lincoln” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 22, 2017 - Headlines Carbon Black in the News: 'Hacker' is the wrong...

Iranian APT33 Targets U.S. Firms with Destructive Malware

The Iranian group known as APT33 is believed to be behind a cyberespionage campaign targeting aerospace, petrochemical and energy sector firms located in the United States, Saudi Arabia and South Korea. The group’s latest attack leverages a dropper called DropShot that is tied to the StoneDrill...

baladia.gov.kw XSS vulnerability

Vulnerable URL: https://www.baladia.gov.kw/sites/ar/pages/allnews.aspx?FollowSite=0=%27-confirm%27OPENBUGBOUNTY%27-%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 20.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 143709 VIP...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a...

www3.halton.gov.uk XSS vulnerability

Vulnerable URL: https://www3.halton.gov.uk/layouts/15/viewlsts.aspx?FollowSite=0=%27-confirm%27OPENBUGBOUNTY%27-%27 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

75,000 Turks Arrested So Far for Downloading Encrypted Messaging App

WARNING: If you are Turkish and using or have installed ByLock—a little-known encrypted messaging app—you could be detained by Turkish authorities. You might be thinking why??? Because using this app in Turkish is illegal since last year. The background story begins here... Remember the deadliest...