A week in security (Jun 12 – Jun 18)

Last week was very busy for the Labs, with a look at so-called numeric tech support scams, a visit to the huge Infosec Europe conference, an exploration of Mac Malware as a Service, and a walk through the myths of online bullying. Elsewhere: A huge click-farm is busted Jaff Ransomware is thwarted...

Cheers to a successful time at Infosec Europe 2017

With over 350 exhibitors, well over 10,000 visitors, and many widely respected speakers, Infosec Europe is one of Europe's biggest security events. The Malwarebytes stand attracted a lot of interested people, even without our robot Zero, who had obligations elsewhere. The new EMEA Channel...

Spotlight on Malware DGA Communication Technique

Written by Avi Aminov and Or Katz Overview Imagine you are standing in the middle of a crowded train station and want to have a private conversation with an old friend. You've been waiting for the perfect time to contact him and get some advice on how to move forward with some important life...

Google 0-Day Hunters Find 'Crazy Bad' Windows RCE Flaw

Update Monday, May 08, 2017: Microsoft has released an emergency security update to patch below-reported crazy bad remote code execution vulnerability in its Microsoft Malware Protection Engine MMPE that affects Windows 7, 8.1, RT and 10 computers, as well as Windows Server 2016 operating systems...

Virtual Patching: A Lifesaver for Web App Security

Here’s a common scenario organizations increasingly face: Too many web apps with too many vulnerabilities and no chance for immediate remediation. In the interim, the organization is left exposed to potentially devastating breaches, at a time when web apps have become one of cyber attackers’...

NSA's DoublePulsar Kernel Exploit In Use Internet-Wide

If you’re on a red team or have been on the receiving end of a pen-test report from one, then you’ve almost certainly encountered reports of Windows servers vulnerable to Conficker MS08-067, which has been in the wild now for nearly 10 years since the bug was patched. A little more than two weeks...

Rapid7: Supporting the Community at BSides Boston

One of the things I love about working at Rapid7 is how deeply this company embodies the concept of giving back to the Security Community. Whether it be discussing research on adversary analytics, attack methods for breaking out of sandboxes, or simply breaking into the industry - Rapid7 encourag...

maynard.wickedlocal.com XSS vulnerability

Open Bug Bounty ID: OBB-216597 Description| Value ---|--- Affected Website:| maynard.wickedlocal.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

ipswich.wickedlocal.com XSS vulnerability

Open Bug Bounty ID: OBB-216581 Description| Value ---|--- Affected Website:| ipswich.wickedlocal.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

brewster.wickedlocal.com XSS vulnerability

Open Bug Bounty ID: OBB-216538 Description| Value ---|--- Affected Website:| brewster.wickedlocal.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A...

devilslakejournal.com XSS vulnerability

Open Bug Bounty ID: OBB-216492 Description| Value ---|--- Affected Website:| devilslakejournal.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

wrentham.wickedlocal.com XSS vulnerability

Open Bug Bounty ID: OBB-216409 Description| Value ---|--- Affected Website:| wrentham.wickedlocal.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A...

jacksonnewspapers.com XSS vulnerability

Open Bug Bounty ID: OBB-216369 Description| Value ---|--- Affected Website:| jacksonnewspapers.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

penfieldpost.com XSS vulnerability

Vulnerable URL: http://www.penfieldpost.com/search?text=';";;---- infosec.com.br --;'"...

irondequoitpost.com XSS vulnerability

Vulnerable URL: http://www.irondequoitpost.com/search?text=';";;---- infosec.com.br --;'"...

brightonpittsfordpost.com XSS vulnerability

Vulnerable URL: http://www.brightonpittsfordpost.com/search?text=';";;---- infosec.com.br --;'"...

victorpost.com XSS vulnerability

Vulnerable URL: http://www.victorpost.com/search?text=';";;---- infosec.com.br --;'"...

www2.cultura.gov.br XSS vulnerability

Vulnerable URL: http://www2.cultura.gov.br/site/?s=s=015263130529786204654:asoduglh86s=FORID:11=aaa';";;---- infosec.com.br --;'"...

prefeituradearipuana.com.br XSS vulnerability

Open Bug Bounty ID: OBB-214921 Description| Value ---|--- Affected Website:| prefeituradearipuana.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Malware exploit: Pbot

Type: Remote Code Execution Author: Juan Vasquez This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp...