California Passes New Privacy Law

The California legislature unanimously passed the strongest data privacy law in the nation. This is great news, but I have a lot of reservations. The Internet tech companies pressed to get this law passed out of self-defense. A ballot initiative was already going to be voted on in November, one...

IIJ SmartKey App for Android Information Disclosure Vulnerability

IIJ SmartKey App for Android is an Android-based application from Internet Initiative Japan IIJ that provides two-factor authentication for websites. A security vulnerability exists in IIJ SmartKey App for Android. A remote attacker can exploit the vulnerability to bypass authentication...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 11, 2018

As a native Texan, I’ve seen more than my fair share of bugs - actual physical bugs that love the hot, humid Texas climate and my curly hair for some reason. The Zero Day Initiative ZDI sees many bugs of the software variety, including those that affect SCADA control systems. Fritz Sands recently...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 4, 2018

It was a busy day yesterday, with Adobe issuing four emergency patches for their Flash Player, including one for a zero-day being actively exploited in the wild. Adobe has indicated that CVE-2018-5002 was discovered being used in limited, targeted attacks on Windows users in the wild. The attacks...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 28, 2018

I ended up at an urgent care clinic earlier this week and found out I have strep throat. The doctor who examined me asked me what medicine I had taken prior to my visit to help alleviate my throat pain, to which I replied, “I took a multi-symptom liquid medicine because the pain was keeping me...

CentOS 7 : libvorbis (CESA-2018:1058)

An update for libvorbis is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

alpine-initiative.ch XSS vulnerability

Open Bug Bounty ID: OBB-616722 Description| Value ---|--- Affected Website:| alpine-initiative.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WebKitGTK+ Memory Corruption / Code Execution Vulnerability

Exploit for windows platform in category dos / poc ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2018-0004 ------------------------------------------------------------------------ Date reported : May 07, 2018 Advisory ID : WSA-2018-0004...

Microsoft Patch Tuesday, May 2018 Edition

Microsoft today released a bundle of security updates to fix at least 67 holes in its various Windows operating systems and related software, including one dangerous flaw that Microsoft warns is actively being exploited. Meanwhile, as it usually does on Microsoft's Patch Tuesday -- the second...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 30, 2018

When I was little, I discovered the joy of jumping on the bed. While it was fun to jump on the bed, I wanted to make it more challenging so I started to imitate the ski jumpers I had seen during the 1976 Winter Olympics and jump from my parents’ dresser to the bed. I quickly found out there’s a...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 23, 2018

I was having dinner with friends recently and one of the newer members of the group asked me what I did for a living. I told him that I worked for a cybersecurity company and his reply was, “I don’t need to worry about security – I have a MacBook.” I thought that at any second, Rod Serling was...

initiative-des-alpes.ch XSS vulnerability

Open Bug Bounty ID: OBB-602637 Description| Value ---|--- Affected Website:| initiative-des-alpes.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 9, 2018

The interviewing process can be mentally draining. You have to look your best, say the right things, and prove that you’re the best person for the job. When I interview candidates, I love to come up with the one crazy question that isn’t on the usual list of questions that might be asked. I...

A View of Upcoming Threat Coverage from Pwn2Own 2018

This blog will be updated throughout the competition so keep tracking for the latest updates on upcoming threat coverage! St. Patrick’s Day is coming up later this week, but the contestants at Pwn2Own 2018 will need more than luck on their side. They will need to dive into their expert hacking...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 5, 2018

Today marks the first day of South by Southwest SXSW here in Austin and if you happen to be in town for the event, Trend Micro will be there! Starting tomorrow, Trend Micro will be exhibiting at the SXSW Job Market in booth 523. The SXSW Job Market is being held on March 10-11, 2018 at the Palmer...

Eaton ELCSoft

CVSS v3 6.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: Eaton Equipment: ELCSoft Vulnerability: Improper Input Validation AFFECTED PRODUCTS ELCSoft is programming software for all Eaton ELC programmable logic controllers. The ELC programmable logic controllers are not...

Delta Electronics Delta Industrial Automation DOPSoft

CVSS v3 6.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Delta Electronics Equipment: Delta Industrial Automation DOPSoft Vulnerability: Stack-based Buffer Overflow AFFECTED PRODUCTS The following version of Delta Industrial Automation DOPSoft, a human machine interface HMI...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 12, 2018

Valentine’s Day was earlier this week, and there was so much love in the air. There was also a lot of love in the Trend Micro world as our teams worked diligently to make sure our customers were protected from this month’s bevy of critical vulnerabilities across several vendors. This week, we foc...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 29, 2018

Late last year, Trend Micro introduced its Security Predictions for 2018. One of the predictions stated that digital extortion will be at the core of most cybercriminals’ business model. It’s much more than just ransomware – it is the most successful criminal business model in the current threat...

IGF proves the value of bottom-up, multi-stakeholder model in cyberspace policy-making

In December, the Internet Governance Forum IGF brought the world together to talk about the internet. I tend to take a definite interest in cybersecurity, but there were many more important topics discussed. They ranged from diversity in the technology sector through to philosophy in the digital...