676 matches found
Enigma Machine Recovered from the Baltic Sea
Neat story: German divers searching the Baltic Sea for discarded fishing nets have stumbled upon a rare Enigma cipher machine used by the Nazi military during World War Two which they believe was thrown overboard from a scuttled submarine. Thinking they had discovered a typewriter entangled in a...
U.S. Dept Of Defense: IDOR on https://██████ via POST UID enables database scraping
Summary: The UID parameter on █████████ in the ██████ ███████ system, with ███████, does not validate that the caller has permission to view information on the UID entered, thereby enabling personnel and student data extraction. Description: The user operations API endpoint for the ███ ██████████...
The US Military Buys Commercial Location Data
Vice has a long article about how the US military buys commercial location data worldwide. The U.S. military is buying the granular movement data of people around the world, harvested from innocuous-seeming apps, Motherboard has learned. The most popular app among a group Motherboard analyzed...
MITRE ATT&CK Tactics Are Not Tactics
Just what are "tactics"? Introduction MITRE ATT&CK is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from Marc...
DOJ Charges 6 Sandworm APT Members in NotPetya Cyberattacks
The Department of Justice DOJ on Monday announced charges against six Russian nationals who are allegedly tied to the Sandworm APT. The threat group is believed to have launched several high-profile cyberattacks over the past few years – including the destructive NotPetya cyberattack that targete...
A Trickbot Assault Shows US Military Hackers' Growing Reach
Despite the operation's short-term effects, it sets new precedents for the scope of Cyber Command's mission...
The Man Who Speaks Softly—and Commands a Big Cyber Army
Meet General Paul Nakasone. He reined in chaos at the NSA and taught the US military how to launch pervasive cyberattacks. And he did it all without you noticing...
U.S. Dept Of Defense: Insufficient Session Expiration on Adobe Connect | https://█████████
Description: Due to lack of password protection and Insufficient Session Expiration I am able to brute force Adobe Connect meeting rooms. Many of the meeting rooms have chat history and files uploaded. Some of the chat history and files contains personal identifiable information. Walkthrough...
U.S. Dept Of Defense: param allows any external resource to be downloadable | https://████████
Description: The following param allows an attacker to trick people into downloading malicious files, scripts and other payloads. https://██████████?url=https:// PoC 1. I will show you how the page looks normally without any changes. If you directly access https://███ you will be shown the...
military-form.com Cross Site Scripting vulnerability OBB-1299595
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
QakBot Banking Trojan Returned With New Sneaky Tricks to Steal Your Money
A notorious banking trojan aimed at stealing bank account credentials and other financial information has now come back with new tricks up its sleeve to target government, military, and manufacturing sectors in the US and Europe, according to new research. In an analysis released by Check Point...
QakBot Banking Trojan Returned With New Sneaky Tricks to Steal Your Money
A notorious banking trojan aimed at stealing bank account credentials and other financial information has now come back with new tricks up its sleeve to target government, military, and manufacturing sectors in the US and Europe, according to new research. In an analysis released by Check Point...
Transparent Tribe: Evolution analysis, part 2
Background + Key findings Transparent Tribe, also known as PROJECTM or MYTHIC LEOPARD, is a highly prolific group whose activities can be traced as far back as 2013. In the last four years, this APT group has never taken time off. They continue to hit their targets, which typically are Indian...
Transparent Tribe Mounts Ongoing Spy Campaign on Military, Government
The APT group Transparent Tribe is mounting an ongoing cyberespionage campaign, researchers said, which is aimed at military and diplomatic targets around the world. The effort features a worm that can propagate from machine to machine while stealing files from USB removable drives. Transparent...
Defrauding the US Military: $379 million lost in 5 years to scams
By Sudais Asif The most successful scams targeting both in-service and retired US military veterans were... This is a post from HackRead.com Read the original post: Defrauding the US Military: $379 million lost in 5 years to scams...
NSA, FBI Warn of Linux Malware Used in Espionage Attacks
UPDATE The U.S. government is warning of new malware, dubbed Drovorub, that targets Linux systems. It also claims the malware was developed for a Russian military unit in order to carry out cyber-espionage operations. The malware, Drovorub, comes with a multitude of espionage capabilities,...
CactusPete APT group’s updated Bisonal backdoor
CactusPete also known as Karma Panda or Tonto Team is an APT group that has been publicly known since at least 2013. Some of the groups activities have been previously described in public by multiple sources. We have been investigating and privately reporting on this groups activity for years as...
Man convicted for identity theft & fraud against US Military, veterans
By Zara Khan The perpetrator was blatantly involved in victimizing thousands... This is a post from HackRead.com Read the original post: Man convicted for identity theft & fraud against US Military, veterans...
militarychildcareins.com Cross Site Scripting vulnerability OBB-1213269
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
IndigoDrop spreads via military-themed lures to deliver Cobalt Strike
By Asheer Malhotra. Cisco Talos has observed a malware campaign that utilizes military-themed malicious Microsoft Office documents maldocs to spread Cobalt Strike beacons containing full-fledged RAT capabilities. These maldocs use malicious macros to deliver a multistage and highly modular...