676 matches found
Opinion: Don't Let a Tech Slowdown Threaten Our Military
The right software and digital engineering can take military aircraft back to the future...
U.S. Government, Military Personnel Data Leaked By Autoclerk
A leaky database owned by reservations management system Autoclerk has exposed the personal data and travel information for thousands of users – including U.S. government and military personnel. Autoclerk, which was acquired by the Best Western Hotel and Resorts Group in August, provides...
How Tortoiseshell created a fake veteran hiring website to host malware
By Warren Mercer and Paul Rascagneres with contributions from Jungsoo An. Introduction Cisco Talos recently discovered a threat actor attempting to take advantage of Americans who may be seeking a job, especially military veterans. The actor, previously identified by Symantec as Tortoiseshell,...
News Wrap: GandCrab Operators Resurface, Utilities Firms Hit By LookBack Malware
On this week’s news wrap podcast, Threatpost editors Tara Seals and Lindsey O’Donnell break down the top news, including: Despite claiming they were retiring, GandCrab’s authors have been linked to the REvil/Sodinokibi ransomware via a technical analysis. A spearphishing campaign, first spotted i...
Threat Source newsletter (Sept. 26)
Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. An attacker known as “Tortoiseshell” is using a phony, malicious website to deliver malware. The site specifically targets U.S. military...
U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (████.███.mil)
The CVE-2018-0296 vulnerability was discovered in a Cisco VPN system. It allowed an unauthenticated attacker to perform path traversal and disclose sensitive information such as VPN sessions and user files. The issue was addressed by updating to a patched version that returned a 404 "File not...
The Myth of Consumer-Grade Security
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that's not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical...
U.S. Dept Of Defense: Command Injection (via CVE-2019-11510 and CVE-2019-11539)
Summary: The Navy has a Pulse Secure SSL VPN https://████████/dana-na/auth/urldefault/welcome.cgi that is vulnerable to: CVE-2019-11510 - Pre-auth Arbitrary File Reading CVE-2019-11539 - Post-auth Command Injection vulnerable hostname from ssl certificate: ██████████.navy.mil The pre-auth arbitra...
U.S. Dept Of Defense: Partial SSN exposed through Presentation slides on ██████████
Summary: During a search of ████████ I discovered that one of the slides ina presentation contained a screen shot of live data. Description: The slides describe testing and using military application to organize and aggregate data on users. On one of the slides it does show a screen shot of actua...
U.S. Dept Of Defense: PII leakage-Full SSN on ███
Summary: I discovered a pdf file on ████████ that outlines various information corresponding to military members. It reveals information on date of birth, where they were born, marriage status, race, children/dependents, etc Description: I discovered what looks to be an internal file that outline...
Chinese Military Wants to Develop Custom OS
Citing security concerns, the Chinese military wants to replace Windows with its own custom operating system: Thanks to the Snowden, Shadow Brokers, and Vault7 leaks, Beijing officials are well aware of the US' hefty arsenal of hacking tools, available for anything from smart TVs to Linux servers...
Zebrocy: A Russian APT Specializing in Victim Profiling, Access
Zebrocy, the Russian speaking threat group that shares similarities and overlaps with both the Sofacy and BlackEnergy APTs, is once again roaming the wide plain of government, foreign-affairs and military targets. Researchers have spotted the group using a new first-stage malware dropper in recen...
U.S. Charges WikiLeaks' Julian Assange With Violating Espionage Act
The United States Justice Department has unveiled charges against WikiLeaks founder Julian Assange with 17 new counts on the alleged violation of the Espionage Act by publishing classified information through WikiLeaks website. If convicted for all counts, Assange could face a maximum sentence of...
U.S. Dept Of Defense: ████ - Complete account takeover
Summary: ███████ ██████████ was updated today 03/04, which includes a backend rewrite. Unfortunately, the new site is insecure and allows a password to be reset given only a username. This allows access to payment records for any DoD employee given only their username, which is commonly known...
Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic
In early 2019, FireEye Threat Intelligence identified a spear phishing email targeting government entities in Ukraine. The spear phishing email included a malicious LNK file with PowerShell script to download the second-stage payload from the command and control C&C server. The email was received...
Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms
An Iran-linked cyber-espionage group that has been found targeting critical infrastructure, energy and military sectors in Saudi Arabia and the United States two years ago continues targeting organizations in the two nations, Symantec reported on Wednesday. Widely known as APT33, which Symantec...
Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns
A recently discovered vulnerability in the WinRAR file archival utility has been exploited in a slew of new campaigns, including one with a never-before-seen payload. The flurry of activity shows no sign of waning as cybercriminals continue to find success exploiting the bug. The campaigns take...
The Air Force Wants to Give You Its Credit Card
Will Roper, acquisition executive for the US Air Force, talks to WIRED's editor in chief about making the military more adaptive, the role of AI, and what he worries about every day...
RSAC 2019: Bronze Union APT Updates Remote Access Trojans in Fresh Wave of Attacks
The notorious Chinese-linked threat group, dubbed Bronze Union, has been spotted in a widespread 2018 campaign updating its arsenal of cyberweapons by breathing new life into old tools. The threat group was spotted in 2018 using updated source code to target data owned by political, technology,...