A week in security (September 3 – 9)

Last week on Malwarebytes Labs, we looked at spyware going mainstream, how the popular game Fortnite sparks security concerns for Android users, and how certain Mac App Store apps are stealing user data. Other cybersecurity news: Microsoft announced Windows 7 Extended Security Updates in a blog...

Teen arrested for DDoS attack on ProtonMail & making fake bomb threats

By Waqas ProtonMail, a Swiss-based end-to-end email encryption service, has announced the name of one of the attackers involved in the DDoS attack against the company earlier this year. Due to the attack, the email service of ProtonMail stopped responding for a minute several times despite having...

Leader of DDoS-for-Hire Gang Pleads Guilty to Bomb Threats

A 19-year-old man from the United Kingdom who headed a cybercriminal group whose motto was "Feds Can't Touch Us" pleaded guilty this week to making bomb threats against thousands of schools. On Aug. 31, officers with the U.K.'s National Crime Agency NCA arrested Hertfordshire resident George...

GD bbPress 2.5 Cross Site Scripting

An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary javascript code via filename. The arbitrary code runs both on the topic page and in the admin panel, and it only affects the administrators, moderators and the attacker. The variable $errorafilea in...

Linux/x86 - Disable ASLR Security + Obfuscated Shellcode (23 bytes)

Linux/x86 - Disable ASLR Security + Obfuscated Shellcode 23 bytes. Shellcode exploit for Linuxx86 platform ;Title : Linux/x86 - Disable ASLR Security obfuscated shellcode - 23 bytes ;Date : 24 Jan 2018 ;Author : 0xAlaufi ;Tested on : Linux/x86 Ubuntu 12.04.5 global start section .text start: jmp...

Mailsploit vulnerability exists in email address resolution

TL;DR: Mailsploit is a collection of bugs in email clients that allow effective sender spoofing and code injection attacks. The spoofing is not detected by Mail Transfer Agents MTA aka email servers, therefore circumventing spoofing protection mechanisms such as DMARC DKIM/SPF or spam filters. Bu...

MailSploit — Email Spoofing Flaw Affects Over 30 Popular Email Clients

If you receive an email that looks like it's from one of your friends, just beware! It's possible that the email has been sent by someone else in an attempt to compromise your system. A security researcher has discovered a collection of vulnerabilities in more than 30 popular email client...

“ProtonMail Contacts” world’s first encrypted contacts manager is here

By Waqas The world-renowned encrypted email service provider ProtonMail is back in the This is a post from HackRead.com Read the original post: ProtonMail Contacts worlds first encrypted contacts manager is here...

ProtonMail Launches Free VPN Service

Encrypted email service ProtonMail announced today it was launching a free VPN service called ProtonVPN. Developers said the move comes following one year of development and four months of beta testing by 10,000 ProtonMail community members. According to Proton Technologies AG, the company behind...

Free Mac Ransomware-as-a-Service MacRansom Surfaces

Researchers on Friday began warning of MacRansom, a new and free macOS-based ransomware as a service RaaS that’s been making the rounds over the past several weeks. It leverages a portal hosted on the Tor network, but attackers looking for the malware won’t find it there. Interested parties need ...

ProtonMail - Encrypted Email - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application ProtonMail - Encrypted Email published at the 'play' market has multiple vulnerabilities...

ProtonMail Gets Own Tor-Accessible .Onion Hidden Service

Users of the encrypted email service ProtonMail looking for an extra layer of security now have the option of accessing their inbox directly through the Tor network. ProtonMail, originally developed by CERN and MIT scientists, announced Thursday it had added its own Tor hidden service. According ...

The Best Way to Send and Receive End-to-End Encrypted Emails

How many of you know the fact that your daily e-mails are passaged through a deep espionage filter? This was unknown until the whistleblower Edward Snowden broke all the surveillance secrets, which made privacy and security important for all Internet users than ever before. I often get asked "How...

Linux x86/x86_64 Read etc/passwd Shellcode

Linux x86/x8664 Read etc/passwd Shellcode. Shellcode exploit for linux platform / + Author : B3mB4m Contact : [email protected] Project : https://github.com/b3mb4m/Shellsploit Greetz : Bomberman,T-Rex,KnocKout,ZoRLu If you want test it, you must compile it within x86 OS. Or basically you can...

Experts Say Bitcoin Extortionist Copycats on the Rise

Experts believe that the success tied to a recent spate of DDoS-for-hire groups may be because many are copycat collectives operating with a shorter lifespan. Researchers with Recorded Future, a Massachusetts-based firm that tracks real time threat intelligence, said Monday that they’ve noticed a...

ProtonMail Back Online Following Six Day DDoS Attack

Encrypted email service ProtonMail is back online today following a crippling six-day attack that saw the company’s ISPs and data centers under siege. Operators behind the service said the site may not always be reachable, as its servers are still under heavy strain and mitigating attack, and tha...

ProtonMail Paid Hackers $6000 Ransom in Bitcoin to Stop DDoS Attacks

The Geneva-based encrypted email service ProtonMail was forced to pay a Ransom of almost $6,000 to stop sustained Denial-of-service DDoS attacks that have knocked its service offline since Tuesday. ProtonMail – a full, end-to-end encrypted email service that launched last year – has been dealing...

PayPal Unfreezes Secure Email Startup ProtonMail's Account

PayPal unfroze the account of Swiss secure email upstart ProtonMail late this morning, freeing at least $300,000 the service raised, that for a day, had seemingly been left in limbo. A blog post by ProtonMail CEO Andy Yen Monday claimed that his company’s account had been “restricted pending...

PayPal Freezes $275,000 Campaign Funds of Secure-Email Startup 'ProtonMail'

ProtonMail, an End-to-End Encrypted email service developed by MIT, Harvard and CERN researchers, who already received over $275,000 from a crowdfunding campaigns to their PayPal account, and was so much excited to launch its beta version, but just before that PayPal freezes their account without...

ProtonMail.ch Header Injection / CSRF

SecurityAdvisory ---------------- Time Line Vulnerability ------------------------------- -Day 05-05-2014 Security Advisory = No response -Days 08 12 19-05-2014 Multiples Advisories = No Response -Day 20-05-2014 Full Disclosure Alerts summary -CRLF injection/HTTP response splitting...