Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders

Summary The Federal Bureau of Investigation FBI, Department of Homeland Security DHS, and Cybersecurity and Infrastructure Security Agency CISA assess Russian Foreign Intelligence Service SVR cyber actors—also known as Advanced Persistent Threat 29 APT 29, the Dukes, CozyBear, and Yttrium—will...

FBI-DHS-CISA Joint Advisory on Russian Foreign Intelligence Service Cyber Operations

The Federal Bureau of Investigation FBI, Department of Homeland Security, and CISA have released a Joint Cybersecurity Advisory CSA addressing Russian Foreign Intelligence Service SVR cyber actors—also known as Advanced Persistent Threat 29 APT 29, the Dukes, CozyBear, and Yttrium—continued...

Threat Advisory: NSA SVR Advisory Coverage

The U.S. National Security Agency released an advisory outlining several vulnerabilities that the Russian Foreign Intelligence Services SVR is exploiting in the wild. The U.S. formally attributed the recent SolarWinds supply chain attack to the SVR group in this advisory and detailed more of the...

US Sanctions Russia and Expels 10 Diplomats Over SolarWinds Cyberattack

The U.S. and U.K. on Thursday formally attributed the supply chain attack of IT infrastructure management company SolarWinds with "high confidence" to government operatives working for Russia's Foreign Intelligence Service SVR. "Russia's pattern of malign behaviour around the world – whether in...

CISA and CNMF Analysis of SolarWinds-related Malware

CISA and the Department of Defense DoD Cyber National Mission Force CNMF have analyzed additional SolarWinds-related malware variants—referred to as SUNSHUTTLE and SOLARFLARE. One of the analyzed files was identified as a China Chopper webshell server-side component that was observed on a network...

NSA-CISA-FBI Joint Advisory on Russian SVR Targeting U.S. and Allied Networks

CISA, the National Security Agency NSA, and the Federal Bureau of Investigation FBI have released a Joint Cybersecurity Advisory CSA on Russian Foreign Intelligence Service SVR actors scanning for and exploiting vulnerabilities to compromise U.S. and allied networks, including national security a...

Latest on the SVR’s SolarWinds Hack

The New York Times has an in-depth article on the latest information about the SolarWinds hack not a great name, since its much more far-reaching than that. Interviews with key players investigating what intelligence agencies believe to be an operation by Russia’s S.V.R. intelligence service...

Cybersecurity Firm FireEye Got Hacked; Red-Team Pentest Tools Stolen

FireEye, one of the largest cybersecurity firms in the world, said on Tuesday it became a victim of a state-sponsored attack by a "highly sophisticated threat actor" that stole its arsenal of Red Team penetration testing tools it uses to test the defenses of its customers. The company said it's...

PT-2020-20237

Name of the Vulnerable Software and Affected Versions Askey AP4000W TDC V1.01.003 Description An issue allows an attacker to perform Remote Code Execution RCE by sending a specially crafted network packet to the bd svr service listening on TCP port 54188. Recommendations For Askey AP4000W TDC...

Design/Logic Flaw

The recvmsguserauthrequest function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSHMSGUSERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase...

CVE-2018-15599

The recvmsguserauthrequest function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSHMSGUSERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase...

CVE-2018-15599: Exposure of Sensitive Information to an Unauthorized Actor

The recvmsguserauthrequest function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSHMSGUSERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase...

PT-2018-13107

Name of the Vulnerable Software and Affected Versions Dropbear versions prior to 2018.76 Description The issue is related to a user enumeration problem in the recv msg userauth request function. This function is located in svr-auth.c and is prone to a vulnerability because the validity of usernam...

Kingsoft WPS Office Free Elevation of Privilege Vulnerability

Kingsoft WPS Office Free is a free office software suite from the Chinese company Kingsoft, commonly used components include: Writer word processing, Spreadsheets electronic forms and Presentation presentation. A security vulnerability exists in Kingsoft WPS Office Free version 10.2.0.5978. A loc...

Solaris 10 (x86) : 141710-03

Sun GlassFish Enterprise Server v2.1.1 Security Patch01, x86: SVR. Date this patch was last updated by Sun : Jan/08/10 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc';...

svr-mmm-pc.com XSS vulnerability

Vulnerable URL: http://www.svr-mmm-pc.com/?s=%22%3E%3Csvg%20onload=alert%22OPENBUGBOUNTY%22%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 340553 VIP website status:| No Coordinated Disclosure Timeline:...

Over Half a Million Vehicle Records from SVR Tracking Leaked Online

By Waqas Over Half a Million Vehicle Records from SVR Tracking Leaked This is a post from HackRead.com Read the original post: Over Half a Million Vehicle Records from SVR Tracking Leaked Online...

Passwords For 540,000 Car Tracking Devices Leaked Online

Another day, another news about a data breach, though this is something disconcerting. Login credentials of more than half a million records belonging to vehicle tracking device company SVR Tracking have leaked online, potentially exposing the personal data and vehicle details of drivers and...

PT-2014-1929

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions prior to 1.13 Description The issue allows remote authenticated users to forge tickets by leveraging administrative access. This is due to the kadm5 randkey principal 3 function in lib/kadm5/srv/svr principal.c in kadmi...

PT-2013-5044

Name of the Vulnerable Software and Affected Versions TORQUE Resource Manager versions prior to 4.2.6 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the email -M switch to qsub, due to a problem in the send the mail function in server/svr...