SOC Forum 2017: How I Learned to Stop Worrying and Love Massive Malware Attacks

Today I spoke at SOC Forum 2017 in Moscow. It was a great large-scale event about Security Operation Centers. 2,700 people registered. Lots of people in suits . And lots of my good fellows. The event was held in Radisson Royal Congress Park. There were three large halls for presentations and a hu...

Sync Breeze 10.1.16 Buffer Overflow Vulnerability

Sync Breeze version 10.1.16 is vulnerable to a buffer overflow vulnerability, which can be exploited remotely or locally to achieve arbitrary code execution. The flaw is triggered by providing a long input into the "Destination directory" path of the application. Sync Breeze 10.1.16 Buffer Overfl...

Bad Rabbit Ransomware Uses Leaked 'EternalRomance' NSA Exploit to Spread

A new widespread ransomware worm, known as "Bad Rabbit," that hit over 200 major organisations, primarily in Russia and Ukraine this week leverages a stolen NSA exploit released by the Shadow Brokers this April to spread across victims' networks. Earlier it was reported that this week's...

Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene

In the first six months of 2017, ransomware threats reached new levels of sophistication. The same period also saw the reversal of a six-month downward trend in ransomware encounters. New ransomware code was released at a higher rate with increasing complexity. Two high-profile ransomware inciden...

Akamai Is Named A Leader In Gartner's Magic Quadrant For Web Application Firewalls

"Don't work for recognition, but do work worthy of recognition" - H. Jackson Brown. A friend sent this quote to me after I explained to her my ambivalence about being recognized by Gartner as a "Leader" in their Web Application Firewall Magic Quadrant. I had mixed feelings because I wanted to...

Microsoft Adding Artificial-Intelligence Based Advanced Antivirus to Windows 10

Microsoft is making every effort to make its Windows operating system more secure and advanced than ever before by beefing up its security practices and hardening it against hackers and cyber attacks in its next release. With the launch of its Windows 10 Creator Update also known as RedStone 3,...

Supply Chain Security: Akamai from a Customer's Risk Perspective

Managing risk is a key aspect of any business. This becomes more complicated when additional parties, such as vendors are brought into the mix. One of the strongest pieces of guidance on managing vendors that customers have brought to Akamai comes from the US Office of the Comptroller of the...

Ghost Blog 0.11.3 Cross Site Scripting Vulnerability

Tempest Security Intelligence Advisory ADV-9/2017 - Ghost Blog version 0.11.3 suffers from a persistent cross site scripting vulnerability. Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence -...

Ghost Blog 0.11.3 Cross Site Scripting

===== Tempest Security Intelligence - ADV-9/2017 ======================== Persistent Cross-Site Scripting XSS in Ghost ------------------------------------------------------- Author: - Patrick Costa Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents...

Audacity 2.1.2 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-7/2016 - Audacity version 2.1.2 is vulnerable to dll hijacking as it tries to load avformat-55.dll without supplying the absolute path, thus relying upon the presence of such dll on the system directory. This behavior results in an exploitable dll...

Atlassian Confluence < 5.10.6 - Persistent Cross-Site Scripting

===== Tempest Security Intelligence - ADV-3/2016 CVE-2016-6283 ============== Persisted Cross-Site Scripting XSS in Confluence Jira Software ---------------------------------------------------------------- Authors: - Jodson Santos - [email protected] Tempest Security Intelligence -...

Telegram Desktop 0.10.1 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-6/2016 - Telegram Desktop version 0.10.1 is vulnerable to dll hijacking as it tries to load "COMBASE.dll" without supplying the absolute path, thus relying upon the presence of such dll on the system directory. Unsafe DLL search path in Telegram Desktop...

Malvertising Campaign Pushing Neutrino Exploit Kit Shut Down

A global malvertising campaign exposing potentially one million users to the risk of being infected with CrypMIC ransomware delivered via the Neutrino Exploit Kit has been shut down, according to researchers. Cisco’s Talos Security Intelligence and Research Group, which discovered the criminal...

Machinae - Security Intelligence Collector

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Security Intelligence Collector: Machinae

Machinae is a tool for collecting intelligence from public sites/feeds about various security-related pieces of data: IP addresses, domain names, URLs, email addresses, file hashes and SSL fingerprints. It was inspired by Automater , another excellent tool for collecting information. The Machinae...

Microsoft Identifies New Malware Dropping Sefnit Botnet

Plenty has been written about the Sefnit malware family and its favor with using Tor to mask communication, as well as the money it’s made for criminals via click-fraud schemes. Sefnit, however, has had a pair of accomplices that until recently were regarded as harmless programs by most security...

VUPEN Security Research - Mozilla Firefox &quot;BumpChunk&quot; Object Processing Use-after-free &#40;Pwn2Own&#41;

VUPEN Security Research - Mozilla Firefox "BumpChunk" Object Processing Use-after-free Pwn2Own Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Mozilla Firefox is a free and open-source web browser developed for Windows, OS X, and Linux, with ...

Finland's Ministry of Foreign Affairs networks hit by sophisticated Malware attack

Finnish commercial broadcaster MTV3 reports that the Finnish Ministry of Foreign Affair networks has been targeted in a four-year-long cyber espionage operation. Finland's foreign minister said, "I can confirm there has been a severe and large hacking in the ministry's data network," A large scal...

Chinese computer maker Lenovo banned by Spy Agencies

According to a new report, the world's biggest personal computer maker, Chinese firm Lenovo Group Limited has reportedly been banned from supplying equipment for networks of the intelligence and defense services of Australia, the United States, Britain, Canada and New Zealand, due to hacking...

Microsoft Report Examines Socio-Economic Relationships to Malware Infections

Tired of all those malware and vulnerability reports that count how many of each have been reported to security companies? Well, Microsoft has taken a different tack in its latest Security Intelligence Report SIR by globally comparing regions’ relative security against socio-economic factors...