Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2018-1719, CVE-2018-1614, CVE-2012-5783, CVE-2018-1621, CVE-2018-1695, CVE-2018-1567)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

SAML Authentication Bypass

Wizkunde SAMLBase is vulnerable to authentication bypasses. This is due to the inconsistent handling of comments within XML nodes, resulting in the incorrect parsing of the inner text of XML nodes. This causes any inner text after the comment to be lost prior to signing of the SAML message. An...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

EU Cybersecurity Act IoT FAIL

The EU recently announced that its plans for a Cybersecurity Act had been backed by industry committee MEPs. This was a significant opportunity for consumer IoT security to be regulated and resolve the current mess. Sadly, they’ve stopped short and made the code voluntary for all but certain...

The Threats That Are Your Weakest Link

Coalfire published the latest report in its Securealities series, The Penetration Risk Report, and its based on findings from Coalfire penetration tests. It includes data drawn from engagements with businesses of all sizes, spanning financial services, retail, healthcare, and technology/cloud...

Excerpts from Modern Bank Heists – Threat Hunting Teams & CIR

Carbon Black recently published a report on the newest threats facing the financial world, and how to counteract them. For more information about how Cb Defense, Carbon Black's NGAV + EDR solution, helps enterprises address their endpoint security challenges, check out our weekly Cb Defense Live...

Building a Profitable Security Services Offering

Security is the number one concern of business owners today. This isn’t surprising, with all of the hacks, breaches, data thefts, ransomware attacks and privacy violations that we hear about on a daily basis. And those are just the ones we know about – according to the Online Trust Alliance’s OTA...

PCI DSS v3.2.1 – What You Need to Know

On Thursday, May 17, the PCI Security Standards Council PCI SSC released an updated version of the PCI DSS standard, primarily to include clarifications and minor revisions around controls that referenced SSL/early TLS. The new version removes notes referring to the effective date of February 1,...

PCI Compliance: Early-TLS and Cloud Service Providers

Organizations tracking their PCI compliance are likely aware of the impending June 30, 2018 deadline to disable SSLv3 and early-TLS. This blog post examines the special case of Cloud Service Providers CSPs and how their customers should proceed to achieve compliance...

Calls For Regulation Build After Facebook Privacy Fallout

As Facebook CEO Mark Zuckerberg appeared before Congress this week, politicians stressed the need for regulation to secure end users’ data privacy on social media platforms. The series of hearings on Tuesday and Wednesday gave members of Congress an opportunity to question Facebook about multiple...

Managing Your Vulnerabilities, FedRAMP Style

As a member of Coalfires Cyber Engineering team, I frequently get questions about vulnerability Deviation Requests DRs from Cloud Service Providers CSPs seeking Federal Risk and Authorization Management Program FedRAMP authorizations. In this post, Ill try to answer questions we frequently...

omniauth-saml authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

EulerOS 2.0 SP2 : ipsilon (EulerOS-SA-2018-1013)

According to the version of the ipsilon packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in ipsilon in the SAML2 provider's handling of sessions. An attacker able to hit the logout URL could determine what...

Mozilla Joins U.S. Attorneys General In Bid to Restore Net Neutrality

Mozilla has joined a coalition of U.S. state attorneys general in battling the Federal Communications Commission’s controversial recent ruling that overturned net neutrality laws. “The internet is a global, public resource,” Mozilla wrote in a blog post. “It relies on the core principle of net...

internetserviceprovidersisp.com XSS vulnerability

Open Bug Bounty ID: OBB-508925 Description| Value ---|--- Affected Website:| internetserviceprovidersisp.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinate...

Excerpts from The Ransomware Economy: Emergence and Innovation

Carbon Black recently published an investigative report on the Dark Web marketplace for ransomware. This is an excerpt from that report, which you can find here. For more information about the rise of ransomware, and what you can do about it, check out the Future-Proof Your Ransomware Prevention...

Top 10 Things CSPs Need to Know about FedRAMP Authorization on Amazon Web Services

Coalfire conducted a webinar, FedRAMP on AWS: What you need to know. The discussion covered what cloud service providers need to know when pursuing FedRAMP authorization leveraging AWS U.S East/West or GovCloud. Below youll find the Top 10 things that cloud service providers should know...

New Techniques in Fake Reviews

Research paper: "Automated Crowdturfing Attacks and Defenses in Online Review Systems." Abstract: Malicious crowdsourcing forums are gaining traction as sources of spreading misinformation online, but are limited by the costs of hiring and managing human workers. In this paper, we identify a new...

CVE-2017-12870

SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the SimpleSAML/Utils/Crypto class to protect session identifiers in replies to non-HTTPS service providers...

FedRAMP JAB Business Case extended

The FedRAMP Business Case for being considered for this cycle of the Joint Authorization Board JAB has been pushed out to August 31 at 5:00pm eastern. The additional time is to accommodate the large number of requests to document demand verification. Earlier the JAB has stated that federal demand...