Teaming up in the war on tech support scams

Editors note: Erik Wahlstrom spoke about the far-reaching impact of tech support scams and the need for industry-wide cooperation in his RSA Conference 2018 talk Tech Scams: Its Time to Release the Hounds. Social engineering attacks like tech support scams are so common because theyre so effectiv...

Perspectives on Russian hacking

Russia is an endlessly fascinating subject both in and around infosec. Recent years have shifted attention away from pure malware capabilities, to psyops, social engineering, and an endless slew of mind games designed to destabilize and keep nations ever-so-slightly off balance. Security firms in...

Magnitude exploit kit switches to GandCrab ransomware

The GandCrab ransomware is reaching far and wide via malspam, social engineering schemes, and exploit kit campaigns. On April 16, we discovered that Magnitude EK, which had been loyal to its own Magniber ransomware, was now being leveraged to push out GandCrab, too. While Magnitude EK remains...

Arm your users with knowledge to spot phishing attacks – for free!

Attendees to the Black Hat 2017 security conference said their No. 1 security concern and most time-consuming activity was phishing and social engineering attacks. That’s no surprise with the increase in Business Email Compromise BEC attacks and with most ransomware being delivered by email. But...

Unikrn: CSRF logs the victim into attacker's account

Description: There is no session validation while logging in which leads to csrf. Steps To Reproduce: 1. Create a CSRF login POC using the following code. 2. Replace the email and password with the valid credentials. 3. Send the script to the victim to make them click. References: 1. You've...

Facebook Graph Metadata Crosswalk Mapping Proof Of Concept

!/usr/bin/perl Facebook 'Graph' metadata crosswalk mapping PoC 2018 Todor Donev https://ethical-hacker.org/ https://facebook.com/ethicalhackerorg Description: Criminal hacker CRACKER can take advantage of this weakness by creating a specialized database to manipulate facebook users with fake news...

Google Play Boots Three Malicious Apps From Marketplace Tied to APTs

Two advanced persistent threat groups managed to sneak apps onto the Google Play marketplace earlier this year. Both were designed to conduct surveillance on targets located in the Middle East region, according to Lookout security researchers. One of the groups, identified as APT-C-23 also known ...

LocalTapiola: Reflected XSS of bbe-child-starter Theme via "value"-GET-parameter

This bug is related to 324442. And xss in other url. poc: https://www.lahitapiolarahoitus.fi/wp-content/themes/bbe-child-starter/bbe-engine/assets/actions/bbeopenhtmleditorpopup.php?attribute=%27%3C/script%3E%3Cbody%20onload&value=alertdocument.cookie Impact -Make admin-user run malicious...

‘FakeUpdates’ campaign leverages multiple website platforms

A malware campaign which seems to have started at least since December 2017 has been gaining steam by enrolling a growing number of legitimate but compromised websites. Its modus operandi relies on social engineering users with fake but convincing update notifications. Similar techniques were use...

Node.js third-party modules: npm packages that overlap with core node packages

Hi, I have posted here, but I wanted to make you aware of this easy social engineering trick. I do not want to claim any of these are currently malicious, but it they easily could be. Thanks, Marc Impact The attacker could do anything...use the postinstall as the user, work the same as steal data...

Easter Holiday Phishing Scams and Malware Campaigns

As the Easter holiday approaches, NCCIC/US-CERT reminds users to be aware of potential holiday scams and cyber campaigns, which may include emails and ecards from unknown senders that may contain malicious links, fake advertisements or shipping notifications with attachments infected with malware...

IC3 Issues Alert on Tech Support Fraud

The Internet Crime Complaint Center IC3 has released an alert on tech support fraud. Tech support fraud involves criminals claiming to provide technical support to fix problems that don't exist. Their methods include placing calls, sending pop-ups, engaging misleading lock screens, and sending...

CVE-2018-5143

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting XSS attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute. This could allow users to be socially...

LocalTapiola: Reflected XSS on bbe_open_htmleditor_popup.php of BBE Theme via "value"-GET-parameter

Basic report information Summary: The BBE Theme allows unauthorized access to bbeopenhtmleditorpopup.php which echoes unsanitized values of value-GET-parameter leading to reflected XSS. Description: The www.lahitapiolarahoitus.fi has Wordpress with theme BBE Theme v1.52. I did some code review an...

MyCrypto: Missing SPF Records.

What Is SPF/TXT Records? An SPF record is a type of Domain Name Service DNS record that identifies which mail servers are permitted to send email on behalf of your domain. The purpose of an SPF record is to prevent spammers from sending messages with forged From addresses at your domain. Checking...

Python-Rootkit - Python Remote Administration Tool (RAT) To Gain Meterpreter Session

This is a full undetectable python RAT which can bypass almost all antivirus and open a backdoor inside any windows machine which will establish a reverse httpsMetasploit connection to your listening machine. ViRu5 life cycle Bypass all anti-virus. Inject a malicious powershell script into memory...

Hirschmann Automation and Control GmbH Classic Platform Switches

CVSS v3 7.5 ATTENTION: Exploitable remotely/high skill level is needed to exploit. Vendor: Hirschmann Automation and Control GmbH, a division of Belden Inc. Equipment: Classic Platform Switches Vulnerabilities: Session Fixation, Information Exposure Through Query Strings in GET Request, Cleartext...

Schneider Electric SoMove Software and DTM Software Components

CVSS v3 7.8 Vendor: Schneider Electric Equipment: SoMove software and DTM software components Vulnerability: Uncontrolled Search Path Element AFFECTED PRODUCTS Schneider Electric reports the vulnerability affects the following SoMove software and DTM software components: SoMove software, versions...

Risk Misconceptions in Social Engineering Testing

The post Risk Misconceptions in Social Engineering Testing appeared first on Rhino Security Labs...

New BEC Spam Campaign Targets Fortune 500 Businesses

Researchers have identified a wave of new business email compromise campaigns targeting Fortune 500 companies that are designed to trick victims into fraudulent wire transfers. Researchers said the campaigns originate from Nigeria and are targeting companies in the retail, healthcare and financia...