Beers with Talos EP27: Smart Install, Vuln Process Realities, and Professional Wrestling

Beers with Talos BWT Podcast Episode 27 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP27 Show Notes: Recorded 4/13/18 - We just upgraded all our gear, so naturally we had a straight tech...

Moxa EDR-810 Service Agent Multiple Denial of Service Vulnerabilities

Summary Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted packet can cause a denial of service. An attacker can send a large packet to 4000/tcp and 4001/tcp to trigger this vulnerability. Tested Version...

Moxa EDR-810 Plaintext Password Storage Vulnerability

Summary An password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An attacker with shell access could extract passwords in clear text from the device. Tested Versions Moxa EDR-810 V4.1 build 17030317 Product URLs...

Vulnerability Spotlight: TALOS-2018-0529-531 - Multiple Vulnerabilities in NASA CFITSIO library

Vulnerabilities discovered by Tyler Bohan from Talos Overview Talos is disclosing three remote code execution vulnerabilities in the NASA CFITSIO library. CFITSIO is a library of C and Fortran subroutines for reading and writing data files in the Flexible Image Transport System FITS data format...

Beers with Talos EP26: Talos is Holding a Conference, and the Evolving Battle at the Edge

Beers with Talos BWT Podcast Episode 26 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP26 Show Notes: Recorded 3/29/18 - Joel is sitting out this week, and Bill Largent from the Outreach...

Circle with Disney WiFi Insecure Access Point Vulnerability

Summary An exploitable vulnerability exists in the WiFi Access Point feature of Circle with Disney running firmware 2.0.1. A series of WiFi packets can force Circle to setup an Access Point with default credentials. An attacker needs to send a series of spoofed “de-auth” packets to trigger this...

GoScanSSH Malware Targets SSH Servers, But Avoids Military and .GOV Systems

Researchers have identified a new malware family, dubbed GoScanSSH, that targets public facing SSH servers, but avoids those linked to government and military IP addresses. The malware has been in the wild since June 2017 and exhibits a number of unique characteristics, such as being written in t...

Talos Threat Research Summit at Cisco Live US 2018

Cisco Talos presents a conference by Defenders, for Defenders. Talos had one goal in mind when creating a brand new conference: Make something that we'd want to attend ourselves. As such, the Talos Threat Research Summit is aimed at being a one-day conference by defenders, for defenders. This...

Beers with Talos EP 25: WE'LL DO IT LIVE!!!

Beers with Talos BWT Podcast Episode 25 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP25 Show Notes: Recorded 3/13/18 - LIVE from San Jose, California. First of all – we still have a...

VMSA-2018-0008:Workstation and Fusion updates address a denial-of-service vulnerability

VMSA-2018-0008 Workstation and Fusion updates address a denial-of-service vulnerability VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0008 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: Workstation and Fusion updates address a...

OlympicDestroyer is here to trick the industry

A couple of days after the opening ceremony of the Winter Olympics in Pyeongchang, South Korea, we received information from several partners, on the condition of non-disclosure TLP:Red, about a devastating malware attack on the Olympic infrastructure. A quick peek inside the malware revealed a...

Vulnerability Spotlight: Simple DirectMedia Layer’s SDL2_Image

Overview Talos is disclosing several vulnerabilities identified in Simple DirectMedia Layer's SDL2Image library that could allow code execution. Simple DirectMedia Layer is a cross-platform development library designed to provide low-level access to audio, keyboard, mouse, joystick and graphics...

Remote Code Execution Bug Patched in Adobe Acrobat Reader DC

Researchers at Cisco Talos are detailing a remote code execution vulnerability found in Adobe Acrobat Reader DC that can be triggered when a malicious file is opened or a victim accesses a rigged webpage. According to Talos, the vulnerability CVE-2018-4901 was disclosed on Dec. 7 and Adobe issued...

Adobe Flash Player Use After Free Remote Code Execution Vulnerability(CVE-2018-4878)

EXECUTIVE SUMMARY The 1st of February, Adobe published an advisory concerning a Flash vulnerability CVE-2018-4878. This vulnerability is a use after free that allows Remote Code Execute through a malformed Flash object. Additionally KISA Korean CERT published an advisory about a Flash 0-day used ...

Beers with Talos EP23 - Eternal Fauxmance: Attribution Easter Eggs

Beers with Talos BWT Podcast Episode 23 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing: www.talosintelligence.com/podcast EP23 Show Notes: Recorded 2/16/18 - This week, Mitch learns about starting a show without Matt with no...

Talos Quarterly Threat Briefing - Winter 2018

Date: Tuesday, February 27, 2018 Time: 1:00pm ET/10:00am PT Topic: Miners, Malspam, and Meltdowns Recording available here: Space is limited for this event, so be sure to save your spot. Following the webinar, the video will also be made available here. In this edition of the Talos Quarterly Thre...

Threat Round Up for Feb 9 - Feb 16

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between February 9 and February 16. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

Researchers Find New Twists In ‘Olympic Destroyer’ Malware

Researchers have uncovered new wrinkles in the “Olympic Destroyer” malware attack that targeted the Winter Olympics in Pyeongchang, South Korea. Cisco Talos researchers now believe the malware also wipes files on shared network drives. Originally researchers believed the malware only targeted...

Targeted Attacks In The Middle East

This blog post is authored by Paul Rascagneres with assistance of Martin Lee. Executive Summary Talos has identified a targeted attacks affecting the Middle East. This campaign contains the following elements, which are described in detail in this article. The use of allegedly confidential decoy...

New Monero Crypto Mining Botnet Leverages Android Debugging Tool

A new botnet that distributes malware for mining Monero cryptocurrency has emerged, infecting Android devices through a port linked with a debugging tool for the OS, according to researchers at Qihoo 360 Netlab. Dubbed ADB.Miner by 360 Netlab, the botnet is gaining entry to Android devices–mostly...