Destructive and MiTM Capabilities of VPNFilter Malware Revealed

It turns out that the threat of the massive VPNFilter botnet malware that was discovered late last month is beyond what we initially thought. Security researchers from Cisco's Talos cyber intelligence have today uncovered more details about VPNFilter malware, an advanced piece of IoT botnet malwa...

Target Credential Issues by Authentication Protocol - No Issues Found

Valid credentials were provided for an authentication protocol on the remote target and Nessus did not log any subsequent errors or failures for the authentication protocol. When possible, Nessus tracks errors or failures related to otherwise valid credentials in order to highlight issues that ma...

PVS targets using MAK Licensing intermittently fail to reactivate

PVS targets using a vdisk that has the radio button set to MAK licensing will intermittently fail to reactivate after rebooting. PVS CDF traces may also show an error that the device does not exist in the VAMT database. "Device: 10.10.10.10 not found in Vamt database."...

IMP XForm 2.0 DatalifeEngine SQL Injection

Exploit Title: IMP XForm v2.0 DatalifeEngine Module SQL Injection Exploit Author: Hesam Bazvand Software Link: http://www.datalifeengine.ir/download/1396/IMP.XForm.v2.0.zip Tested on: Windows 10 / Kali Linux Category: WebApps Dork : inurl:xform/1.html OR inurl:xform/2.html and etc... Email :...

Steamed Hams

but it's a Metasploit Module Module Options msf use exploit/multi/hams/steamed msf undefinedsteamed show actions ...actions... msf undefinedsteamed set ACTION msf undefinedsteamed show options ...show and set options... msf undefinedsteamed run This module requires Metasploit:...

Octopus Deploy has an unspecified vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A security vulnerability exists in Octopus Deploy. An attacker could exploit this vulnerability to view deployment targets and create associated variables...

DEBIAN-CVE-2018-0733

Because of an implementation bug the PA-RISC CRYPTOmemcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security...

Alleged Mastermind Behind Carbanak Crime Gang Arrested

The suspected mastermind behind the Carbanak criminal gang, which is notorious for stealing as much as $1 billion from more than 100 financial institutions in a string of attacks, has been apprehended, according to the Spanish National Police. According to the European Union Agency for Law...

A Closer Look at APT Group Sofacy’s Latest Targets

Threatpost talks to Kaspersky Lab researcher Kurt Baumgartner who was instrumental in tracking the latest activities of the Russian-speaking Sofacy APT gang. Research shows a continual march toward Far East targets and overlapping of activities with other groups such as Lamberts, Turla and Danti...

Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries

Intrusions Focus on the Engineering and Maritime Sector Since early 2018, FireEye including our FireEye as a Service FaaS, Mandiant Consulting, and iSIGHT Intelligence teams has been tracking an ongoing wave of intrusions targeting engineering and maritime entities, especially those connected to...

Android malware HenBox hits Xiaomi devices & minority group in China

By Waqas The IT security researchers at Palo Alto Networks’ Unit 42 This is a post from HackRead.com Read the original post: Android malware HenBox hits Xiaomi devices & minority group in China...

A Slice of 2017 Sofacy Activity

Sofacy, also known as APT28, Fancy Bear, and Tsar Team, is a highly active and prolific APT. From their high volume 0day deployment to their innovative and broad malware set, Sofacy is one of the top groups that we monitor, report, and protect against. 2017 was not any different in this regard. O...

CrossRAT keylogging malware targets Linux, macOS & Windows PCs

By Waqas Another day, another malware - This time, it is CrossRAT malware This is a post from HackRead.com Read the original post: CrossRAT keylogging malware targets Linux, macOS & Windows PCs...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of January 22, 2018

Yesterday, the Zero Day Initiative ZDI announced the dates and contest rules for Pwn2Own 2018. Last year, we celebrated the 10th anniversary of the event and the 11th year is going to be bigger than ever! Pwn2Own will be returning to Vancouver, BC, at the CanSecWest Conference on March 14-16, 201...

January 17, 2018—KB4057401 (Preview of Monthly Rollup)

None None...

Korea In The Crosshairs

This blog post is authored by Warren Mercer and Paul Rascagneres and with contributions from Jungsoo An. A one year review of campaigns performed by an actor with multiple campaigns mainly linked to South Korean targets. Executive Summary This article exposes the malicious activities of Group 123...

Harbor 'Ping()' Function Server-Side Cross-Site Forgery Vulnerability

Harbor is an open source, enterprise-grade registry server that also provides advanced security features such as user management, access control and activity auditing. A server-side cross-site forgery vulnerability exists in the 'Ping' function of the ui/api/targets.go file in Harbor 1.3.0-rc4 an...

Server side request forgery (ssrf)

The Ping function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping...

CVE-2017-17697

The Ping function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/ping...

Octopus Deploy Information Disclosure Vulnerability

Octopus allows attackers to obtain sensitive cleartext information by reading a variable JSON file in certain situations involving Offline Drop Targets. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...