GlassRAT Remote Access Trojan

A remote access Trojan used sparingly in targeted attacks has been found after living under cover for three years, undetected by most security gear. The RAT, dubbed GlassRAT, was signed with a certificate belonging to a popular Chinese software company with hundreds of millions of users worldwide...

Dutch Police Arrest Alleged CoinVault Ransomware Authors

Ransomware has emerged as major threat to consumers and businesses in recent years, and law enforcement agencies and security researchers have taken note. Authorities last year disrupted the Cryptolocker ransomware operation and now Dutch police have arrested two young men they believe are involv...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The MSP versions do not...

SPF - SpeedPhish Framework

SPF SpeedPhish Framework is a python tool designed to allow for quick recon and deployment of simple social engineering phishing exercises. Requirements: dnspython twisted PhantomJS Usage: usage: spf.py -h -f -C --all --test -e -g -s --simulate -w -W -d -c --ip -v -y optional arguments: -h, --hel...

Airties login-cgi Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Airties login-cgi Buffer Overflow', 'Description' = %q This module exploits a remote buffer overflow vulnerability on several Airtie...

Microsoft Windows Service Control Manager Elevation of Privilege Vulnerability

Microsoft Windows is a popular operating system. A security vulnerability exists in Microsoft Windows that allows authenticated users to run special program elevations of privilege and invoke restricted target SCMs due to a failure of the Service Control Manager to properly calibrate the emulatio...

The Future of Healthcare Cybersecurity: The Best Defense is a Good Offense

In the last five years with the increasing digitalization of health information, healthcare security breaches have increased four-fold with the industry experiencing more breaches than any other in 2013. With a large number of potential targets and the high value of personal medical information o...

Design/Logic Flaw

The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debuggerapi.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension...

LLMNR Query

This module sends LLMNR queries, which are really just normal UDP DNS queries done usually over multicast on a different port, 5355. Targets other than the default RHOSTS' 224.0.0.252 should not respond but may anyway. This module requires Metasploit: https://metasploit.com/download Current sourc...

Massive, Decades-Long Cyberespionage Framework Uncovered

CANCUN–Researchers at Kaspersky Lab have uncovered a cyberespionage group that has been operating for at least 15 years and has worked with and supported the attackers behind Stuxnet, Flame and other highly sophisticated operations. The attackers, known as the Equation Group, used two of the zero...

New Strain of Banking Trojan Targets Android, Steals SMS

A relatively new Android Trojan that specializes in stealing banking information by intercepting SMS messages has been making the rounds. Researchers at zScaler spotted the as yet unnamed Trojan circulating as 888.apk. Like many types of malware that came before it, at least for the moment, the...

Nagios-history.cgi-Exec-Code

CVE-2012-6096 - Nagios history.cgi Remote Command Execution Another year, another reincarnation of classic and trivial bugs to exploit. This time we attack Nagios.. or more specifically, one of its CGI scripts. !/usr/bin/python CVE-2012-6096 - Nagios history.cgi Remote Command Execution...

2015 Computer Security Risks and Trends to Watch

P4ssw0rds got you down? POODLEs Bashing you over the head giving you Heartbleed? Well, bad puns aside, 2014 was a rough year and you can surely expect more of the same in 2015—with a few new twists. Hackers will still chase credit card numbers and point-of-sale systems, but they’ve got their eye ...

Costin Raiu on the Regin APT Malware

Denis Fisher talks with Costin Raiu of the Kaspersky Lab GReAT Team about the discovery of the Regin APT malware, the threat’s targets and tactics, its ability to compromise GSM base stations and its other capabilities. Download: digitalunderground173.mp3 Music by Chris Gonsalves...

Hikvision DVR RTSP Request Remote Code Execution

This module exploits a buffer overflow in the RTSP request parsing code of Hikvision DVR appliances. The Hikvision DVR devices record video feeds of surveillance cameras and offer remote administration and playback of recorded footage. The vulnerability is present in several models / firmware...

Pro-Syrian Malware Increasing in Number, Complexity

As the civil war in Syria continues, malware targeting those who oppose the embattled regime of Bashar al Assad is increasing in number, organization and sophistication according to a new report from Kaspersky Lab’s Global Research and Analysis Team. Most of the malware samples related to the...

MGASA-2014-0327 Updated kdelibs4 packages fix security vulnerability and various bugs

This update fixes a security vulnerability in the polkit authentication backend of kdelibs CVE-2014-5033 mga13792, and fixes some additional issues: - duplicate targets in PythonMacros.cmake reviewboard kde 111371, - kded4 leak sockets in NetworkInterface::isWireless bko324954, - media type...

D-Link info.cgi POST Request Buffer Overflow

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpClient include...

90 Percent of the Information Intercepted by NSA Belongs to Ordinary Internet Users

If anybody says that NSA is watching you, nobody surprises. But, a large scale investigation published by Washington Post indicates that the scope of surveillance carried out by US National Security Agency was massive even than the expectation of you and me. Just because you are an ordinary perso...

Cridex Variant Geodo Part Trojan, Part Email Worm

A knockoff of the Cridex banking Trojan has surfaced with an appetite for more than online banking credentials. Seculert has called this one Geodo—a take on another of Cridex’s many aliases Feodo—and has confirmed that the malware comes with an efficient self-replicating feature borne of stolen...