New Relic: APT repository is signed using weak digest (SHA-1)

When installing New Relic on a new Ubuntu 16.04 xenial machine to test out the beta, I noticed this warning: W: gpgv:/var/lib/apt/lists/apt.newrelic.comdebiandistsnewrelicRelease.gpg: The repository is insufficiently signed by key B60A3EC9BC013B9C23790EC8B31B29E5548C16BF weak digest This...

Debian Security Advisory DSA 3525-1 (pixman - security update)

Vincent LE GARREC discovered an integer overflow in pixman, a pixel-manipulation library for X and cairo. A remote attacker can exploit this flaw to cause an application using the pixman library to crash, or potentially, to execute arbitrary code with the privileges of the user running the...

CanSecWest 2016 Attack Attribution False Flags

With every APT report there comes the gnawing question of whodunit. Just this week, a Reuters report linked a spree of ransomware attacks against U.S. companies to state-sponsored hacker groups in China. Most reports, however, offer no tangible evidence other than technological footprints that ca...

Lessons from Operation RussianDoll

As defensive security controls raise the bar to attack, attackers will employ increasingly sophisticated techniques to complete their mission. Understanding the mechanics and impact of these threats is essential to systematically discover and deflect the coming wave of advanced attacks. Mandiant...

Vigilant in the use of Microsoft Office EPS vulnerability-vulnerability warning-the black bar safety net

Introduction Recently, APT and early warning platform to capture to an attack sample, after analysis, the sample may wish to make use of CVE-2 0 1 5-2 5 4 5 attack, and have a higher attack level. Analysis The sample is an Encapsulated PostScript EPS filter module32bit module for EPSIMP32. FLTin ...

Five-Year 'Dust Storm' APT Campaign Seen Targeting Japanese Critical Infrastructure

A five-year campaign primarily focused on extracting sensitive information from Japanese oil, gas, and electric utilities was outlined by researchers on Tuesday. Referred to as Operation Dust Storm .PDF by researchers at Cylance, the campaign has managed to stay persistent over the years, and...

Operation Blockbuster Ties Destructive Attacks to Lazarus Group

The nation-state sponsored hacker group allegedly behind the 2014 attack against Sony Pictures Entertainment has been linked to similar intrusions against a number of companies in South Korea including the Dark Seoul and Operation Troy attacks. A coalition of security companies called Operation...

Deepin 15 lastore-daemon Privilege Escalation

!/usr/bin/env python encoding=utf8 Exploit Title: Lastore-daemon in Deepin 15 results in privilege escalation Date: 20160208 Exploit Author: King's Way Vendor Homepage: http://www.deepin.org Software Link: http://cdimage.linuxdeepin.com/releases/15.1/deepin-15.1-amd64.iso Version: Deepin 15 & 15....

Deepin Linux 15 - lastore-daemon Privilege Escalation

Exploit for linux platform in category local exploits !/usr/bin/env python encoding=utf8 Exploit Title: Lastore-daemon in Deepin 15 results in privilege escalation Date: 20160208 Exploit Author: King's Way Vendor Homepage: http://www.deepin.org Software Link:...

Deepin Linux 15 - 'lastore-daemon' Local Privilege Escalation

!/usr/bin/env python encoding=utf8 Exploit Title: Lastore-daemon in Deepin 15 results in privilege escalation Date: 20160208 Exploit Author: King's Way Vendor Homepage: http://www.deepin.org Software Link: http://cdimage.linuxdeepin.com/releases/15.1/deepin-15.1-amd64.iso Version: Deepin 15 & 15....

Power Grid Honeypot Puts Face on Attacks

TENERIFE, Spain –The rhetoric around hacking the power grid would have you believe it’s a relatively mundane practice. Policymakers, intelligence agencies and vendors, for example, spread the word gleefully, leaning on scenarios such as state-sponsored hackers shutting off the lights in the dead ...

10 Year Poseidon APT Group Identified As First Portuguese Speaking Campaign

TENERIFE, Spain–For more than 10 years, attackers have carried out a series of covert attacks on firms worldwide and capitalized on that connection by coercing the companies into a phony business relationship where they can further steal data. Experts with Kaspersky Lab’s Global Research and...

Carbanak 2.0, Metel, GCMAN Borrow from APT Attacks

TENERIFE, Spain— Many bank robbers long ago dropped the stick-up man persona in favor of a keyboard and a reliable password-stealing Trojan. Banking malware, however, may soon not be good enough for the bad guys. More and more are copycatting the techniques deployed by advanced hackers to steal...

On BlackEnergy, Ransomware Hitting an Israeli Energy Consortium, Amazon as a CA, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest on the BlackEnergy APT Group, Amazon getting into the SSL certificate game, and government agencies being told to audit their systems for the Juniper backdoor. Download: ThreatpostNewsWrapJanuary292016.mp3 Music by Chr...

BlackEnergy APT Group Spreading Malware via Tainted Word Docs

Attackers have begun using rigged Microsoft Word documents propagated via spearphishing emails to spread the BlackEnergy Trojan. Researchers with Kaspersky Lab’s Global Research and Analysis Team discovered a malicious Word document last week that appears to stem from a campaign against one of th...

Debian Security Advisory DSA 3445-1 (pygments - security update)

Javantea discovered that pygments, a generic syntax highlighter, is prone to a shell injection vulnerability allowing a remote attacker to execute arbitrary code via shell metacharacters in a font name. OpenVAS Vulnerability Test $Id: deb3445.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generat...

R.I.P Ian Murdock, Founder of Debian Linux, Dies at 42

Ian Murdock, the founder the Debian Linux operating system and the creator of apt-get, has passed away. Yes, it is very sad to announce that Ian Murdock is not between us. His death has touched the entire software community. He was just 42. The announcement of Murdock death came out via a blog po...

The EPS Awakens - Part 2

On Wednesday, Dec. 16, 2015, FireEye published The EPS Awakens, detailing an exploit targeting a previously unknown Microsoft Encapsulated Postscript EPS dict copy use-after-free vulnerability that was silently patched by Microsoft on November 10, 2015. The blog described the technical details of...

0d1n - Tool For Automating Customized Attacks Against Web Applications

Web security tool to make fuzzing at HTTP inputs, made in C with libCurl. You can do: brute force passwords in auth forms directory disclosure use PATH list to brute, and find HTTP status code test list on input to find SQL Injection and XSS vulnerabilities To run: require libcurl-dev or...

Sofacy APT28 Gang Using New Backdoors, Zero Days

A new analysis of the Sofacy APT gang, a Russian-speaking group carrying out targeted attacks against military and government offices for close to a decade, shows a relentless wave of intrusions peaking this summer against victims in a number of NATO countries and the Ukraine. Researchers at...