Pentagon Expands Bug-Bounty Program to Include Physical Systems

The Department of Defense is expanding its “Hack the Pentagon” bug-bounty program to include hardware assets, tapping the Synack, HackerOne and Bugcrowd platforms to attract more white hats to the effort. The news comes two weeks after the Government Accountability Office GAO released a report...

Have Network, Need Network Security Monitoring

I have been associated with network security monitoring my entire cybersecurity career, so I am obviously biased towards network-centric security strategies and technologies. I also work for a network security monitoring company Corelight, but I am not writing this post in any corporate capacity...

Creating a Cyber Panic Room to Fight Off Invasions

Genghis Khan was a mastermind. A terrifyingly brilliant military strategist who altered the course of world history. He used fear to paralyze his enemies. “In one apocryphal account circulated to create anxiety among the enemy, the Mongols supposedly promised to retreat from a besieged city if th...

Dark Web: US court seizes assets and properties of deceased AlphaBay operator

By Carolina AlphaBay was one of the largest dark web marketplaces - In 2017, its admin Alexandre Cazes committed suicide in a Thai prison. The Fresno Division of the U.S. District Court for the Eastern District of California has finally concluded a 14-month long civil forfeiture case and allowed...

CVE-2018-16725

XSS in baijiacms V4 via the id parameter of assets/weengine/components/zclip/ZeroClipboard.swf (Non-standard use of the flash component). Affected: baijiacms V4; root cause: improper handling of the SWF component parameter; impact: cross-site scripting exposure. Remediation details are not provid...

CVE-2018-14059

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

Design/Logic Flaw

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

CVE-2018-14059

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions...

CVE-2018-14059

CVE-2018-14059 corresponds to a Pimcore XSS vulnerability exposed in Pimcore 5.2.3 and earlier and affects multiple entry points: Users, Assets, Data Objects, Video/Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Meta...

The digital entropy of death: BSides Manchester

Last week, I gave a talk at BSides Manchester based on a previous blog series for Malwarebytes Labs called "The digital entropy of death." What do you do when a relative or close friend dies, leaving all of their digital accounts lying around for anyone to break into and make use of? Which...

Integer overflow

An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red BTCR, an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address array, as exploited in the wild in May 2018, aka the...

CVE-2018-11687

An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red BTCR, an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address array, as exploited in the wild in May 2018, aka the...

CVE-2018-11687

An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red BTCR, an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address array, as exploited in the wild in May 2018, aka the...

CVE-2018-10769

The transferProxy and approveProxy functions of a smart contract implementation for SmartMesh SMT, an Ethereum ERC20 token, allow attackers to accomplish an unauthorized transfer of digital assets because replay attacks can occur with the same-named functions with the same signatures in other...

CVE-2018-10769

Summary (CVE-2018-10769): The SmartMesh (SMT) smart contract’s transferProxy and approveProxy functions are vulnerable to replay attacks, allowing unauthorized transfers of digital assets. The issue arises because the same-named functions (with identical signatures) exist in other tokens (First, ...

Integer overflow

An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER EETHER, an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets...

CVE-2018-11561

An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER EETHER, an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets...

CVE-2018-11561

An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER EETHER, an Ethereum ERC20 token, will lead to an unauthorized increase of an attacker's digital assets...

CVE-2018-11561

CVE-2018-11561 affects the EETHER ERC20 smart contract; an integer overflow in the unprotected distributeToken function enables an attacker to illegitimately increase their digital assets. The vulnerability is described in multiple sources (NVD/CNVD) as a token-amount overflow in the distributeTo...

What I expect from IT Asset Inventory

The main problem of vulnerability management, in my opinion, is that it is not always clear whether we know about ALL network hosts existing in our infrastructure or not. So, not the actual process of scanning and the detection of vulnerabilities, but the lack of knowledge what we should scan...