Researchers Claim CIA Was Behind 11-Year-Long Hacking Attacks Against China

Qihoo 360, one of the most prominent cybersecurity firms, today published a new report accusing the U.S. Central Intelligence Agency CIA to be behind an 11-year-long hacking campaign against several Chinese industries and government agencies. The targeted industry sectors include aviation...

ASSURE Aviation Cyber Security Testing

We've long been supporters and champions of a formalised approach to Aviation Cyber Security Testing. Our research and blogging has taken us on an interesting journey regarding airside and landside security, mapping attack surfaces and explaining how systems work and interact. Speaking and...

livre-aviation.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1069410 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Opinion: Don't Let a Tech Slowdown Threaten Our Military

The right software and digital engineering can take military aircraft back to the future...

Mapping the Attack Surface of an Airport

Aviation security is a complex environment. What first sparked my interest in avionics security was a comment from an airport customer of ours. They had seen the media coverage of the DHS work against a Boeing 757 a few years ago and were concerned that an ‘infected’ airplane might create a fresh...

IBM Maximo Asset Management CVE-2019-4512 Information Disclosure Vulnerability

Description IBM Maximo Asset Management is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Technologies Affected IBM Control Desk IBM Maximo Asset Management 7.6.1.1 IBM Maximo for Aviation IBM...

A Pen Tester’s First Solo: Aviation Security 101

My colleague Ken and I are both private pilots with a keen interest in avionics and security. We were fortunate to have access to some end of life, functioning airframes so had the opportunity to start investigating the security of airplane and avionics. Here’s a primer for anyone interested in...

PTP at DEF CON 27

Here's the lowdown on our 14 DEF CON 27 talks, workshops, and panel sessions: Main Stage Track 3 Paris: Saturday 13:00 Chris Wade presents Tag-side attacks against NFC Track 2 Paris: Saturday 15:00 G Richter presents Reverse-Engineering 4g Hotspots for Fun, Bugs and Net Financial Loss Villages...

Black Hat USA 2019 Preview

Las Vegas – Despite bizarre reports of a grasshopper infestation, Black Hat USA 2019 and DEF CON are set to kick off next week in Las Vegas, bringing on a wave of sessions, keynotes and security-themed villages. The Threatpost team, which will be on the frontlines of next week’s shows, discuss wh...

GE Aviation Passwords, Source Code Exposed in Open Jenkins Server

A public Jenkins server owned by GE Aviation has exposed source code, plaintext passwords, global system configuration details and private keys from the company’s internal commercial infrastructure. GE Aviation, a subsidiary of General Electrics, is among the top commercial aircraft engine...

Drones are Quickly Becoming a Cybersecurity Nightmare

Drones are a growing threat for law enforcement and business security officers. In the run-up to Christmas 2018, rogue drones grounded planes at London Gatwick, the UK’s second-busiest airport. But, increasingly it’s not just the air traffic controllers sounding the alarms over drones, it’s also...

A security vulnerability has been identified in IBM DB2 shipped with IBM Maximo Asset Management (CVE-2019-4094)

Summary IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about the security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-4094 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Serv...

aviation-safety.net XSS vulnerability

Open Bug Bounty ID: OBB-713016 Description| Value ---|--- Affected Website:| aviation-safety.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

aviation-safety.net XSS vulnerability

Open Bug Bounty ID: OBB-712539 Description| Value ---|--- Affected Website:| aviation-safety.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

aviation-safety.net XSS vulnerability

Open Bug Bounty ID: OBB-711412 Description| Value ---|--- Affected Website:| aviation-safety.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

aviation-safety.net XSS vulnerability

Open Bug Bounty ID: OBB-704040 Description| Value ---|--- Affected Website:| aviation-safety.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

dashboard.aviationadr.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-700278 Description| Value ---|--- Affected Website:| dashboard.aviationadr.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

Chinese Threat Actors Indicted For Stealing Aviation Trade Secrets

Hot on the heels of the Carbon Black Quarterly IR Threat Report, specifically calling out increased cybercrime activity from China, the US Department of Justice has indicted ten Chinese Nationals for perpetrating attacks against U.S. and French aviation companies in a stunning display of state...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Asset Management Essentials, Maximo Industry Solutions including Maximo for Energy Optimization, Maximo for Government, Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life...

aviationexperience.digitickets.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-684090 Description| Value ---|--- Affected Website:| aviationexperience.digitickets.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79...