Chinese Hackers targeting American Drones under Operation Beebus

FireEye experts have been tracking the Operation Beebus campaign for a few months now, and new same gang of hackers are being blamed for a set of recently discovered spear-phishing attacks that aim to steal information related to American drones. These attacks exploited previously discovered...

Chinese Hackers targeting American Drones under Operation Beebus

FireEye experts have been tracking the Operation Beebus campaign for a few months now, and new same gang of hackers are being blamed for a set of recently discovered spear-phishing attacks that aim to steal information related to American drones. These attacks exploited previously discovered...

Sitecom routers backdoor account

2 undocumented backdoor accounts...

Sitecom WLM-3500 backdoor accounts

Sitecom WLM-3500 backdoor accounts ================================== ADVISORY INFORMATION Title: Sitecom WLM-3500 backdoor accounts Discovery date: 24/03/2013 Release date: 16/04/2013 Credits: Roberto Paleari [email protected], @rpaleari Advisory URL:...

Comment Crew's Operation Beebus Stealing Drone Tech

FireEye experts have been tracking the Operation Beebus campaign for a few months now, and their latest research suggests that whomever is responsible for the attacks is ultimately interested in stealing drone technology-related secrets. Operation Beebus is an APT-style attack campaign targeting...

Sitecom WLM-3500 Backdoor Accounts (HTTP)

Sitecom WLM-3500 routers contain an undocumented access backdoor. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Common server to resolve the vulnerability summary-vulnerability warning-the black bar safety net

Author : laterain +IIS6. 0 Directory resolution:/xx.asp/xx.jpg xx.jpg can be replaced with any text filee.g. xx.txt, the text content for the back door code IIS6. 0 will be xx.jpg parsing of asp files. Suffix resolution:/xx. asp;. jpg IIS6. 0 would put such a suffix the file is successfully parse...

Sitecom WLM-3500 Backdoor Accounts

Sitecom WLM-3500 backdoor accounts ================================== ADVISORY INFORMATION Title: Sitecom WLM-3500 backdoor accounts Discovery date: 24/03/2013 Release date: 16/04/2013 Credits: Roberto Paleari [email protected], @rpaleari Advisory URL:...

VsFtp2 Version 2.3.4 Backdoor vulnerability-vulnerability warning-the black bar safety net

Metasploit+Nmap using the Test to build a virtual machine nmap –sT –A IP address Or use metaspliot scan to ftp –version to scan Here using someone else's figure ! image metasploit exploit use exploit/unix/ftp/vsftpd234backdoor msf exploitvsftpd234backdoor show options Need to fill out the attack...

Stolen Winnti Certificates Used in Watering Hole Attack Against Tibet Orphans Site

The assault against Free Tibet and Uyghur supporters is unrelenting as another watering hole attack has been uncovered, this time against a caregiver site supporting Tibetan refugee children. The non-governmental organization NGO Tibetan Homes Foundation site remains compromised and is hosting a...

Aastra IP phones backdoor

Hardcoded telnet account admin/Mqozn...

Energizer DUO Trojan Code Execution (CVE-2010-0103)

A remote code execution vulnerability has been reported in Energizer DUO USB battery charger. The vulnerability is due to the file Arucer.dll providing USB communication capabilities. A remote attacker can exploit this vulnerability by using this capability as a backdoor...

Hacker uses Evernote account as Command-and-Control Server

Cyber criminals are using popular note-taking app Evernote as Command-and-Control Server to give commands to the malware installed on infected PCs using botnets. TrendMicro uncovered a malware detected as "BKDRVERNOT.A" tried to communicate with Command-and-Control Server using Evernote. Malware...

Hacker uses Evernote account as Command-and-Control Server

Cyber criminals are using popular note-taking app Evernote as Command-and-Control Server to give commands to the malware installed on infected PCs using botnets. TrendMicro uncovered a malware detected as “BKDRVERNOT.A” tried to communicate with Command-and-Control Server using Evernote. Malware...

Cybercriminals Use Evernote as C&C

At least one group of cybercriminals has taken to Evernote, the popular cloud-based note-taking and data-sharing service, as a base of operations for a data stealing Trojan, according to TrendMicro threat response engineer Nikko Tamana. TrendMicro detected the threat as “BKDRVERNOT.A” and observe...

Israeli Government Websites Targeted in Watering Hole Attack

A new watering hole attack has been reported, this one targeting two government-related websites based in Israel that have been injected with malware exploiting a six-month-old vulnerability in Internet Explorer. The two sites, ict.org.il and herzliyaconference.org, are related to Israel’s first...

Nmap NSE 6.01: smb-psexec

Implements remote process execution similar to the Sysinternals' psexec tool, allowing a user to run a series of programs on a remote machine and read the output. This is great for gathering information about servers, running the same tool on a range of system, or even installing a backdoor on a...

Anti-Tibetan Attack Stems from Nvidia Abuse, Old RTF Vulnerability

A series of targeted attacks are continuing to bully a signed Nvidia application into dropping a backdoor that lets attackers root their way through the systems of Tibetan sympathizers. According to Sophos’ Gabor Szappanos, the multifaceted attack can install a backdoor on unsuspecting users’...

Multiple Vulnerabilities in Netgear DGN2200B

Device Name: DGN2200B Vendor: Netgear ============ Vulnerable Firmware Releases: ============ Hardwareversion DGN2200B Firmwareversion V1.0.0.367.0.36 - 04/01/2011 ============ Device Description: ============ Infos: http://www.netgear.com/home/products/wirelessrouters/work-and-play/dgn2200.aspx...

Adobe Patches Sandbox Escape Vulnerability in Reader and Acrobat

Adobe today released a patch for two vulnerabilities being exploited in the wild that enabled attackers to pull off the first confirmed sandbox escape against Adobe Reader. The vulnerabilities CVE-2013-0640 and CVE-2013-0641 could cause a crash and allow an attacker to remotely run malware on a...