US-CERT Warns of Dyre Banking Trojan

The Department of Homeland Security formally sounded the alarm Monday on Dyre, the banking Trojan that’s been spotted siphoning banking credentials from both large enterprises and major financial institutions as of late. The warning came in the form of an alert from the United States Computer...

New Adobe Flash Exploit Found in Angler, Fiesta EKs

Two notorious exploit kits are already seeding vulnerable websites with exploits for a Flash Player vulnerability that was patched in last week’s Adobe security bulletin. French researcher Kafeine told Threatpost that the most likely scenario is that a skilled coder found a way to reverse-enginee...

Design/Logic Flaw

The Industrial and Commercial Bank of China ICBC Banking aka com.icbc.android application 2.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7589

The CVE-2014-7589 entry concerns the ICBC Banking Android app (com.icbc.android) version 2.40, where the app does not verify X.509 certificates from SSL servers. This missing certificate validation can allow a man-in-the-middle to spoof servers and exfiltrate sensitive information via a crafted c...

CVE-2014-7589

The Industrial and Commercial Bank of China ICBC Banking aka com.icbc.android application 2.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PayPal Inc iOS Mobile 4.6.0 Input Validation

Document Title: =============== PayPal Inc 86 iOS 4.6 - Validation & Design Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=915 PayPal Security UID: eff8aq Release Date: ============= 2014-09-30 Vulnerability Laboratory ID VL-ID:...

CVE-2014-6875

The Woodforest Mobile Banking aka com.woodforest application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Woodforest Mobile Banking aka com.woodforest application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Santander Personal Banking aka com.sovereign.santander application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6875

CVE-2014-6875 affects the Woodforest Mobile Banking Android app (v3.1); the root cause is that the app does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Exploit status and fixes are not detailed...

CVE-2014-6877

The CVE-2014-6877 entry concerns the Santander Personal Banking Android app (version 2.1). The connected records confirm the root cause: the application does not verify X.509 certificates presented by SSL servers, which enables man-in-the-middle attackers to spoof servers and extract sensitive in...

CVE-2014-6877

The Santander Personal Banking aka com.sovereign.santander application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6875

The Woodforest Mobile Banking aka com.woodforest application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6732

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6732

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6732

The CVE-2014-6732 entry concerns the Westpac Mobile Banking Android app (version 5.21) that does not verify X.509 certificates when establishing SSL connections. This weakens server authentication and allows a man-in-the-middle to spoof SSL servers and capture sensitive information via a crafted ...

jQuery Official Website Compromised To Serve Malware

The official website of the popular cross-platform JavaScript library jQuery jquery.com has been compromised and redirecting its visitors to a third-party website hosting the RIG exploit kit, in order to distribute information-stealing malware. JQuery is a free and open source JavaScript library...

Dyre Trojan Targeting More than Salesforce.com Credentials

The criminals who unleashed a variant of the Dyre banking Trojan recently may have more up their sleeve than harvesting Salesforce.com credentials. Analysis of a sample conducted by SaaS security company Adallom determined that the new strain of Dyre is targeting large enterprises in addition to...

CVE-2014-5926

The DCU Mobile Banking aka com.Vertifi.Mobile.P211391825 application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...