CB TAU Threat Intelligence Notification: Winnti Malware 4.0

Winnti is a family of malware used by multiple Chinese threat actors like APT41. Carbon Black’s Threat Analysis Unit TAU is providing this technical analysis, YARA rules, IOCs and product rules for the research community. Behavioral Summary Winnti malware is installed manually with stolen...

CB Partner Spotlight Series: Slipstream Cyber Security

Slipstream Cyber Security is a managed cyber-security service provider enterprise with a Cyber Security Operations Centre CSOC is located in Perth, Western Australia. Staffed by experienced security professionals with backgrounds in cyber operations, anti-fraud, intelligence and more, the team...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

Default credentials

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2019-15497

Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP...

CVE-2019-15497

CVE-2019-15497 affects Black Box iCOMPEL 9.2.3 through 11.1.4 (as used in ONELAN Net-Top-Box 9.2.3–11.1.4 and other products). The root cause described is default credentials that allow remote attackers to access devices remotely via SSH, HTTP, HTTPS, and FTP . Impact is consistent with the NVD m...

CB Customer Spotlight: Q&A with MEDNAX’s Don Cox

With over 30 years of experience in the technology landscape, Don Cox knows what it takes to be a leader in the industry. Currently residing as the CISO at MEDNAX, the physician-led healthcare organization headquartered in Sunrise, FL, Cox is responsible for cyber operations and engineering,...

The Next Chapter in Our Story: VMware + Carbon Black

I am excited to share with you a significant milestone in Carbon Black’s history. Earlier today, Carbon Black entered into a merger with VMware, who as of moments ago announced its intention to acquire Carbon Black. You can also read the press release with more details here, but first I’d like to...

KBPublisher 6.0.2.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Tittle: KBPublisher 6.0.2.1 - Multiple SQL Injection Risk: High Date: 21.Aug.2019 Author: Pedro Andujar Twitter: @pandujar .: INTRO : KBPublisher is Knowledge Management Software. It reduces the need for customer support, improves staff...

KBPublisher 6.0.2.1 SQL Injection

=============================== - Advisory - =============================== Tittle: KBPublisher 6.0.2.1 - Multiple SQL Injection Risk: High Date: 21.Aug.2019 Author: Pedro Andujar Twitter: @pandujar .: INTRO : KBPublisher is Knowledge Management Software. It reduces the need for customer support...

CB TAU Threat Intelligence Notification: Sodinokibi Ransomware

Sodinokibi otherwise known as Sodin or REvil is a ransomware variant that has recently been observed evolving its delivery techniques, leveraging fake antivirus software and PowerShell droppers. This malware appears to be related to GandCrab and is likely a result of their operation closing up...

Bypassing Apple FaceID's Liveness Detection Feature

Apple's FaceID has a liveness detection feature, which prevents someone from unlocking a victim's phone by putting it in front of his face while he's sleeping. That feature has been hacked: Researchers on Wednesday during Black Hat USA 2019 demonstrated an attack that allowed them to bypass a...

Threat Source newsletter (Aug. 15)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. Sorry we missed you last week, we were all away at Hacker Summer Camp. If you missed us at Black Hat, we have a roundup up on the blog o...

Talos Black Hat 2019 flash talk roundup

Talos went wall-to-wall at Hacker Summer Camp, showing up to Black Hat and DEFCON with talks, challenges, advice and education. Over the course of two days at Black Hat, Cisco Security hosted more than 20 talks at our booth, many featuring Talos researchers and analysts. In case you couldn't swin...

Meet Bluetana, the Scourge of Pump Skimmers

"Bluetana," a new mobile app that looks for Bluetooth-based payment card skimmers hidden inside gas pumps, is helping police and state employees more rapidly and accurately locate compromised fuel stations across the nation, a study released this week suggests. Data collected in the course of the...

Black Hat 2019 News Wrap: The Best and Worst of the Show

LAS VEGAS – Black Hat and DEF CON 2019 may be wrapping up, but the dual conferences last week in Las Vegas left the security industry with a flurry of new security flaws, topics and announcements to discuss for the weeks to come. Threatpost editors Tara Seals and Lindsey O’Donnell get together to...

Fedora 30 : kernel / kernel-headers / kernel-tools (2019-7aecfe1c4b)

The 5.2.5 stable kernel update contains a number of important fixes across the tree. This should also fix the black screen issue that several i915 users were hitting with 5.2.4. ---- The 5.2.4 kernel rebase contains new features and hardware support, and a number of important fixes across the tre...

Election Systems Are Even More Vulnerable Than We Thought

Black Hat and Defcon are underway in Vegas, WhatsApp flaws allow hackers to alter messages, and more of this week’s top security news...

DEF CON 2019: Researchers Demo Hacking Google Home for RCE

LAS VEGAS – The Tencent Blade Team of researchers demonstrated several ways they have developed to hack and run remote code on Google Home smart speakers. The hacks center around what is known as a Magellan vulnerability, which can be used to exploit the massively popular SQLite database engine...

Apple Upgrades Bug Bounty Program: Adds Macs, $1M Reward

LAS VEGAS – Apple is giving its bug bounty program a much-needed makeover. The device manufacturer in a Thursday Black Hat USA 2019 session said it will open the historically private program to all researchers in the fall. In addition, it plans to drastically boost some rewards for vulnerabilitie...