2017’s Biggest Threats and What CISOs Can do to Mitigate Risks in 2018

Enterprise Risk Management ERM is getting harder every day. According to the World Economic Forum‘s 2018 Global Risks Perception Survey, cyber attacks and data theft are 3 and 4 respectively of the top 5 likely risks organizations will face this year. This is not surprising, in 2017 CISOs the wor...

Lookout: Dark Caracal Points To APT Actors Moving To Mobile Targets

CANCUN, Mexico – On the heels of global cyber espionage campaign Dark Caracal, security firm Lookout is sounding the alarm on how it is indicative of advanced persistent threats moving from desktop platforms to mobile platforms. Dark Caracal, which was first discovered by researchers in January, ...

POS Malware Found at 160 Applebee’s Restaurant Locations

Malware was discovered on point of sales systems at more than 160 Applebee’s restaurants, exposing credit card information from unknowing diners. RMH Franchise Holdings, which owns and operates more than 160 Applebee’s stores across the U.S., said that it recently discovered malware infecting its...

Malware steals data directly from the device to hack Facebook account

By Waqas Hacking Facebook credentials such as login IDs and passwords have This is a post from HackRead.com Read the original post: Malware steals data directly from the device to hack Facebook account...

WordPress Users Warned of Malware Masquerading as ionCube Files

Security researchers are warning WordPress and Joomla admins of a sneaky new malware strain masquerading as legitimate ionCube files. The malware, dubbed ionCube Malware, is used by cybercriminals to create backdoors on vulnerable websites allowing them to steal data or plant more malware. In the...

MediaWiki SyntaxHighlight Extended HTML Injection Vulnerability

MediaWiki is a free, web-based wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers for the deployment of in-house knowledge management and content management systems. An HTML injection vulnerability exists in the MediaWiki SyntaxHighlight extension, which ste...

DNS: Exfiltration vs. Tunneling

The Internet was designed to share data, but sometimes the paths that enable it are blocked. When it comes to bad actors - that's a good thing. Most companies today have a Data Loss Prevention DLP policy to accompany their web proxies and firewalls. Some of them think this is the best way to stop...

Jumping Air Gaps

Nice profile of Mordechai Guri, who researches a variety of clever ways to steal data over air-gapped computers. Guri and his fellow Ben-Gurion researchers have shown, for instance, that it's possible to trick a fully offline computer into leaking data to another nearby device via the noise its...

CVE-2018-1221: Gorouter websocket handling vulnerability | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions cf-deployment All versions prior to 1.14.0 routing-release All versions prior to 0.172.0 Description The Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and...

Washington State Marijuana Tracking System Hacked to Steal Route Data

By Waqas Problems for Washington Marijuana Industry Twofold After New Marijuana-Tracking Software This is a post from HackRead.com Read the original post: Washington State Marijuana Tracking System Hacked to Steal Route Data...

Hackers Can Now Steal Data Even From Faraday Cage Air-Gapped Computers

A team of security researchers—which majorly focuses on finding clever ways to get into air-gapped computers by exploiting little-noticed emissions of a computer's components like light, sound and heat—have published another research showcasing that they can steal data not only from an air gap...

Intel Releases New Spectre Patch Update for Skylake Processors

After leaving million of devices at risk of hacking and then rolling out broken patches, Intel has now released a new batch of security patches only for its Skylake processors to address one of the Spectre vulnerabilities Variant 2. For those unaware, Spectre Variant 1, Variant 2 and Meltdown...

Critical Flaw in Grammarly Spell Checker Could Let Attackers Steal Your Data

A critical vulnerability discovered in the Chrome and Firefox browser extension of the grammar-checking software Grammarly inadvertently left all 22 million users' accounts, including their personal documents and records, vulnerable to remote hackers. According to Google Project Zero researcher...

WinShell Trojan Detection

This host seems to be running WinShell. WinShell is a Trojan Horse which allows an intruder to take the control of the remote computer. An attacker may use it to steal your passwords, modify your data, and prevent you from working properly. C Tenable Network Security, Inc. include"compat.inc";...

IPSwitch MOVEit 8.1 < 9.4 - Cross-Site Scripting

Exploit Title: IPSwitch MoveIt Stored Cross Site Scripting XSS Date: 1-31-2017 Software Link: https://www.ipswitch.com/moveit Affected Version: 8.1-9.4 only confirmed on 8.1 but other versions prior to 9.5 may also be vulnerable Exploit Author: 1N3@CrowdShield - https://crowdshield.com Early...

IPSwitch MoveIt 9.4 Cross Site Scripting

Exploit Title: IPSwitch MoveIt Stored Cross Site Scripting XSS Date: 1-31-2017 Software Link: https://www.ipswitch.com/moveit Affected Version: 8.1-9.4 only confirmed on 8.1 but other versions prior to 9.5 may also be vulnerable Exploit Author: 1N3@CrowdShield - https://crowdshield.com Early...

Nearly 2000 WordPress Websites Infected with a Keylogger

More than 2,000 WordPress websites have once again been found infected with a piece of crypto-mining malware that not only steals the resources of visitors' computers to mine digital currencies but also logs visitors' every keystroke. Security researchers at Sucuri discovered a malicious campaign...

CVE-2018-5319

RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request...

CVE-2018-5319

RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request...

Meltdown and Spectre Attacks | Cloud Foundry

Severity Advisory/Critical Description Meltdown and Spectre exploit critical vulnerabilities in modern processors. These hardware bugs allow programs to steal data which is currently processed on the computer. While programs are typically not permitted to read data from other programs, a maliciou...