Ghosts in the Endpoint

We would like to introduce the first of our “Ghosts in the Endpoint” series, a report prepared by FireEye Labs that documents malicious software not being detected in the wild by traditional signature-based detections. In this study, all the families identified are samples from VirusTotal VT with...

Google Updates Safe Browsing Alerts for Network Admins

Google beefed up the way it displays Safe Browsing Alerts for Network Administrators this week, adding information about sites peddling unwanted and malicious software as well as those caught carrying out social engineering attacks. Google debuted the service, which notifies network admins after...

GetDataReport - Script to collect information to the client side

Script in PHP+JS for get information of target through a web application, use $SERVER functions and JS functions for get information of our client. Plugin WEBApps in some web applications need to collect information from the client to perform tasks with this plugin will be easier to work with the...

Mac Adware 'OSX.Pirrit' Unleashes Ad Overload, For Now

Researchers discovered a Mac OS X variant of the Windows-based Pirrit adware that creates a proxy server on infected Mac computers and injects ads into webpages. According to researchers at Boston-based Cybereason Labs, the adware, dubbed OSX.Pirrit, is mostly benign, serving up just ads, but has...

Gratipay: prevent %2f spoofed URLs in profile statement

https://gratipay.com%[email protected] on clicking on this url this link will take to the google.com or any other malicious url. On seeing it will look like the link will take to the gratipay but onclicking the url it will redirect to the malicious site.Attacker with the help social engg. techniques...

FTC Releases Alert on Tech-Support Scams

The Federal Trade Commission FTC has released an alert on tech-support themed telephone scams. In these schemes, fraudulent callers claim to be from legitimate technical support organizations and offer to fix computer problems that don't exist. Users should not give control of their computers to...

GitLab: Attacker can extract list of private project's project members

There's a minor information disclosure issue in the Import members feature. It can be abused to get a list of project members that are working on a private project. The following steps require that you're signed in as a user that can create a new project. When someone imports project members from...

Enable this New Setting to Secure your Computer from Macro-based Malware

Do you deal with MS Word files on the daily basis? If yes, then are you aware that even opening a simple doc file could compromise your system? It is a matter to think that the virus does not directly affect you, but it is you who let the virus carry out the attack by enabling deadly "Macros" to...

Coinbase: Sending payments via QR code does not require confirmation

Coinbase pushed out a feature whereby scanning a QR code inside the Coinbase Mobile app would complete payments under 0.1BTC without further confirmation. Upon reviewing this report and further consideration of the possible security implications of this feature, it was reverted. This issue has a...

colorado.edu XSS vulnerability

Vulnerable URL: http://www.colorado.edu/engineering/deaa/cgi-bin/list.pl?year=1986%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4891...

BinDiff Now Free, To Delight of Security Researchers

BinDiff is a constant presence inside a security researcher’s toolbox, ideal for patch and malware analysis or reverse engineering of code. The Google-owned software allows researchers to conduct side-by-side comparisons of binary files in disassembled code looking for differences in the samples...

Binary Analysis IDE: BinDiff

BinDiff is a comparison tool for binary files that helps to quickly find differences and similarities in disassembled code. It is used by security researchers and engineers across the globe to identify and isolate fixes for vulnerabilities in vendor-supplied patches and to analyze multiple versio...

CTF-Tools - Some setup scripts for security research tools

This is a collection of setup scripts to create an install of various security research tools. Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth. Installers for the following tools are included: Category | To...

'The Fappening' Hacker Reveals How He Stole Pics of Over 100 Celebrities

Almost one and a half years ago after the massive leakage of celebrities' photographs — famous as "The Fappening" or "Celebgate" scandal — a man had been charged with the Computer Fraud and Abuse Act, facing up to 5 years in prison as a result. The US Department of Justice DOJ announced on Tuesda...

HackerOne: Mediation link can be accepted by other users

When a company user requests mediation on a report, a support ticket is created for the HackerOne team to investigate. @kirkj found out that the support ticket included an invitation link, and that some support reps may include it inadvertently within email replies. If HackerOne had not accepted...

Steam Stealer Malware "Booming Business" for Attackers Targeting Gaming Service

Malware that targets Steam accounts has proliferated the gaming platform and become what researchers are calling a “booming business” for cybercriminals over the last few months. The popular platform, owned by Valve, boasts 140 million users and is so ripe for attacks that according to the compan...

Uber: Active Email Hyperlink Sent on riders.uber.com

On riders.uber.com when the rider changes their information an email will be sent to their email informing them a change has been made on their rider account. The rider can change their first name to anything within 45 characters and once the change has been made they can add an email to their...

Trihedral Engineering Limited VTScada Vulnerabilities

OVERVIEW An anonymous researcher has identified several vulnerabilities in Trihedral Engineering Ltd.’s Trihedral VTScada and reported them to Zero Day Initiative ZDI, which reported them to NCCIC/ICS-CERT. Trihedral Engineering Ltd. has produced a new version to mitigate these vulnerabilities...

Locky Ransomware Now Part Of Massive Spam Attack

Researchers are tracking a massive spam campaign pelting inboxes with Locky ransomware downloaders in the form of JavaScript attachments. The huge spike, reported by security firm Trustwave, represents an extraordinary uptick in the attempted distribution of the Locky ransomware. Trustwave said...

Lessons from Operation RussianDoll

As defensive security controls raise the bar to attack, attackers will employ increasingly sophisticated techniques to complete their mission. Understanding the mechanics and impact of these threats is essential to systematically discover and deflect the coming wave of advanced attacks. Mandiant...