A combination of clicks and key presses can lead to cross site scripting or code execution

When a user double clicks on a page, they may expect the two clicks to target the same object. If a page uses the first click to open a pop-up window in a predictable location, the second click may focus parts of the new window, such as its address field. If the page can then convince the user to...

A combination of clicks and key presses can lead to cross site scripting or code execution – Opera Security Advisories

When a user double clicks on a page, they may expect the two clicks to target the same object. If a page uses the first click to open a pop-up window in a predictable location, the second click may focus parts of the new window, such as its address field. If the page can then convince the user to...

Pages can prevent navigation to a target page, spoofing the address field – Opera Security Advisories

When a user types a new URL for the browser to load, the currently active page may detect when the new page is about to load and prevent the navigation, while still leaving the new URL displayed in the address bar. This can then be used to spoof the URL of the target page. The malicious page woul...

Hidden keyboard navigation can allow cross site scripting or code execution

When a user is interacting with a window, that window should be visible to the user, to ensure that the user realizes it is there. If a page is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can en...

Pages can prevent navigation to a target page, spoofing the address field

When a user types a new URL for the browser to load, the currently active page may detect when the new page is about to load and prevent the navigation, while still leaving the new URL displayed in the address bar. This can then be used to spoof the URL of the target page. The malicious page woul...

Apple Details iOS Security Features in New Guide

Apple has released a detailed security guide for its iOS operating system, an unprecedented move for a company known for not discussing the technical details of its products, let alone the security architecture. The document lays out the system architecture, data protection capabilities and netwo...

IXESHE Malware Avoids Easy Detection to Remain a Persistent Threat

Trend Micro today issued a report on an advanced persistent threat that uses stealthy data-stealing malware called IXESHE “i-sushi” to infect machines. So far it’s hit East Asian governments, Taiwanese electronics manufacturers and German telecommunications firms operating across Asia. Though the...

DHS Warns of Potential Scams and Attack in Run-up to London Olympics

Hacktivists, malware, scams, data theft and DDoS attacks are among the Department of Homeland Security’s concerns regarding this summer’s Olympic Games set to take place in London, according to the DHS Cybersecurity and Communications Integration Center’s Strategic Outlook. The document focuses...

Tatanga Trojan Mixes MitB with Social Engineering

Cybercriminals are using the Tatanga trojan to carry out a complicated man-in-the-browser MitB attack that enables the circumvention of SMS authentication for financial transactions, according to Trusteer’s Amit Klein. The attack is targeting the customers of a number of banks in Germany. How man...

Forget 'Brogrammers,' Women Have The Edge In DEFCON Social Engineering Contest

Men may dominate the ranks of vulnerability researchers and hackers. But could women be the superior social engineers? Its a question that the organizers of the annual Social Engineering Capture the Flag CTF contest at DEFCON will try to answer. In a break from recent years, the third annual DEFC...

New P2P Zeus Variant Targets Popular Sites with Bogus Offers

Facebook, Gmail, Yahoo and Hotmail users should beware of rogue rebate offers and new secure payment options aimed at getting them to part with their debit card information. Earlier this week Amit Klein, CTO of Trusteer, announced the discovery of a peer-to-peer variant of the Zeus platform that...

extmail找回密码带来的可提供交互性社工的问题

简要描述： 大部分的extmail产品用户在使用该产品时并不会注意到该问题,以至于许多这种页面都可以直接通过外网进行访问,由于该产品是属于邮件系统,使用者本身会在网络上留下邮件地址,通过web界面访问得知该系统之后就会给其带来可被交互性社工的危险。呵呵,最近挺忙,事情挺多的 详细说明：...

The Hackers Conference 2012 Call For Papers #THC2012

We are extremely delighted to announce the Call for Papers for The Hackers Conference 2012 It is a unique event, where the elite of the hacker world, leaders in the information security industry and the Internet community meet face to face to join their efforts to cooperate in addressing the most...

Discuz!所有版本敏感帐号注册

简要描述： 用来社工和骗人，应该可以 详细说明： 允许特殊帐号注册如admin,Αdmiп,аdmin,admiп,аdmiп,Αdmin（就用一些特殊字符替换） 可以伪造管理员，版主或者一些与权威的用户的帐号 漏洞证明： discuz.net上的admin,Αdmiп,аdmin,admiп,аdmiп,Αdmin全被注册了，还可以模仿某些版主的帐号...

Iran Replicating Captured U.S. Drone RQ-170 Sentinel

Iran Replicating Captured U.S. Drone RQ-170 Sentinel Iranian military aerospace chief General Amir Ali Hajizadeh was quoted having said:"The Americans should be aware to what extent we have infiltrated the plane." Iran has broke the encryption codes and begun construction of a replica of the Unit...

Analysis: Flashback Spread Via Social Engineering, Then Java Exploits

Kaspersky Lab‘s latest analysis of the Mac OS X Flashback botnet reveals that the botnet’s malware was spread via drive-by downloads on hacked WordPress web sites. From September 2011 until February 2012, the Flashback creators distributed the trojan through compromised WordPress sites that...

Pro-Tibetan activists become victim of Spear Phishing

Pro-Tibetan activists become victim of Spear Phishing Hackers are ramping up their attacks against Tibetan activists and are using increasingly sophisticated techniques to deliver malware An interesting example of such a malicious email has recently been spotted by FireEye researcher Alex Lanstei...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core'...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution. Remote exploits for multiple platform This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and term...