Steam Stealer Malware "Booming Business" for Attackers Targeting Gaming Service

Malware that targets Steam accounts has proliferated the gaming platform and become what researchers are calling a “booming business” for cybercriminals over the last few months. The popular platform, owned by Valve, boasts 140 million users and is so ripe for attacks that according to the compan...

Uber: Active Email Hyperlink Sent on riders.uber.com

On riders.uber.com when the rider changes their information an email will be sent to their email informing them a change has been made on their rider account. The rider can change their first name to anything within 45 characters and once the change has been made they can add an email to their...

Trihedral Engineering Limited VTScada Vulnerabilities

OVERVIEW An anonymous researcher has identified several vulnerabilities in Trihedral Engineering Ltd.’s Trihedral VTScada and reported them to Zero Day Initiative ZDI, which reported them to NCCIC/ICS-CERT. Trihedral Engineering Ltd. has produced a new version to mitigate these vulnerabilities...

Locky Ransomware Now Part Of Massive Spam Attack

Researchers are tracking a massive spam campaign pelting inboxes with Locky ransomware downloaders in the form of JavaScript attachments. The huge spike, reported by security firm Trustwave, represents an extraordinary uptick in the attempted distribution of the Locky ransomware. Trustwave said...

Lessons from Operation RussianDoll

As defensive security controls raise the bar to attack, attackers will employ increasingly sophisticated techniques to complete their mission. Understanding the mechanics and impact of these threats is essential to systematically discover and deflect the coming wave of advanced attacks. Mandiant...

ClamWin 0.99 DLL Hijacking

Hi @ll, the executable installer clamwin-0.99-setup.exe available from loads and executes DWMAPI.dll or UXTheme.dll from its "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and for "prior art" about...

3 6 0 the end of the tour the ultimate firepower“stealth”,“the spike”, etc. vulnerability analysis-vulnerability warning-the black bar safety net

0x01 introduction Before sent over a patch a generic D3D game buck perspective plug-in, a buddy because the stock Duvet cover, with a plug-in to play the ultimate firepower of boredom, a do nothing level is too dishes light has a perspective or abused, please I helped him the whole point of the...

Google Chrome Cleanup Tool DLL Hijacking

Hi @ll, Google's softwareremovaltool.exe alias Chrome Cleanup Tool loads and executes several DLLs from its "application directory" during runtime: Windows XP: SetupAPI.dll, NTMarta.dll, ClbCatQ.dll, SRClient.dll, UXTheme.dll, RASAPI32.dll, HNetCfg.dll, IPHlpAPI.dll, RASAdHlp.dll, XPSP2Res.dll,...

Gratipay: stop serving grtp.co over HTTP

Target Domain: grtp.co 1 Issue Details: Service available on HTTP As per the policy details under scope on HackerOne portalhttps://hackerone.com/gratipay, the 'grtp.co'. should be available only on port 443 or HTTPS protocol. However grtp.co service is running on port 80 too i.e., running on HTTP...

How Just Opening an MS Word Doc Can Hijack Every File On Your System

If you receive a mail masquerading as a company's invoice and containing a Microsoft Word file, think twice before clicking on it. Doing so could cripple your system and could lead to a catastrophic destruction. Hackers are believed to be carrying out social engineering hoaxes by adopting...

FLARE Script Series: flare-dbg Plug-ins

Introduction This post continues the FireEye Labs Advanced Reverse Engineering FLARE script series. In this post, we continue to discuss the flare-dbg project. If you haven’t read my first post on using flare-dbg to automate string decoding, be sure to check it out! We created the flare-dbg Pytho...

Google Safe Browsing Deceptive Embedded Content

Google’s Safe Browsing API is almost a living organism, constantly evolving and adapting to online threats. On Wednesday, Google announced the latest enhancements to the service, with new features that protect users on the web from deceptive embedded content. “You may have encountered social...

Fisher-Price, hereO Toys Expose Kids' Personal Data

As more devices are connected to the Internet, not only are vulnerabilities introduced into those networked things, but also some glaring holes are exposed in organizations’ ability to receive and triage bug reports. Researchers at Rapid7 today disclosed details on a pair of vulnerabilities in to...

Zomato: Subdomain Takeover

Hello, Your Subdomain engineering.zomato.com is Pointing to Tumblr.com You should immediately remove the DNS-entry for engineering.zomato.com is Pointing to Tumblr.com.. Any One Can Claim That Domain , Please Read The Advisory Below. Remediation Please make sure you're always going through your...

my.engr.illinois.edu XSS vulnerability

Vulnerable URL: https://my.engr.illinois.edu/labtrack/utildatajson.asp?callback=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:11 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

colorado.edu XSS vulnerability

Vulnerable URL: http://www.colorado.edu/engineering/civil/db/DBS/glossary.cgi?word=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5369...

Holiday Season 2015 Email Campaign

The holiday season is a time when many people go on vacation or at least get much-needed downtime from work, but that is not always the case with attackers. To better understand the threats we face during “the most wonderful time of the year,” FireEye Labs has been collecting data on the most...

Oracle Supply Chain Agile Engineering Data Management Install Component Data Access Vulnerability

Oracle Supply Chain Products Suite is a suite of supply chain solutions that provides value chain planning, value chain execution, and product lifecycle management. An unspecified vulnerability exists in the Oracle Supply Chain Agile Engineering Data Management Install component, which allows...

CVE-2016-0498

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.2.2, 6.1.3.0, and 6.2.0.0 allows local users to affect confidentiality via unknown vectors related to Install...

CVE-2016-0498

Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.2.2, 6.1.3.0, and 6.2.0.0 allows local users to affect confidentiality via unknown vectors related to Install...