238 matches found
Thunderstrike 2 Mac OS X Firmware Worm
A new attack against Intel firmware running in Apple computers is expected to be unveiled at this week’s Black Hat conference. The research is an extension of the Thunderstrike Mac OS X firmware bootkit disclosed this spring that enables the undetectable installation of malicious firmware that...
Equation APT Group Attack Platform A Study in Stealth
Spies thrive only when they’re able to quietly infiltrate targets and slither away unnoticed; this principle is the same whether we’re talking about the physical world, or digital. The recently uncovered Equation APT group is prime example of the investment nation-state sponsored attackers make i...
Video: Vitaly Kamluk on The Equation Group APT
Kaspersky Lab’s global research and analysis team uncovered what they claim is the most sophisticated advanced persistent threat group yet known. Known as the Equation Group, researchers led by GReAT director Costin Raiu say the threat actors have been operating for 15 years or more and are known...
Dennis Fisher and Mike Mimoso Discuss the 2015 Security Analyst Summit
Dennis Fisher and Mike Mimoso discuss their takeaways from the SAS 2015 conference, including the Equation Group APT analysis, hacking car washes, indexing the dark web and hacking home appliances. Download: digitalunderground187.mp3 Music by Chris Gonsalves...
Costin Raiu on the Equation Group APT
CANCUN–Dennis Fisher talks with Costin Raiu of the Kaspersky Lab GReAT team about the researcher behind the Equation Group campaign, the group’s capabilities and why they seem to have gone dark now. READ Massive Decades Long Cyberespionage Campaign Uncovered READ Inside nls933w.dll, the Equation...
Inside nls_933w.dll, the Equation APT Persistence Module
CANCUN – The names called out like beacons from the screen: Samsung; Seagate; Western Digital; Hitachi; Maxtor. Hardware makers were in the crosshairs of the Equation APT group and it was perhaps the worst possible scenario imagined by researchers looking at the frightening and extensive storehou...
NSA Planted Stuxnet-Type Malware Deep Within Hard Drive Firmware
The U.S. National Security Agency NSA may be hiding highly-sophisticated hacking payloads in the firmware of consumer hard drives over the last 15 to 20 years in a campaign, giving the agency the means to eavesdrop on thousands of targets’ computers, according to an analysis by Kaspersky labs and...
Massive, Decades-Long Cyberespionage Framework Uncovered
CANCUN–Researchers at Kaspersky Lab have uncovered a cyberespionage group that has been operating for at least 15 years and has worked with and supported the attackers behind Stuxnet, Flame and other highly sophisticated operations. The attackers, known as the Equation Group, used two of the zero...
MS14-068: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) (ESKIMOROLL)
The remote Windows host is affected by a privilege escalation vulnerability due to the Kerberos Key Distribution Center KDC implementation not properly validating signatures. A remote attacker can exploit this vulnerability to elevate an unprivileged domain user account to a domain administrator...
MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) (EMERALDTHREAD)
The version of the Print Spooler service on the remote Windows host is affected by a service impersonation vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code on a Windows XP system to escalate privileges on all other supported Windows systems. EMERALDTHREAD is...
MS10-046: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198) (EASYHOOKUP)
The remote windows host contains a version of the Windows Shell that contains a vulnerability in the way it handles shortcut icons. An attacker, exploiting this flaw, can execute arbitrary commands on the remote host subject to the privileges of the user opening the shortcut. EASYHOOKUP is one of...
MS09-050: Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517) (EDUCATEDSCHOLAR)
The remote Windows host contains a vulnerable SMBv2 implementation with the following issues : - A specially crafted SMBv2 packet can cause an infinite loop in the Server service. A remote, unauthenticated attacker can exploit this to cause a denial of service. CVE-2009-2526 - Sending a specially...
MS09-050: Microsoft Windows SMB2 _Smb2ValidateProviderCallback() Vulnerability (975497) (EDUCATEDSCHOLAR) (uncredentialed check)
The remote host is running a version of Microsoft Windows Vista or Windows Server 2008 that contains a vulnerability in its SMBv2 implementation. An attacker can exploit this flaw to disable the remote host or to execute arbitrary code on it. EDUCATEDSCHOLAR is one of multiple Equation Group...
[oCERT-2009-010] mimeTeX and mathTeX buffer overflows and command injection
2009-010 mimeTeX and mathTeX buffer overflows and command injection Description: The mimeTeX and mathTeX CGIs are widely used helper executables that allow mathematical equation rendering in the form of images. Both applications suffer from several buffer overflows as well as command injection...
CVE-2006-4635
Unspecified vulnerability in MySource Classic 2.14.6, and possibly earlier, allows remote authenticated users, with superuser privileges, to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in WebExtensions - Notitia I/II. NOTE: due to lack of details, it is not...
[SA21757] MySource Classic Equation Attribute PHP Code Injection
TITLE: MySource Classic Equation Attribute PHP Code Injection SECUNIA ADVISORY ID: SA21757 VERIFY ADVISORY: http://secunia.com/advisories/21757/ CRITICAL: Moderately critical IMPACT: System access WHERE: From remote SOFTWARE: MySource Classic 2.x http://secunia.com/product/5773/ DESCRIPTION: A...
