Taking apart a double zero-day sample discovered in joint hunt with ESET

In late March 2018, I analyzed an interesting PDF sample found by ESET senior malware researcherAnton Cherepanov. The sample was initially reported to Microsoft as a potential exploit for an unknown Windows kernel vulnerability. During my investigation in parallel with ESET researchers, I was...

connect.esetnod32.ru XSS vulnerability

Open Bug Bounty ID: OBB-628683 Description| Value ---|--- Affected Website:| connect.esetnod32.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-4990 Adobe Reader code execution exploit analysis-exploit warning-the black bar safety net

2018 5 on 15 September, ESET released the article“A tale of two zero-days”, the article disclosed this year 3 month ESET in malware scan engine VirusTotal on the capture of the one used to attack the test PDF document. The PDF document contains a sample of two pieces of 0-day Vulnerability,...

Microsoft Windows Kernel 'Win32k.sys' Local Privilege Escalation Vulnerability(CVE-2018-8120)

作者：bigric3 作者博客： 5月15日ESET发文其在3月份捕获了一个 pdf远程代码执行（cve-2018-4990）+windows本地权限提升（cve-2018-8120）的样本。ESET发文后，我从vt上下载了这样一份样本（）。初步逆向，大致明确如外界所传，该漏洞处于开发测试阶段，不慎被上传到了公网样本检测的网上，由ESET捕获并提交微软和adobe修补。测试特征字符串如下 定位样本中关键的代码并调试分析...

Adobe Reader zero-day discovered alongside Windows vulnerability

During the first half of 2018, we have witnessed some particularly interesting zero-day exploits, including one for Flash CVE-2018-4878 and more recently for Internet Explorer CVE-2018-8174. The former was quickly used by exploit kits such as Magnitude, while it is only a matter of time before we...

ESET NOD32 Antivirus for Linux Installed

ESET NOD32 Antivirus for Linux is installed on the remote host. TRUSTED...

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

Today, with help from Microsoft security researchers, law enforcement agencies around the globe, in cooperation with Microsoft Digital Crimes Unit DCU, announced the disruption of Gamarue, a widely distributed malware that has been used in networks of infected computers collectively called the...

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

Today, with help from Microsoft security researchers, law enforcement agencies around the globe, in cooperation with Microsoft Digital Crimes Unit DCU, announced the disruption of Gamarue, a widely distributed malware that has been used in networks of infected computers collectively called the...

Microsoft teams up with law enforcement and other partners to disrupt Gamarue (Andromeda)

Today, with help from Microsoft security researchers, law enforcement agencies around the globe, in cooperation with Microsoft Digital Crimes Unit DCU, announced the disruption of Gamarue, a widely distributed malware that has been used in networks of infected computers collectively called the...

BankBot banking malware found in flashlight and solitaire apps

By Waqas In a joint research, IT security researchers at Avast, ESET, and This is a post from HackRead.com Read the original post: BankBot banking malware found in flashlight and solitaire apps...

BankBot Returns On Play Store – A Never Ending Android Malware Story

Even after so many efforts by Google for making its Play Store away from malware, shady apps somehow managed to fool its anti-malware protections and infect people with malicious software. A team of researchers from several security firms has uncovered two new malware campaigns targeting Google...

Bad Rabbit: New Ransomware Attack Rapidly Spreading Across Europe

A new widespread ransomware attack is spreading like wildfire around Europe and has already affected over 200 major organisations, primarily in Russia, Ukraine, Turkey and Germany, in the past few hours. Dubbed "Bad Rabbit," is reportedly a new Petya-like targeted ransomware attack against...

blog.eset.ro XSS vulnerability

Open Bug Bounty ID: OBB-363616 Description| Value ---|--- Affected Website:| blog.eset.ro Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

eset.datasystem.ru XSS vulnerability

Vulnerable URL: https://eset.datasystem.ru/search/?query=xss%3Csvg/onload=prompt%27openbugbounty%27%3E=0=0 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

eset.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-339539 Description| Value ---|--- Affected Website:| eset.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

int.form.eset.com XSS vulnerability

Vulnerable URL: http://int.form.eset.com/prs/?language=sk=hello eset!!!" Details: Description| Value ---|--- Patched:| Yes, at 07.10.2017 Latest check for patch:| 07.10.2017 21:40 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP websi...

eset.com XSS vulnerability

Vulnerable URL: https://www.eset.com/fileadmin/templates/swf/Preloader.swf?flashContentURL=javascript:confirm'XSSPOSED' Details: Description| Value ---|--- Patched:| Yes, at 05.01.2018 Latest check for patch:| 05.01.2018 08:32 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

encryption.eset.com XSS vulnerability

Vulnerable URL: https://encryption.eset.com/fr/'%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain;%3E%3C!-- Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No...

ISPs May Be Helping Hackers to Infect you with FinFisher Spyware

Are you sure the version of WhatsApp, or Skype, or VLC Player installed on your device is legitimate? Security researchers have discovered that legitimate downloads of several popular applications including WhatsApp, Skype, VLC Player and WinRAR have reportedly been compromised at the ISP level t...

eset.com.uy XSS vulnerability

Vulnerable URL: https://www.eset.com.uy/productos/index.php/'%22--!%3E%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E Details: Description| Value ---|--- Patched:| Yes, at 18.09.2017 Latest check for patch:| 18.09.2017 09:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...