Warning! Think Twice Before Using USB Drives

Security researchers have discovered a new data-stealing Trojan that makes special use of USB devices in order to spread itself and does not leave any trace of activity on the compromised systems. Dubbed USB Thief or Win32/PSW.Stealer.NAI, the malware has the capability of stealthy attacking...

How To Keep Your Android Phone Secure

As the number of threats is on the rise, Android platform is no longer safe, which isn't a surprise to anyone. Most of us are usually worried more about the security of our desktops or laptops and forget to think about the consequences our smartphones can make if compromised or stolen. Unlike...

ESET NOD32 Antivirus DLL Hijacking

Hi @ll, the executable installer ° of ESET's NOD32 antivirus, esetnod32antivirusliveinstaller.exe, loads and executes at least the rogue/bogus/malicious Cabinet.dll and DbgHelp.dll eventually found in the directory it is started from ' the "application directory". For software downloaded with a w...

Microsoft, Law Enforcement Collaborate in Dorkbot Takedown

A coalition of law enforcement agencies worked together recently to disrupt Dorkbot, a botnet that’s managed to infect more than one million machines in 190 countries during the last year. Researchers with Microsoft’s Malware Protection Center announced the news via a post on the MMPC blog. Two...

eset.entelechargement.com XSS vulnerability

Vulnerable URL: http://eset.entelechargement.com/antivirus/eset-nod32-antivirus.html?'"--...

Analysis of the latest firefox 0day attack-vulnerability warning-the black bar safety net

! /Article/UploadPic/2015-8/2015813114114594.jpg The Mozilla Foundation in the 8 May 6, as Firefox released a security update to fix the Firefox embedded PDF reader pdf. js in the cve-2 0 1 5-4 4 9 5 vulnerability. The vulnerability allows an attacker to bypass the same origin policy,in the local...

Arbitrary Command Execution Vulnerability in Multiple ESET Products

ESET is a world-renowned computer security software company based in Bratislava, Slovakia. An arbitrary command execution vulnerability exists in several ESET products, which allows an attacker to exploit this vulnerability to execute arbitrary commands with root privileges and take full control ...

ESET NOD32 Anti-Virus Emulation Remote Code Execution

A Remote Code Execution vulnerability has been reported in ESET's NOD32 Anti-Virus products. A successful exploitation of this vulnerability can allow code execution with the privileges of the affected product...

Analysis and Exploitation of an ESET Vulnerability

Do we understand the risk vs. benefit trade-offs of security software? Tavis Ormandy, June 2015 Introduction Many antivirus products include emulation capabilities that are intended to allow unpackers to run for a few cycles before signatures are applied. ESET NOD32 uses a minifilter or kext to...

Malicious Minecraft apps affect 600,000 Android Users

So you love Minecraft? You might want to be very careful before downloading the cheats for the popular Minecraft game from Google Play Store. Nearly 3 Million users have downloaded malicious Minecraft Android applications for their smartphone and tablets from the Google Play store, security...

CVE-2014-4974

The ESET Personal Firewall NDIS filter EpFwNdis.sys kernel mode driver, aka Personal Firewall module before Build 1212 20140609, as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls...

Memory corruption

The ESET Personal Firewall NDIS filter EpFwNdis.sys kernel mode driver, aka Personal Firewall module before Build 1212 20140609, as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls...

CVE-2014-4974

The ESET Personal Firewall NDIS filter EpFwNdis.sys kernel mode driver, aka Personal Firewall module before Build 1212 20140609, as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls...

CVE-2014-4974

Vulnerability summary (CVE-2014-4974): The ESET Personal Firewall NDIS filter driver (EpFwNdis.sys) in multi-VM/host products (kernel module used in ESET 5.0–7.0) is vulnerable to local IOCTL-based memory leakage. The issue affects EpFwNdis.sys built before 1212 (20140609); crafted IOCTL calls ca...

PT-2014-6237

Name of the Vulnerable Software and Affected Versions ESET Personal Firewall versions 5.0 through 7.0 Description The issue allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls. This is related to the ESET Personal Firewall NDIS filter kernel mode driver,...

CVE-2014-4974: Exposure of Sensitive Information to an Unauthorized Actor

The ESET Personal Firewall NDIS filter EpFwNdis.sys kernel mode driver, aka Personal Firewall module before Build 1212 20140609, as used in multiple ESET products 5.0 through 7.0, allows local users to obtain sensitive information from kernel memory via crafted IOCTL calls...

CVE-2014-4973

The ESET Personal Firewall NDIS filter EpFwNdis.sys driver in the Firewall Module Build 1183 20140214 and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call...

Code injection

The ESET Personal Firewall NDIS filter EpFwNdis.sys driver in the Firewall Module Build 1183 20140214 and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call...

Immunity Canvas: ESET_EPFWNDIS

Name| ESETEpFwNDIS ---|--- CVE| CVE-2014-4973 Exploit Pack| CANVAS Description| EpFwNDIS.sys Trusted Value Vulnerability Notes| Repeatability: Infinite Notes: This module exploits a vulnerability on the ESET Personal Firewall NDIS filter EpFwNdis.sys driver. The Firewall Module Build 1183 2014021...

CVE-2014-4973

The ESET Personal Firewall NDIS filter EpFwNdis.sys driver in the Firewall Module Build 1183 20140214 and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call...