App-ID Cache Poisoning

An evasion technique that takes advantage of the App-ID cache function has recently been published. In certain circumstances, a knowledgeable user can bypass security policy that restricts the use of certain applications by sending numerous specially crafted requests over the network in order to...

Upclicker Trojan Evades Sandbox Detection by Hiding in a Mouse Click

Finding keen new ways to avoid detection by security systems, malware scanners in particular, seems to be a primary objective for malware writers. Researchers at FireEye have found one of the most ingenious, a Trojan called Upclicker that eludes automated sandbox detection by hooking into a mouse...

Necurs Rootkit Infections Way Up

Infections from a nasty bit of malware, generally delivered by the Black Hole Exploit Kit, surged in November, hitting more than 83,000 machines. Microsoft’s Malware Protection Center rates the Necurs rootkit threat as severe. Dubbed a rootkit by Kaspersky Lab, Necurs has many dimensions to it...

Shylock malware : Undetectable virus stealing bank account information

Shylock, a financial malware platform discovered by Trusteer in 2011, is a non-Zeus-based information-stealing trojan that improved methodology for injecting code into additional browser processes to take control of a computer, and an improved evasion technique to prevent malware scanners from...

Shylock Malware Evasion Techniques Now Detect RDP Connections

Plenty of malware samples contain embedded functionality that helps the code avoid detection by security software, or places encryption or packing barriers that keep security researchers from studying changes that would help vendors write detection signatures. The Shylock malware has taken that...

[Snuck] Automatic XSS filter bypass

Snuck is an automatic tool whose goal is to significantly test a given XSS filter by specializing the injections on the basis of the reflection context. This approach adopts Selenium to drive a web browser in reproducing both the attacker's behavior and the victim's. snuck is an automated tool th...

PrestaShop 1.5.1 - Persistent Cross-Site Scripting

PrestaShop or embed src='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc 3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9y Zy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iM...

PrestaShop 1.5.1 - Persistent Cross-Site Scripting

PrestaShop 1.5.1 - Persistent Cross-Site Scripting PrestaShop or embed src='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc 3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9y...

PrestaShop <= 1.5.1 Persistent XSS

PrestaShop = 1.5.1 Persistent XSS Tested under: Firefox, Chrome and Safari latest versions Discover Credits: David Sopas - [email protected] | @dsopas | davidsopas.com/labs Original link: http://davidsopas.com/labs/prestashopxss.txt Description: PrestaShop is the most reliable and flexible...

PrestaShop 1.5.1 Cross Site Scripting

PrestaShop or embed src='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc 3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9y Zy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAi...

Businesses Remain Scared of Spear-Phishing as Attackers Study Behavior

Scared is a strong word, but the reality, according to a Websense analysis by Patrik Runald, is that spear-phishers, like the ones that compromised a White House network last week, are implementing new evasion tactics, fundamentally changing their attack strategies, and revolutionizing the target...

Apple iOS Mobile Mail - LibTIFF Buffer Overflow (Metasploit)

$Id: mobilemaillibtiff.rb 15950 2012-10-09 18:31:08Z rapid7 $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require...

New Iteration of TDSS/TDL-4 Botnet Uses Domain Fluxing to Avoid Detection

A new version of the TDSS/TDL-4 botnet is rapidly growing, primarily because it’s having great success using an evasion technique known as a domain generation algorithm DGA to avoid detection, researchers at Damballa Security revealed today. The algorithm helps the latest version of the botnet...

PT-2012-1389 · Sophos · Sophos Endpoint Security/Control

Name of the Vulnerable Software and Affected Versions: Sophos Endpoint Security and Control version 9.0.5 Description: A race condition exists that allows local users to bypass kernel-mode hook handlers and execute dangerous code. This is achieved through certain user-space memory changes during...

DarkComet RAT Used in New Attack on Syrian Activists

There is a new attack campaign that’s targeting dissidents in Syria by enticing them to install an alleged security tool called AntiHacker, but instead installs the infamous DarkComet remote access tool that has the ability to log keystrokes, capture webcam images and take other surreptitious...

Report: Stealthy New Banking Malware Tilon Emerges

A new type of financial malware has surfaced that’s targeting information submitted through banking forms via the “Man in the Browser” MITB technique and proving difficult to detect, according to research published by computer security firm Trusteer today. A blog entry by the company’s Chief...

ClamAV: 0.97.5 update (important)

This update addresses possible evasion cases in some archive formats and stability issues in portions of the bytecode engine...

The Hackers Conference 2012 Call For Papers #THC2012

We are extremely delighted to announce the Call for Papers for The Hackers Conference 2012 It is a unique event, where the elite of the hacker world, leaders in the information security industry and the Internet community meet face to face to join their efforts to cooperate in addressing the most...

Comodo Internet Security < 3.9 RAR Archive Scan Evasion

The version of Comodo Internet Security installed on the remote Windows host is earlier than 3.9. As such, it may be possible for certain RAR files to evade detection from the scanning engine. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid58230; scriptversion"1.7";...

Newly Compiled Driver Shows Duqu Authors Still At Work

The still-unidentified group of attackers behind Stuxnet and Duqu have drawn quite a bit of attention to themselves in the last couple of years with their creations. Researchers, law enforcement and some particularly angry governments all would like to have a long talk with the crew. But that...