New Version of Alureon Ups the Ante on Encryption

A new version of the venerable Alureon malware has appeared, and this one includes some odd behavior designed to prevent analysis and detection by antimalware systems. However, this isn’t the typical evasion algorithm, as it uses some unusual encryption and decryption routines to make life much...

China plugging holes in its Great Firewall by disrupting VPN traffic !

China plugging holes in its Great Firewall by disrupting VPN traffic ! Chinese internet users suspect that their government is interfering with the method they have been using to tunnel under the "Great Firewall" to prevent them connecting with the outside world. Sites such as search engine Googl...

Microsoft Pushes Out Two New Security Tools

In parallel with its release of 17 bulletins on Patch Tuesday this month, Microsoft also unveiled two new tools that are meant to help make a couple of common exploitation scenarios more difficult for attackers. The company released a tool called Office File Validation for some older versions of...

Man Pleads Guilty in a Scam Charging Unwitting Customers for Premium Phone Calls

UPDATED: A New Hampshire man has pleaded guilty in Federal Court to charges of conspiracy to commit computer fraud and failure to file income taxes stemming from a scam forcing telephone modems to call premium service numbers without their owner’s consent. Thirty seven year-old Asu Pala of Hudson...

Stonesoft Claims To Find More Evasion Techniques in Security Products

Four months after it first went public with a warning about widespread vulnerabilities in network security products, Stonesoft said it has found more than 100 new holes, and that security vendors are doing little to address the problem. The company on Monday announced that it has submitted...

VaM Shop 1.6 Cross Site Request Forgery / Cross Site Scripting

=================================== Vulnerability ID: HTB22780 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinvamshop.html Product: VaM Shop Vendor: Vamsoft http://vamshop.ru/ Vulnerable Version: 1.6 and Probably Prior Versions Vendor Notification: 28 December 2010 Vulnerability Type: CSRF...

Metasploit 3.5.1 adds Cisco device exploitation !

Metasploit now enables security professionals to exploit Cisco devices, performs passive reconnaissance through traffic analysis, provides more exploits and evaluates an organization's password security by brute forcing an ever increasing range of services. This latest release adds stealth...

DCE-RPC Invalid NDR Value Evasion Technique (CVE-2010-0102)

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

DCE-RPC Fragmented Requests (CVE-2010-0102)

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Check Point's Response to Stonesoft's "Advanced Evasion Techniques" (CVE-2010-0102)

...

Microsoft SMB Invalid Write Mode Evasion Technique

The SMB Protocol is a network file sharing protocol that is implemented in Microsoft Windows. There are many known vulnerabilities in applications based on the SMB protocol. Though IDS and IPS devices have signatures to detect attacks exploiting these vulnerabilities, these devices can be evaded...

DCE-RPC Big Endian Evasion Technique

DCE/RPC stands for "Distributed Computing Environment / Remote Procedure Calls". It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having...

Warning About IDS Evasion Greeted by Chorus of 'Meh'

‘All your IDS are belong to us,’ was the message on Monday, after researchers at networking security equipment vendor Stonesoft announced the discovery of evasion techniques that could be used by sophisticated attackers to bypass network based IDS and IPS. The disclosure raises questions about th...

Researchers Cripple Pushdo Botnet

Researchers have made a huge dent in a major variant of the Pushdo botnet, virtually crippling the network by working with hosting providers to take down about two thirds of the command-and-control servers involved in the botnet. Pushdo for years has been one of the major producers of spam and...

Inside the Black Energy 2 Botnet

By Dmitry Tarakanov Cybercriminals use a variety of bots to conduct DDoS attacks on Internet servers. One of the most popular tools is called Black Energy. To date, Kaspersky Lab has identified and implemented detection for over 4,000 modifications of this malicious program. In mid-2008 malware...

Entry Level Content Management System (EL CMS) - SQL Injection

Entry Level Content Management System EL CMS - SQL Injection + Contact : vir0e5athackermaildotcom + Group : TECON The Eye COnference Indonesia + Site : http://tecon-crew.org Software Information +SOftware : Entry Level Content Management System EL CMS +vendor : http://www.entrylevelcms.com/...

Gumblar Botnet Shifts Tactics

The criminals behind the Gumblar botnet and malware campaign have been adapting their techniques, as attackers are wont to do, in order not only to evade detection but to prevent researchers from downloading and analyzing new versions of the malware. A new analysis of the recent activity by Gumbl...

Winamp - Playlist UNC Path Computer Name Overflow (Metasploit)

$Id: winampplaylistunc.rb 9179 2010-04-30 08:40:19Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

How Criminals Hide Malware from Search Bots

Computer criminals are taking steps to block search engines bots from indexing legitimate Web pages that have been hacked and booby-trapped with hostile code. Read the full article. KrebsonSecurity...

F-Secure Products Archive Files Scan Evasion (2010-1)

The remote host has an antivirus product from F-Secure installed. According to its version, the product fails to accurately scan specially crafted 7Z, GZIP, CAB, and RAR archive files. It is, therefore, possible for such files to evade detection from the scanning engine. C Tenable Network Securit...