Another Golang Crypto Miner On the Loose

There are many crypto mining malware variants infecting systems on the internet. On Friday, March 4, 2021, I noticed an interesting hit in my honeypot logs. The binary it captured stood out, as it was rather large at 4MB. I immediately thought it would be a crypto miner written in the Go language...

Photon OS 1.0: Git PHSA-2021-1.0-0369

An update of the git package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0369. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid147825;...

Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure Vulnerabilities

Exploit Title: Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure Exploit Author: Berkan Er Vendor Homepage: https://www.sonlogger.com/ Version: 4.2.3.3 Tested on: Windows 10 Enterprise x64 Version 1803 A remote attacker can be create an user with SuperAdmin profile...

XStream Code Execution Vulnerability (CNVD-2021-28333)

XStream is a simple Java-based library , Java objects serialized to xml and vice versa i.e. : Java objects and xml documents can easily be converted to each other . A code execution vulnerability exists in XStream, which can be exploited by an attacker to manipulate the processed input stream and...

Microsoft Exchange and Verkada Hacks: Isolate Your Apps and APIs from the Internet Cesspool

It's been an interesting start to March in terms of public security incidents. This month kicked off with multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server. And, as if that wasn't enough, that attack was quickly followed by the news that a hacktivis...

Nessus Network Monitor < 5.13.0 Multiple Vulnerabilities (TNS-2021-02)

The version of Nessus Network Monitor NNM installed on the remote host is prior to 5.13.0. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid147729; scriptversion"1.8";...

ProxyLogon PoC Exploit Released; Likely to Fuel More Disruptive Cyber Attacks

The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI on Wednesday issued a joint advisory warning of active exploitation of vulnerabilities in Microsoft Exchange on-premises products by nation-state actors and cybercriminals. "CISA and FBI...

CentOS 8 : nodejs:10 (CESA-2021:0735)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:0735 advisory. - nodejs: HTTP2 'unknownProtocol' cause DoS by resource exhaustion CVE-2021-22883 - nodejs: DNS rebinding in --inspect CVE-2021-22884 Note that Nessus...

More on the Chinese Zero-Day Microsoft Exchange Hack

Nick Weaver has an excellent post on the Microsoft Exchange hack: The investigative journalist Brian Krebs has produced a handy timeline of events and a few things stand out from the chronology. The attacker was first detected by one group on Jan. 5 and another on Jan. 6, and Microsoft acknowledg...

Microsoft Exchange attacks cause panic as criminals go shell collecting

Only last week we posted a blog about multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Seeing how this disclosure came with a patch being available, under normal circumstances you would see some companies update...

Time in Status Cross-Site Scripting Vulnerability

Atlassian Time in Status is a software application from Atlassian Australia that provides a process for identifying issues by reporting the time spent on each status, assignee or group for each issue. A cross-site scripting vulnerability exists in the Time in Status app for Jira in versions prior...

Security Updates for Microsoft Office Products (March 2021)

The Microsoft Office Products are missing security updates. They are affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-24108, CVE-2021-27054, CVE-2021-27057, CVE-2021-27059 C Tenable Netwo...

KLA12108 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Internet Explorer can be exploited remotely to execute arbitrary code. 2....

TAU Threat Advisory: Microsoft Exchange Servers Targeted with Four Zero-day Exploits

The following advisory from VMware Threat Analysis Unit TAU is to provide guidance, best practices and capabilities to identify risk, prevent, detect and respond to this emerging threat. Summary On March 2, 2021 Microsoft announced four zero-day vulnerabilities CVE-2021-26855, CVE-2021-26857,...

A Basic Timeline of the Exchange Mass-Hack

Sometimes when a complex story takes us by surprise or knocks us back on our heels, it pays to revisit the events in a somewhat linear fashion. Heres a brief timeline of what we know leading up to last weeks mass-hack, when hundreds of thousands of Microsoft Exchange Server systems got compromise...

CISA Orders Fed Agencies to Patch Exchange Servers

Hot on the heels of Microsoft’s announcement about active cyber-espionage campaigns that are exploiting four serious security vulnerabilities in Microsoft Exchange Server, the U.S. government is mandating patching for the issues. The news comes as security firms report escalating numbers of relat...

Microsoft Exchange 0-Day Attackers Spy on U.S. Targets

Microsoft has spotted multiple zero-day exploits in the wild being used to attack on-premises versions of Microsoft Exchange Server. Adversaries have been able to access email accounts, steal a raft of data and drop malware on target machines for long-term remote access, according to the computin...

Patch now! Exchange servers attacked by Hafnium zero-days

Microsoft has detected multiple zero-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft attributes the attacks to a group they have dubbed Hafnium. “HAFNIUM primarily targets entities in the United States across a number ...

Photon OS 1.0: Glib PHSA-2021-1.0-0365

An update of the glib package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0365. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid147008;...

HAFNIUM targeting Exchange Servers with 0-day exploits

Update 03/08/2021: Microsoft continues to see multiple actors taking advantage of unpatched systems to attack organizations with on-premises Exchange Server. To aid defenders in investigating these attacks where Microsoft security products and tooling may not be deployed, we are releasing a feed ...