UBUNTU-CVE-2017-7609

elfcompress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service memory consumption via a crafted ELF file...

CVE-2017-7609: Improper Input Validation

elfcompress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service memory consumption via a crafted ELF file...

PT-2017-17840 · Red Hat +3 · Elfutils +3

Name of the Vulnerable Software and Affected Versions: elfutils version 0.168 Description: The issue is related to the elf compress.c file in elfutils, which does not validate the zlib compression factor. This allows remote attackers to cause a denial of service, specifically memory consumption, ...

Lessons From Top-to-Bottom Compromise of Brazilian Bank

SINT MAARTEN—For three months starting last October, hackers pulled off a stunning compromise of a Brazilian bank’s operations top-to-bottom. The attack was comprehensive with each of the bank’s 36 domains, corporate email and DNS under the attacker’s control. Once Kaspersky Lab researchers Fabio...

Remote Access no longer needs to be Complex and Cumbersome

From an IT management perspective, remote access management can be complex. Deployment, administration, testing and compliance is often multifaceted and time consuming, and security is an on-going concern. Granted, I have talked with IT professionals who tell me VPNs - being the primary remote...

Instagram Adds Two-Factor Authentication

Instagram became the latest in a long line of services over the years to offer users two-factor authentication this week. Kevin Systrom, co-founder and CEO of the Facebook-owned mobile photo-sharing app announced the feature on its blog Thursday afternoon. With the feature – accessible via Settin...

Google, Jigsaw Partner on Free Tools to Secure Elections

Alphabet subsidiary Jigsaw announced on Tuesday that it and Google would offer a free suite of security tools aimed at securing political elections. The announcement was fresh off a tense House Intelligence Committee meeting on Monday during which FBI Director James Comey confirmed that the burea...

Hackers Using Fake Cellphone Towers to Spread Android Banking Trojan

Chinese Hackers have taken Smishing attack to the next level, using rogue cell phone towers to distribute Android banking malware via spoofed SMS messages. SMiShing — phishing attacks sent via SMS — is a type of attack wherein fraudsters use number spoofing attack to send convincing bogus message...

Trello: Rate limiting of incorrect Two Factor Authentication codes not enforced

Trello has a feature which allows the user to enable Two factor authentication to enhance the security. But no Rate Limiting is present on second authentication, i.e. code sent to Registered Mobile Number. Attacker can try as many attempts as he wants to bypass the 2 factor authentication. So usi...

Centrally Manage SSH Administrative Access: KeyBox

Centrally Manage SSH Administrative Access KeyBox is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user’s public SSH keys. Key management and administration is based on profiles assigned to...

Websites Can Now Track You Online Across Multiple Web Browsers

You might be aware of websites, banks, retailers, and advertisers tracking your online activities using different Web "fingerprinting" techniques even in incognito/private mode, but now sites can track you anywhere online — even if you switch browsers. A team of researchers has recently developed...

Valve Patches Trivial XSS Bug in Steam

Valve Corp., has patched a cross-site scripting vulnerability on its popular Steam gaming platform that could be exploited by viewing a maliciously crafted profile. The flaw could allow an attacker to carry out phishing attacks or execute malicious scripts just by opening a crafted profile page. ...

Grab: Two-factor authentication bypass on Grab Android App

Description I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/edit which allow me to bypass 2FA sms code due to lack of rate limiting\code expiration after unsuccessful attempts. The root cause of the problem it that facts: no rate limiting+ no code expiratio...

Facebook Tackles Account Recovery with Delegated Recovery Protocol

Account recovery, the second fiddle to authentication, still largely hinges on insecure schemes such as security questions or email-based verification for password resets and the like. Facebook today at the Enigma Conference in Oakland, Calif., offered a more modern solution called Delegated...

Facebook Adds FIDO U2F Security Keys Feature For Secure Logins

Hacking password for a Facebook account is not easy, but also not impossible. We have always been advising you to enable two-factor authentication — or 2FA — to secure your online accounts, a process that requires users to manually enter, typically a six-digit secret code generated by an...

Facebook Touts 'Safer' Security Key Login

Facebook is giving privacy-minded users looking to fortify their accounts yet another layer of security. Brad Hill, a security engineer with the social network, announced on Facebook’s Security page on Thursday that effective immediately, it would let users tie a physical security key to their...

How to Configure NetScaler Gateway and Microsoft Intune (MDM) for Single Factor Authentication

Background The integration of Microsoft Intune with NetScaler Gateway provides best-of-class application access and data protection solution offered by Citrix NetScaler Gateway and Intune. You get the most complete suite of secure productivity apps, including: email calendar contacts note-taking...

iPhone Secretly Sends Your Call History to Apple Even If iCloud Backups are Turned Off

In the fight against encryption, Apple has positioned itself as a staunch defender of its user privacy by refusing the federal officials to provide encryption backdoors into its products, as well as implementing better encryption for its products. However, a new report from a security firm sugges...

Powerful word brother! 4 easy steps to bypass PayPal two-factor authentication mechanism-vulnerability warning-the black bar safety net

! Two-factor authentication, 2FA refers to the combination of password and a physical card or credit card, SMS, phone, token or fingerprint and other biological signs the two conditions of the user authentication method. This approach has for businesses, is mainly used to increase account securit...

OWA and Offic365 two-factor authentication bypass-vulnerability warning-the black bar safety net

Foreword Full disclosure: the BLACK HILLS information security very much in favor of responsible disclosure of vulnerabilities. 2 0 1 6 9 2 8, I to Microsoft reported this vulnerability, may have been to this article publishing 2016.11.2, Microsoft for this vulnerability is always without any...