My comments on Forrester’s “Vulnerability Management vendor landscape 2017”

A top consulting company, Forrester Research, recently published report "Vendor Landscape: Vulnerability Management, 2017". You can read for free by filling a small form on Tenable web site. What's interesting in this document? First of all, Josh Zelonis and co-authors presented their version of ...

Shodan’ Malware Hunter to Expose Command & Control Centers of Botnets

By Jahanzaib Hassan Recorded Future, a threat intelligence company together with Shodan, which is an internet search engine connecting services to internet devices, have created an online crawler which they call the Malware Hunter. What does it do? The Malware Hunter is a program that sends out...

Malware Hunter Crawls Internet Looking for RAT C2s

A new crawler released today by Shodan designed to find command and control servers has already unearthed 5,800 controllers for more than 10 remote access Trojan RAT families. The crawler, called Malware Hunter, poses as an infected computer beaconing out to an attacker’s server waiting for...

Malware Hunter — Shodan's new tool to find Malware C&C Servers

Rapidly growing, insecure internet-connected devices are becoming albatross around the necks of individuals and organizations with malware authors routinely hacking them to form botnets that can be further used as weapons in DDoS and other cyber attacks. But now finding malicious servers, hosted ...

Dan Geer: Cybersecurity, Humanity's Future "Conjoined"

Given the intertwinement of technology with communication, politics, economies and overall human progress, it seems to go hand-in-hand that cybersecurity must be elevated in parallel. Dan Geer, considered atop the food chain of security thinkers, said during last week’s Source Boston conference...

The 'Audience of You' at NAB

It's all about the "audience of you" as Akamai gears up for next week's 2017 NAB Show in Las Vegas. With that phrase, we're talking about helping to deliver the best possible experiences for each and every OTT video viewer. It's not an easy thing to do, but we're demonstrating a host of new...

Low-Cost Ransomware Service Discovered

A new ransomware as a service RaaS called Karmen has been discovered by security researchers at Recorded Future. This service allows anyone, including novices, to set up an account and customize their own ransomware campaign. The Karmen RaaS costs $175 and lets buyers set ransom prices, determine...

future.museum.ru XSS vulnerability

Vulnerable URL: http://www.future.museum.ru/lmp/link.asp?back=books/consept.htm=javascript:alert%28/OPENBUGBOUNTY/%29 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Jon Oberheide on Perimeter Security

Mike Mimoso talks to Duo Security co-founder and CTO Jon Oberheide at RSA Conference about Google’s BeyondCorp security model, enforcing perimeter security, how endpoint security has evolved through the years, and the future of passwords. Download: JonOberheideonPerimeterSecurity.mp3 Music by Chr...

Horoscope - your astro future - Dangerous filesystem permissions, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Horoscope - your astro future published at the 'play' market has multiple vulnerabilities...

CVE-2016-1548

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimat...

Sanity Check Bypass

PySAML2 is vulnerable to sanity bypass. By failing a check and not causing an exception, malicious attackers can bypass all future checks. These checks can be failed by setting a wrong value for the destination or using a mismatched response ID...

Flash Exploit Found in Seven Exploit Kits

A nasty Adobe Flash zero-day vulnerability that was remediated in an emergency update in October 2015 was thereafter co-opted by seven exploit kits, according to an analysis published today by researchers at Recorded Future. The Adobe vulnerability, CVE-2015-7645, was also used by the Russian APT...

Julian Assange is not Dead, but his Internet Connection is Cut by 'State Party'

Don't worry — Julian Assange is alive and kicking! But his Internet connection is dead. Earlier today, Wikileaks tweeted that its co-founder, Julian Assange, had his internet connection intentionally cut by an unidentified "state party." The non-profit organization said it had "activated...

Future TV Lebanon - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Future TV Lebanon published at the 'play' market has multiple vulnerabilities...

Apple testing Ultra-Fast Li-Fi Wireless Technology for Future iPhones

Apple to make future iPhones compatible with a cutting-edge technology that has the capability to transmit data at 100 times the speed of WiFi, suggests the code found within the iOS firmware. Apple may ship future iPhones with Li-Fi capabilities, a new technology that may end up replacing the...

futureelectronics.es Open Redirect vulnerability

Vulnerable URL: http://www.futureelectronics.es/es/manufacturers/te-connectivity/Paginas/redir.ashx?ciid=5489=Advertising=207=http://www.xssposed.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:|...

futureproducers.com Open Redirect vulnerability

Vulnerable URL: http://www.futureproducers.com/forums/redirect-to/?redirect=http://xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:55 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank|...

Experts Say Bitcoin Extortionist Copycats on the Rise

Experts believe that the success tied to a recent spate of DDoS-for-hire groups may be because many are copycat collectives operating with a shorter lifespan. Researchers with Recorded Future, a Massachusetts-based firm that tracks real time threat intelligence, said Monday that they’ve noticed a...

Stolen U.S. Government Credentials Found Online

Credentials stolen in breaches and sundry hacks belonging to close to 100 unique U.S. government domains are scattered among a number of paste sites and are searchable in other locations online. Analysts at Recorded Future said on Wednesday that through open source intelligence gathering and...