Oracle VM VirtualBox 5.2.x < 5.2.28 / 6.0.x < 6.0.6 (Apr 2019 CPU)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.28 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory : - Multiple unspecified vulnerabilities in the Core component of Oracl...

ICSJWG Spring Meeting April 23–25

The Industrial Control Systems Joint Working Group ICSJWG—a collaborative and coordinating body operating under the Critical Infrastructure Partnership Advisory Council framework—will hold the 2019 ICSJWG Spring Meeting in Kansas City, MO, April 23–25, 2019. ICSJWG facilitates information sharing...

More on the Triton Malware

FireEye is releasing much more information about the Triton malware that attacks critical infrastructure. It has been discovered in more places. This is also a good -- but older -- article on Triton. We don't know who wrote it. Initial speculation was Iran; more recent speculation is Russia. Both...

Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic

In early 2019, FireEye Threat Intelligence identified a spear phishing email targeting government entities in Ukraine. The spear phishing email included a malicious LNK file with PowerShell script to download the second-stage payload from the command and control C&C server. The email was received...

Why Asset Management is so important for Vulnerability Management and Infrastructure Security?

When people ask me how should they start building Vulnerability Management process in their organization well, sometimes it happens, I advice them to create an effective Asset Management process first. Because it's the foundation of the whole Infrastructure Security. The term "Asset Management" h...

North Korea's Hidden Cobra Strikes U.S. Targets with HOPLIGHT

A never-before-seen spyware variant called HOPLIGHT is targeting U.S. companies and government agencies in active attacks, according to the U.S. Department of Homeland Security. In an advisory this week, the United States Computer Emergency Readiness Team US-CERT said that there are nine differen...

Encrypted Messaging Project "Matrix" Suffers Extensive Cyber Attack

Matrix—the organization behind an open source project that offers a protocol for secure and decentralized real-time communication—has suffered a massive cyber attack after unknown attackers gained access to the servers hosting its official website and data. Hackers defaced Matrix's website, and...

The Ping is the Thing: Popular HTML5 Feature Used to Trick Chinese Mobile Users into Joining Latest DDoS Attack

DDoS attacks have always been a major threat to network infrastructure and web applications. Attackers are always creating new ways to exploit legitimate services for malicious purposes, forcing us to constantly research DDoS attacks in our CDN to build advanced mitigations. We recently...

Do High Vanity Bitrates Choke Your Live OTT Service Out of the Gate?

Studies show that video consumption demand is growing faster than capacity. While capacity overhead does exist, current trends suggest that we'll see more bottlenecking on last-hop connectivity, especially with regionally targeted content. By pushing "vanity bitrates" -- those topmost speeds that...

Gustuff banking botnet targets Australia

Vitor Ventura authored this post. Executive summary Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions. As the investigation progressed, Talos came to understand that this campaign was associated with the "ChristinaMorrow" text message spam scam...

TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping

Overview FireEye can now confirm that we have uncovered and are responding to an additional intrusion by the attacker behind TRITON at a different critical infrastructure facility. In December 2017, FireEye publicly released our first analysis on the TRITON attack where malicious actors used the...

ICSA-19-099-02 Siemens Spectrum Power 4.7

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Spectrum Power 4.7 Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability in versions of Spectrum Power 4 using the user-specific...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review the Ado...

A week in security (April 1 – 7)

Last week, Malwarebytes Labs took readers on a brief tour of some of the world's most notable data privacy laws, explored how gamers can protect themselves against cyberthreats, and offered thoughts about the reports that a 23-year-old Chinese woman gained access to President Donald Trump’s...

Kernel update: Virtuozzo ReadyKernel patch 76.0 for Virtuozzo 7.0 Update 9 and Virtuozzo Infrastructure Platform 2.5

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to the kernel 3.10.0-862.20.2.vz7.73.29 Virtuozzo 7.0 Update 9 and Virtuozzo Infrastructure Platform 2.5. Vulnerability id: PSBM-93047, VSTOR-20922 fusekiopcs: kernel crash in processpcsinitreply caused...

8 Tips and Best Practices to Build a Solid Cloud Migration Strategy for 2019

Here are eight fool-proof practices that can help you move your workloads to the cloud. A quick look at cloud migration. Cloud migration involves moving an organization’s data storage and IT operations to a cloud network. Cloud computing services are hosted in a multi-tenant environment and can b...

Product update: Virtuozzo Infrastructure Platform 2.5 Update 5 (2.5.0-1639)

This update provides a new feature as well as stability and usability fixes. Vulnerability id: VSTOR-20558 The same data path ID was assigned to VLAN interfaces in OVS bridges. Vulnerability id: VSTOR-20913 Unable to update storage license. Vulnerability id: VSTOR-21089 Under certain circumstance...

SAS 2019 to Tackle APTs, Supply Chains and More

Kaspersky Lab’s Security Analyst Summit kicks off in Singapore next week, where elite researchers, top cybersecurity firms and global law-enforcement agencies will discuss today’s biggest cybersecurity threats and how best to squash them. This year marks the first time the global security...

Can a Vulnerability Scan break servers and services?

The most serious problem of Vulnerability Scanners is that they are too complex and unpredictable. Usually they don't affect the target hosts, but when they do, welcome to hell! And if you scan huge infrastructure, tens thousands hosts and more, it's not "if" the scanner will break the server it'...

Rockwell Automation Stratix 5950

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Rockwell Automation Equipment: Stratix 5950 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to cause an...