CVE-2019-1010009

CVE-2019-1010009 affects DGLogik DGLux Server All Versions via the IoT API. The root cause described is insecure permissions in the IoT API, enabling remote execution and credential leaks when the server is accessible (attack vector: Any Accessible Server). NVD data shows a high to critical impac...

Hacked Hair Straighteners Can Threaten Homes

Researchers have found a way to successfully hack connected hair straighteners to turn them on and increase the heating element up to its maximum temperature—causing a serious fire hazard for unsuspecting owners. Pen Test Partners decided to put the Glamoriser hair straightener through its securi...

Implementing Bug Bounty Programs: The Right and Wrong Approaches

While bug-bounty programs may seem like a cure-all solution for companies looking discover vulnerabilities in their systems more efficiently, the fact remains that a program could overwhelm a firm’s internal security team and cause other major headaches if implemented the wrong way. “You have to...

Docker Elevation of Privilege Vulnerability

Summary CVE-2018-15664 describes a vulnerability in the Docker runtime and the underlying community project, Moby wherein a malicious/compromised container can acquire full read/write access to the host operating system where that container is running. The vulnerability depends on the way that th...

CVE-2017-8228

Amcrest IPM-721S (V2.420.AC00.16.R.20160909) contains a vulnerability (CVE-2017-8228) where Amcrest cloud verification for adding cameras to a user’s account is insufficient. An attacker who knows a camera’s serial number and the user’s recent reboot window can add another user’s camera to their ...

Related vulnerabilities have now been patched: the Orvibo smart home devices disclosure of user information-bug warning-the black bar safety net

From Orvibo aspect to understand, this relates to the information disclosure of the security vulnerability has now been fixed, and the user information of the protection level, at the same time they also want and professional information security research team into cooperation with the protection...

CVE-2017-11578

It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the...

Design/Logic Flaw

It was discovered as a part of the research on IoT devices in the most recent firmware for Blipcare device that the device allows to connect to web management interface on a non-SSL connection using plain text HTTP protocol. The user uses the web management interface of the device to provide the...

CVE-2017-11578

CVE-2017-11578 affects the Blipcare wireless blood pressure monitor. The device exposes its web management interface over plain HTTP (non-SSL), allowing an attacker on the same wireless network to conduct a MITM and sniff the user’s Wi‑Fi credentials. The impact is disclosure of credentials witho...

5 Years of Fighting DDoS with the Power of Akamai

Additional analysis and research provided by Principal Architect, Tom Emmons Earlier this year, Akamai celebrated the fifth anniversary of the Prolexic acquisition. The merger was officially completed in February of 2014, and a lot has happened since then. In this post, we want to spend a moment...

A week in security (June 24 – 30)

Last week on Malwarebytes Labs, we peeled back the mystery on an elusive malware campaign that relied on blank JavaScript injections, detailed for readers our latest telemetry on the tricky GreenFlash Sundown exploit, and looked at one of the top campaigns directing traffic toward scareware pages...

Countdown to Black Hat: Top 10 Sessions to Attend — #4

With Black Hat USA 2019 fast approaching, we continue our blog series highlighting training sessions and research briefings that we think Qualys customers will find relevant and valuable. Our pick this week is the training session An Introduction To IoT Pentesting With Linux. The course offers “a...

How we hacked our colleague’s smart home

In this article, we publish the results of our study of the Fibaro Home Center smart home. We identified vulnerabilities in Fibaro Home Center 2 and Fibaro Home Center Lite version 4.540, as well as vulnerabilities in the online API. An offer you cannot refuse The backbone of any technology compa...

Myspace Employees Used to Spy on Users

Robert Mueller will testify, malware wrecks IoT, and more of the week's top security news...

This Week in Security News: Malvertising and Internet of Things Malware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about a new Internet of Things malware that’s bricked thousands of devices. Also, read about a ransomware family that’s using...

Linux Kernel TCP SACK Denial of Service Vulnerability

Executive Summary Known vulnerabilities exist in the Linux kernel. These vulnerabilities are documented by the following CVEs: CVE-2019-11477, CVE-2019-11478, and CVE-2019-11479. The purpose of this advisory is to explain the various effects of these vulnerabilities and to provide links to more...

Than Mirai botnet and BrickerBot more powerful IOT killer app still appeared. Behind the developer was actually a 14-year-old Sao years! - Vulnerability warning-the black bar safety net

! A new malicious program is through the destruction of the IOT device firmware and let them completely into“bricks”, which is similar in 2017, the destruction of millions of devices BrickerBot malicious programs. This malicious program is known as Silex, which by destroying the IOT devices of th...

Thousands of IoT Devices Bricked By Silex Malware

A 14-year-old hacker used a new strain of malware this week to brick up to 4,000 insecure Internet of Things devices – before abruptly shutting down his command and control server. The malware, dubbed Silex, was first discovered by Larry Cashdollar, senior security intelligence response engineer ...

SIRT Advisory: Silexbot Bricking Systems With Known Default Login Credentials

On June 25th, I discovered a new bot named Silexbot on my honeypot. The bot itself is a blunt tool used to destroy IoT devices. Its author, someone who claims to be a 14-year-old boy from Europe, has made his...

NIST Releases Report on Managing IoT Risks

The National Institute of Standards and Technology NIST has released the Considerations for Managing Internet of Things IoT Cybersecurity and Privacy Risks report. The publication—the first in a planned series on IoT—aims to help federal agencies and other organizations manage the cybersecurity a...