July 10, 2017 – Morning Cyber Coffee Headlines – “Nikola Tesla” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 10, 2017 - Headlines ‘Time to Move Forward,’ Trump Says After Putin Denies...

IoT mDNS/DNS-SD QM Amplification Distributed Denial Of Service

!/usr/bin/perl IoT mDNS/DNS-SD 'QM' amplification ddos Copyright 2017 c Todor Donev [email protected] https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous program is for Educational purpose ONLY. Do not use it without permission. The usual...

IoT mDNS / DNS-SD QM Amplification Distributed Denial Of Service Exploit

IoT mDNS/DNS-SD QM amplification distributed denial of service exploit. !/usr/bin/perl IoT mDNS/DNS-SD 'QM' amplification ddos Copyright 2017 c Todor Donev email protected https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous program is for...

Telit IoT Innovation - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Telit IoT Innovation published at the 'play' market has multiple vulnerabilities...

As Cities Get Smarter, So Should Their Security

TrendMicro Today, more urban centers than ever are implementing a range of advanced technological systems. These sensors and networks used in combination with citizens' mobile devices create smarter cities capable of reduced pollution, increased safety, better engagement with residents and more...

Legislation to Strengthen IoT Marketplace Transparency

Senator Ed Markey D-MA is poised to introduce legislation to develop a voluntary cybersecurity standards program for the Internet of Things IoT. The legislation, called the Cyber Shield Act, would enable IoT products that comply with the standards to display a label indicating a strong level of...

IoT Network Security Analysis Tool: ASTo

IoT Network Security Analysis Tool Apparatus is a security framework to facilitate security analysis in IoT systems. To make the usage of the Apparatus framework easier the ASTo app was created ASTo stands for Apparatus Software Tool. ASTo is based on electron and cytoscape.js . The application i...

Inside Secure MatrixSSL Buffer Overflow Vulnerability (CNVD-2017-15853)

Inside Secure MatrixSSL is an IoT application toolkit from Inside Secure, France, that enables modular implementation of TLS and DTLS. A heap buffer overflow vulnerability exists in the X509 certificate parsing feature in Inside Secure MatrixSSL version 3.8.7b. A remote attacker could exploit thi...

Vulnerability Spotlight: Multiple Vulnerabilities in InsideSecure MatrixSSL

These vulnerabilities were discovered by Aleksandar Nikolic of Cisco TalosOverviewMatrixSSL is a TLS/SSL stack offered in the form of a Software Development Kit SDK that is geared towards application in Internet of Things IOT devices and other embedded systems. It features low resource overhead a...

InsideSecure MatrixSSL x509 certificate IssuerDomainPolicy Remote Code Execution Vulnerability

Summary An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a...

Is Continuing to Patch Windows XP a Mistake?

Last week, Microsoft issued a security patch for Windows XP, a 16-year-old operating system that Microsoft officially no longer supports. Last month, Microsoft issued a Windows XP patch for the vulnerability used in WannaCry. Is this a good idea? This 2014 essay argues that it's not: The zero-day...

In Fear of IoT Security

I wish I had a dime for every time I have heard someone say "With so many vulnerabilities being reported in the Internet of Things, I just dont trust that technology, so I avoid using any of it." I am left scratching my head because these same people seem to have no issues running a Windows...

TP-Link Fixes Code Execution Vulnerability in End of Life Routers

Router manufacturer TP-Link recently fixed a vulnerability in a discontinued line of routers that if exploited could have been used to execute code on the device. Researchers at Senrio, a firm that specializes in IoT security, uncovered a logic vulnerability in a configuration service present in...

Internet-Enabled Drill Demonstrates IoT Security Done Right

To Mark Loveless, an internet-enabled cordless drill seemed like a perfect recipe for an IoT security nightmare. Duo Security’s senior security researcher confessed that it sounded silly and quite possibly part of a push by the electronics maker to inject “smarts” into devices that ultimately...

IoT Malware Activity Already More Than Doubled 2016 Numbers

The number of new malware samples in the wild this year targeting connected internet-of-things IoT devices has already more than doubled last year’s total. Honeypots laid out by Kaspersky Lab researchers mimicking a number of connected devices running Linux have attracted more than 7,200 differen...

Honeypots and the Internet of Things

There were a number of incidents in 2016 that triggered increased interest in the security of so-called IoT or 'smart' devices. They included, among others, the record-breaking DDoS attacks against the French hosting provider OVH and the US DNS provider Dyn. These attacks are known to have been...

Ghost to reproduce: part of the WiMAX routing device to authenticate the existence of the bypass and back door vulnerability-vulnerability warning-the black bar safety net

The SEC's security personnel in some of the WiMAX router on found a vulnerability, this vulnerability allows an attacker to change the router administrator password, and then get on the vulnerabilities of the device control. Worse, if an attacker took control of these contains a vulnerability in...

Open Source LoRa CSS PHY Implementation: gr-lora

Open Source LoRa CSS PHY Implementation LoRa is a wireless LPWAN PHY that is developed and maintained by Semtech. It is designed to provide long range, low data rate connectivity to IoT-focused devices. A reasonable analogy is that LoRa is like cellular data service, but optimized for embedded...

Bridging the Skills Gap with Trend Micro’s Capture the Flag (CTF) Competition

We all know the IT security industry is suffering from chronic skills gaps and shortages around the world. In the US things are no different, with an estimated talent shortfall of around 40,000 jobs for information security analyst roles alone. While various initiatives have been proposed, few ha...

EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 - Remote Code Execution Exploit

Exploit for hardware platform in category web applications !/usr/bin/env python coding: utf8 EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution Vendor: EnGenius Technologies Inc. Product web page: https://www.engeniustech.com Affected version: ESR300 1.4.9, 1.4.7, 1.4.2,...